Cold email infrastructure as code review: domains, inboxes, DNS and warmup

This post contains affiliate links. It is adapted from the Nerdy Joe cold email infrastructure guide. I work with Nerdy Joe.

If you have ever been asked to "just get the outbound emails working," you already know the problem is not the copy. It is infrastructure: domains, mailboxes, DNS, reputation and monitoring. Treat it like any other system you would deploy, with a spec, a checklist and alerts.

The six layers

Layer	What it is	Failure mode if skipped
Sending domains	Separate domains related to your brand	A bad campaign hurts your main domain
Inboxes	Google Workspace, Microsoft 365 or SMTP mailboxes	Too few inboxes forces high volume per inbox
DNS authentication	SPF, DKIM, DMARC, MX, reverse DNS, tracking domain	Mail is rejected or filtered as unauthenticated
Warmup	Gradual low-volume sending	New inboxes at full volume look like spam operations
Rotation and limits	Spreading sends across inboxes with daily caps	One inbox burns while the rest sit idle
Monitoring	Bounces, complaints, placement tests, blacklists	Problems go unnoticed until replies stop

1. Isolate the blast radius with separate domains

Never send cold email from the domain that sends your invoices and support replies. Register lookalikes such as getacme.com or tryacme.com, and forward each one to your main site so a curious prospect lands somewhere real. Stick to mainstream extensions. Instantly's AirMail accepts only .com and .org domains, which says something about how providers treat the rest.

Size it like capacity planning:

domains = ceil(new_prospects_per_day / emails_per_inbox_per_day / inboxes_per_domain)

Vendor defaults put most setups at two to five inboxes per domain. PlusVibe's Google Workspace offer creates 3 inboxes per domain and its Microsoft 365 offer 5, and Instantly allows up to 5 accounts per done-for-you domain.

2. Create the inboxes

Pick Google Workspace, Microsoft 365, SMTP, or a mix. Smartlead and PlusVibe can match sender provider to recipient provider (Gmail to Gmail, Outlook to Outlook), which only works if you run both. Give every inbox a real name, photo and signature.

3. DNS: the part receivers check first

Record	Purpose	Gotcha
MX	Receive replies	Domain looks fake without it
SPF (TXT)	Authorize sending servers	One record per domain, max 10 DNS lookups (RFC 7208)
DKIM (TXT)	Sign each message	Google requires at least 1024 bits and recommends 2048
DMARC (TXT)	Policy plus reporting	Start at p=none with a report address, tighten later
Tracking CNAME	Custom open/click domain	Instantly points to prox.itrackly.com, Smartlead to open.sleadtrack.com
PTR	Reverse DNS for the IP	Google and Microsoft handle it for their inboxes

A starting point for a new sending domain:

example-send.com.         TXT  "v=spf1 include:_spf.google.com ~all"
_dmarc.example-send.com.  TXT  "v=DMARC1; p=none; rua=mailto:[e-mail]"

Then enable DKIM in the Google or Microsoft admin console and publish the record it gives you. Check your work from the shell:

dig +short TXT example-send.com
dig +short TXT _dmarc.example-send.com
dig +short TXT google._domainkey.example-send.com

The acceptance test: send a message to a personal Gmail account, open "Show original" and confirm SPF, DKIM and DMARC all say pass.

Why bother below bulk volume? Google requires all senders to personal Gmail accounts to have SPF or DKIM, valid forward and reverse DNS, TLS, and a spam rate under 0.3% in Postmaster Tools (it recommends under 0.1%). Senders of more than 5,000 messages a day need SPF, DKIM and DMARC with alignment. Microsoft introduced similar rules for outlook.com, hotmail.com and live.com, and according to dmarcian moved from junking non-compliant mail to rejecting it in May 2025. The records cost nothing, so set all three up.

4. Warm up like a canary release

New mailboxes have no history. Ramp slowly. Vendor guidance:

• Instantly recommends 3 weeks for AirMail inboxes, starting at 2 warmup emails on day one, then 4, then 6.
• Smartlead says existing accounts need 2+ weeks and new domains can need 1 to 2 months, with 40 or fewer warmup emails a day for new accounts.
• PlusVibe's default ramp starts at 5 a day, adds 5 a day, and tops out at 50.

Per nerdyjoe.com, Koldify (the agency behind Nerdy Joe) warms inboxes for about three weeks and typically launches campaigns around week four. Keep warmup running after launch.

5. Rate limits and rotation

Source	Guidance
Apollo knowledge base	Start at 50 emails a day per mailbox, 10 to 20 per hour, 60 to 300 seconds apart
Instantly AirMail	Hard cap of 20 emails a day per mailbox
Smartlead API guide	Start at 10 to 15 new leads a day, add 5 to 10 every few days

Use the lowest number as your default and scale horizontally: more inboxes, fewer emails each. Instantly, Smartlead and PlusVibe all rotate senders, so you can drain one unhealthy inbox without stopping the campaign.

6. Monitoring and auto-pause

Weekly checks: bounce rate per inbox, Postmaster Tools spam rate, a placement test, blacklist status, and reply rate per inbox (a sudden drop on one inbox usually means spam placement). Apollo says a bounce rate of 8% or more needs immediate action, so alert lower. Smartlead can auto-pause a campaign at a bounce threshold you set, such as 3% or 5%. PlusVibe can auto-pause on high bounces, and Instantly can pause a mailbox when placement drops or it gets blocklisted (it checks 94 blacklists).

Verify every list before sending. Bounces are the fastest way to burn a new domain.

Common bugs

• Two SPF records on one domain, which makes SPF fail.
• An SPF chain that exceeds 10 lookups.
• Sending from the main domain "just for a test."
• Launching on day one instead of after warmup.
• Raising volume per inbox instead of adding inboxes.

Tooling

If you are picking a sender, the guide prices three routes: Instantly, Smartlead and PlusVibe, with contact data usually coming from Apollo. Prices change, so check the full guide for the October 2026 numbers and the cost worked example.