Cold email still works in 2026, but the margin for error is thin. The filters are smarter, the thresholds are lower, and a new domain gets no benefit of the doubt. Do the setup properly and pace yourself and it is one of the cheapest channels there is. Rush it and you will burn a domain, and your real email with it. This is the short version of everything that matters.
01 Why domains get burned
A burned domain is one that inbox providers have quietly decided not to trust. Your mail still sends, but it lands in spam or is rejected outright, and there is rarely a warning. The important thing to understand: reputation attaches to the domain, not the individual message. One bad week poisons everything you send from that domain afterwards.
Almost all of the damage traces back to four avoidable mistakes:
- Starting volume too high. A brand new domain has no history. Send fifty emails on day two and the filters assume the worst.
- Dirty lists. Bounces are the fastest way to burn. Twelve bounces out of fifty sends is a 24% bounce rate on a domain with zero reputation. Verify every address first.
- Skipping authentication. Without SPF, DKIM and DMARC resolving cleanly, providers cannot tell your mail from a spoof, and it amplifies the damage from every other problem.
- Ignoring the signals. Bounce and spam-complaint rates are measured continuously. Cross the thresholds and enforcement is automatic and domain-wide.
Never send cold from your primary domain. It will burn within 30 days and take the mailbox your team relies on for real business down with it. Cold outreach lives on dedicated sending domains, always.
02 Setup and authentication
Before a single cold email goes out, get the foundation right. This is an afternoon of work that saves you weeks.
Buy dedicated sending domains
Keep your primary domain completely separate. Register look-alike secondaries, for
example try-acme.com or acme-hq.com, and redirect them to your
main site so they resolve like a real business.
Set up SPF, DKIM and DMARC on every domain
All three, resolving cleanly, before day one. SPF says which servers may send for you.
DKIM is a cryptographic signature proving the message is really yours and unaltered. DMARC
ties them together. Start DMARC at p=none while you confirm passes, then move
to p=quarantine or p=reject.
Plan a small fleet of mailboxes
One mailbox is not enough. Spread volume across several mailboxes on your sending domains so no single inbox ever carries too much.
2026 reality: mail from domains without correct SPF, DKIM and DMARC is increasingly rejected by the big providers, not just filtered to spam. Authentication is the price of entry, not an optimization.
Do it once, do it right
SPF, DKIM and DMARC, step by step
This is the part everyone finds intimidating, and it is genuinely a 20 minute job once you know where to click. You add three small text records to your domain, one time, before you send a single email. No developer needed, and no command line. Follow it in order and do it for every sending domain you own.
First, in plain English, what the three records are:
- SPF is a public list of the servers allowed to send mail for your domain. It stops other people from sending as you.
- DKIM is a tamper-proof signature stamped on every message. It proves the mail genuinely came from you and was not altered on the way.
- DMARC is your instruction to the world: if a message claims to be from your domain but fails the two checks above, here is what to do with it.
The three records at a glance. These are the exact values to enter. They assume Google Workspace, which is what most PitchButler mailboxes run on. If you send through another provider, only the SPF and DKIM values differ; the names and the method are identical (see the note below the steps).
| Record | Type | Name / Host | Value to enter |
|---|---|---|---|
| SPF | TXT | @ | v=spf1 include:_spf.google.com ~all |
| DKIM | TXT | google._domainkey | Generated in your mail admin (step 3) |
| DMARC | TXT | _dmarc | v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com |
Open your domain's DNS panel
DNS records live wherever you bought the domain: GoDaddy, Namecheap, Cloudflare, Squarespace and the rest. Log in, find the domain, and open the page called DNS, DNS records or Manage DNS. Everything below is added here, and the button you want is almost always labelled Add record.
Add the SPF record
Create one TXT record. For Name / Host enter @ (some panels want the field left blank instead, which means the same thing). For Value paste v=spf1 include:_spf.google.com ~all and save. One rule that trips people up: a domain may have only one SPF record. If one already exists, edit that record rather than adding a second.
