Cold email infrastructure setup: domains, inboxes, DNS and warm-up

What Google, Yahoo and Outlook require

All three publish rules for high-volume senders: Google, Yahoo and Outlook. The table summarizes what each page said when we checked on 18 October 2026.

Three details change how you plan. Google counts messages from the same primary domain together, so 2,500 from the domain and 2,500 from a subdomain make you a bulk sender, and bulk sender status has no expiration date. Yahoo and Google both name one-click unsubscribe for marketing mail, and Yahoo says an unsubscribe not honored within 2 days fails the requirement. Outlook's post said that after 5 May 2025 it would route mail from non-compliant high-volume domains to Junk, with rejection planned for a later date to be announced, using the error "550; 5.7.515 Access denied."

Google also says enforcement is gradual and progressive, and that it began ramping up enforcement on non-compliant traffic in November 2025. Failures show up as temporary or permanent errors (4.7.x and 5.7.x codes) or as spam foldering.

Domains and mailboxes: how many you need

Use secondary domains for cold outreach so a reputation problem never touches the domain your team uses for customer mail. Microsoft's guidance for services outside your direct control is the same: put them on a subdomain so problems there do not affect the main domain's reputation. A close variant of your brand domain is the common choice.

Smartlead publishes the clearest volume guidance we have seen from a sending platform. It recommends up to 50 cold emails per mailbox, says anything above that is "in the danger zone for most cold email programs," keeps each domain under about 500 cold emails a day, and suggests spreading volume across 3 to 5 domains. Its example: 400 emails from eight warmed mailboxes on one domain is usually fine. Its benchmark page, covering more than 850 million emails from January to June 2026 (both Smartlead pages checked 18 October 2026), shows the median mailbox sends 14 a day and the heaviest 10 percent send 42.

This is arithmetic, not a rule. We plan to run below the per-mailbox cap so one bad day has room. The same arithmetic sits behind our work for an AI-feedback SaaS company that sent 1,000+ emails a day across multi-inbox infrastructure and booked 40+ meetings a month (case study), and behind Rapid Lanyard's 39 domains (case study).

Google Workspace or Microsoft 365

Both providers publish sending limits. Google Workspace allows 2,000 messages a day per paid user (1,500 for mail merge), and trial accounts get 500 messages and 500 unique external recipients a day. Google says limits for a trial domain lift once it has cumulatively paid at least $100, which can take up to 75 days. A user who hits a limit cannot send for up to 24 hours (Google Workspace help, checked 18 October 2026).

Exchange Online caps each mailbox at 10,000 recipients a day and 30 messages a minute. Microsoft's own documentation says Exchange Online "isn't suited to accommodate bulk-mailing scenarios." Trial tenants are capped at 5,000 external recipients a day, and mail from default onmicrosoft.com domains is throttled to 100 external recipients per organization in a rolling 24 hours (Microsoft Learn, checked 18 October 2026). Microsoft 365 also screens outbound mail: messages it judges to be spam leave through a separate high-risk delivery pool, and the default policy blocks a user who reaches a sending limit until the next day.

Sending platforms sit on top of these mailboxes, and our Smartlead vs Instantly comparison covers two of them. Every one of the limits above is higher than 50 messages a day. The ceiling that matters is reputation. We split inboxes between the two providers on larger programs, as we did for Rapid Lanyard, so a filtering problem at one provider does not stop the whole program.

The DNS records, step by step

Publish records on every sending domain and subdomain. Each needs its own.

1. SPF. One TXT record per domain. For Google Workspace alone, Google's record is v=spf1 include:_spf.google.com ~all, and Google recommends the soft-fail ~all. For Microsoft 365 alone, Microsoft's record is v=spf1 include:spf.protection.outlook.com -all, and Microsoft recommends the hard-fail -all because DKIM and DMARC are also in place. Two SPF records on one domain return a permanent error. RFC 7208 allows 10 DNS-querying terms per check (include, a, mx, ptr, exists and redirect count; ip4, ip6 and all do not), and going over also returns a permanent error. A sending tool adds its own include, so count lookups before you add it.
2. DKIM. Google: generate the key in the Admin console, choose 2048 bits if your DNS host supports it, and publish a TXT record at google._domainkey with the value v=DKIM1; k=rsa; p=your key. Google says to expect up to 48 hours before it works, and you must wait 24 to 72 hours after turning on Gmail before the key is available. Microsoft: publish two CNAME records, selector1._domainkey and selector2._domainkey, with the values the Defender portal gives you, then enable signing. Microsoft's PowerShell documentation lists 1024 as the default key size with 2048 as an option. Google and Yahoo both say 1024 bits is the minimum.
3. DMARC. A TXT record at _dmarc.yourdomain.com. Google says to turn on SPF or DKIM first, wait at least 48 hours, then start with p=none. A usable starting record is v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. Google recommends sending reports to a dedicated mailbox or a reporting service, not your own address, and notes that Gmail does not support the ruf tag. Subdomains inherit the parent policy unless you set sp. Once reports show your own mail passing, move to quarantine or reject.
4. Alignment. The From domain must align with the SPF or DKIM domain. Relaxed alignment is the default and, per Google, usually gives enough protection.
5. Test. Send from each mailbox to a Gmail or Workspace address that is not yours, open the original message and read Authentication-Results. A passing DKIM result shows dkim=pass.

The tags above come from Google's help page. RFC 7489, which defined DMARC, is an informational document that the RFC Editor page now marks as obsolete, replaced by newer RFCs.

Warm-up and the volume ramp

A new mailbox has no sending history. Warm-up tools trade emails between a pool of mailboxes to build engagement before cold volume begins. Instantly's suggested settings for a newly created account are a daily warm-up limit of 10, an increase of 1 a day, and a 30 percent reply rate, and it advises keeping the defaults and leaving "Disable slow warmup" off for new accounts (Instantly help center, checked 18 October 2026).

Then ramp cold volume in steps. Smartlead says a new mailbox should start below its cap once warm-up is done and build up, and it flags going from zero to 50 in the first week as a spam-triggering pattern. It adds that mailboxes in months 10 to 12 typically send at 70 to 80 percent of peak capacity. Smartlead does not state a warm-up length, so we do not quote one. Hold each volume step until bounces and spam rate look normal, then take the next.

Before launch, check three things per domain: all three DNS records pass, the mailbox sends and receives, and the bounce rate on a small first batch stays well under 2 percent, the line Smartlead's data marks as dangerous. The deliverability playbook covers monitoring after launch, and the full cold email playbook shows where infrastructure fits in the system. For tools that automate warm-up, see our ranked list of email warm-up and deliverability tools. Our cold email systems service builds this setup in client-owned accounts.

Questions

How many domains and mailboxes do I need for 1,000 cold emails a day?

At Smartlead's cap of 50 per mailbox you need at least 20 mailboxes, and at 400 a day per domain about three domains. Smartlead suggests spreading volume across 3 to 5 domains (checked 18 October 2026).

Do I need DMARC at p=reject for cold email?

No. Google says the DMARC policy for bulk senders can be none, Yahoo asks for at least p=none, and Outlook asks for at least p=none. Google recommends starting at none and tightening later.

Should my SPF record end in ~all or -all