Generate and add the DKIM record
DKIM is the only one you cannot simply copy from this page, because it carries a key unique to you. In Google Workspace, go to admin.google.com and open Apps, then Google Workspace, then Gmail, then Authenticate email. Pick your domain, click Generate new record, choose the 2048 key length, and leave the prefix as google. Google then shows you a Host (google._domainkey) and a long Value beginning v=DKIM1;. Add that as a TXT record in your DNS, wait a few minutes, then return to the same Google page and click Start authentication.
Add the DMARC record
Create one more TXT record. For Name / Host enter _dmarc. For Value paste v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com, swapping in a real inbox you actually check. Starting at p=none is deliberate: it switches on reporting without blocking anything, so you can confirm the first two records pass before you tighten the screws. You do that in the last step.
Wait, then confirm all three pass
DNS changes take anywhere from a few minutes to a couple of hours to spread. Once they settle, send an ordinary email from a mailbox on that domain to any Gmail address you own. Open it in Gmail, click the three-dot menu, choose Show original, and look for SPF: PASS, DKIM: PASS and DMARC: PASS. Three green passes and the domain is authenticated. If one fails, it is nearly always propagation, so wait and check again before changing anything.
Then tighten DMARC over the next week or two
Once your real mail is passing cleanly at p=none, walk the policy up one rung at a time.
Never jump straight to reject on a live domain; you want to be sure nothing legitimate is failing first.
| Stage | Set policy to | What happens to mail that fails |
|---|---|---|
| 1. Monitor | p=none | Nothing is blocked. You collect reports and confirm your real mail passes. |
| 2. Quarantine | p=quarantine | Failing messages go to spam. Watch it for about a week. |
| 3. Enforce | p=reject | Failing messages are rejected outright. This is the target for every sending domain. |
Not on Google Workspace? (Outlook, Microsoft 365, another provider)
The method is identical, only two values change. Your provider's admin console generates the
DKIM record for you exactly the way Google does, so grab it from there instead of step 3. For SPF,
swap Google's include for your provider's: Microsoft 365, for example, uses
v=spf1 include:spf.protection.outlook.com -all. DMARC is provider-independent, so the
_dmarc record above is the same everywhere. If you genuinely do not know who sends your
mail, search your provider's help centre for "SPF and DKIM setup" and paste the record they give you
into the very same DNS panel.
The three mistakes behind almost every failure: adding a second SPF or DMARC record
instead of editing the one that already exists; letting the DNS panel double up the name, so
_dmarc quietly becomes _dmarc.yourdomain.com.yourdomain.com (when in doubt,
type just _dmarc); and declaring it broken after two minutes. Give DNS a full hour before
you worry.
Do this on every domain, no exceptions. Authentication is per-domain, not per-account. A sending domain missing even one of the three records is treated as unauthenticated, and in 2026 that increasingly means rejected before it ever reaches a spam folder.
03 Warming up
Warm-up is not optional and it is not instant. Budget 3 to 4 weeks minimum before any real campaign. You are teaching the filters that people want your mail.
- Start at around 5 sends per day per mailbox.
- Ramp gradually to about 25 by the end of the first week, then keep climbing slowly over four to six weeks.
- Send only to people who will actually open and reply: colleagues, friends, existing contacts.
- Plain text only. No images, tracking pixels or heavy HTML during warm-up. They depress the exact engagement signals warm-up exists to build.
- Space sends a few minutes apart. Never blast.
- Aim for 90%+ opens, 50%+ replies and zero spam complaints in this phase.
When the ramp is done, run an inbox placement test to confirm where your mail actually lands before you scale up.
04 Sending limits and the volume math
The single most important number: keep per-mailbox volume low. The safe range for cold sending is roughly 30 to 50 emails per mailbox per day.
If you need more capacity, you add mailboxes and domains. You never raise per-inbox volume. Most teams run three to five warmed mailboxes and spread the load across them. Sudden spikes in sending velocity are one of the clearest spam signals there is, so growth in total volume should come from more inboxes sending a little, not a few inboxes sending a lot.
05 Building a campaign that gets replies
Volume is not the lever. Precision is. The gap between an average campaign and a great one is targeting and relevance, not send count.
Targeting
Build a narrow Ideal Customer Profile before you build a list. Reaching just one or two of the right people per company yields materially higher reply rates than blasting ten-plus contacts at the same account. Fewer, better-chosen recipients wins every time.
Personalization that works
Merge tags are not personalization. What moves reply rates is relevance to the prospect's actual situation: their role, a recent company event, a growth signal, a specific problem they likely have. Reference context, not compliments. Genuinely relevant, well-targeted campaigns pull reply rates into the 15 to 30% range against the 1 to 5% of generic blasts.
06 Copy that gets replies
Keep it short and human. You are starting a conversation, not closing a deal in message one.
- 50 to 125 words is the sweet spot. Keep first touches under 80.
- Plain text. Heavy HTML and image-stuffed templates read as marketing and trip filters.
- One clear idea, one soft ask. Make the reply easy.
- Lead with them, not you. Their problem in the first line beats your product in the first line.
07 Sequences and follow-ups
Plan a sequence of 4 to 7 emails over two to three weeks. Follow-ups do real work: roughly 58% of replies come from the first email and the remaining 42% from the follow-ups, so the ones who ignore the opener are worth a second and third touch.
- Each follow-up should add a new angle or a new piece of value, never just "bumping this to the top of your inbox".
- Space them two to four days apart at first, then widen the gaps.
- Stop the moment someone replies or opts out. A follow-up after a reply reads as a robot.
08 The numbers that matter
Watch these continuously. Crossing a red line triggers automatic, domain-wide enforcement from Gmail, Yahoo and Microsoft, so they are worth pausing over.
| Metric | Aim for | Red line |
|---|---|---|
| Bounce rate | Under 1.5% | Over 3% in week one; 5% = stop |
| Spam complaints | Under 0.1% | 0.3% triggers enforcement |
| Reply rate | 8 to 12% (25%+ if dialed in) | Under 3% means retarget |
| Open rate (warm-up) | 90%+ | Below 70% = weak list |
| Volume per mailbox | 30 to 50 / day | Sudden spikes read as spam |
09 Pre-launch checklist
Before you turn a campaign on, run down this list. If any line is unchecked, you are not ready.
- Dedicated sending domain bought, separate from your primary.
- SPF, DKIM and DMARC all resolve cleanly.
- DMARC set to
p=quarantineorp=reject. - Every address on the list verified.
- Warm-up ramp run for three to four weeks.
- Inbox placement test passed.
- Per-mailbox cap set to 30 to 50 a day.
- Plain text, no tracking pixels or heavy HTML.
- ICP defined; one to two contacts per company.
- Follow-up sequence written, each touch adds value.
- Opt-out honored permanently on every send path.
10 How PitchButler handles this for you
This is the whole reason PitchButler exists. You should not have to hold all of this in your head on every send, so the engine does it by default.
Warm-up and rotation, automatic
We ramp new mailboxes slowly, rotate a fleet, and freeze or pause any domain that starts to look unhealthy, all without you touching a dial.
Limits and pacing, enforced
Per-mailbox daily caps, human pacing inside your chosen hours, and volume spread so no inbox ever spikes. Every send is gated behind SPF, DKIM and DMARC checks and a live send window.
A kill switch on your reputation
Bounce and complaint rates are watched continuously, and a kill switch pauses all outbound at the first spike, before a domain burns. Opt-outs are permanent and always honored.
Replies read and handed off
Every reply is read by AI, qualified, and handed to a human at exactly the right moment. You bring the offer and the list; we keep the infrastructure healthy and the conversations moving.
11 Quick questions
How long does warm-up really take?
Three to four weeks minimum. Start at about five sends a day per mailbox, ramp to roughly twenty-five by the end of week one, then climb slowly over four to six weeks before running at full volume. There is no safe shortcut.
What bounce rate actually burns a domain?
Keep it under 2%, ideally under 1.5%. Above 3% in your first week is a warning and above 5% is a stop-everything signal. Sustained bouncing is treated as a spam trigger across the whole domain, not just one campaign.
Can I just send from my company's main domain?
No. Because reputation attaches to the domain, one rough stretch poisons everything, including your team's real email. Always use dedicated sending domains kept separate from your primary.
How many emails a day is safe?
Roughly 30 to 50 per mailbox per day for cold outreach. To scale, add mailboxes and domains rather than pushing more through one inbox. Velocity spikes are a spam signal in themselves.
Want the deeper dives? The blog goes further on SPF, DKIM and DMARC, deliverability, and cold email best practices.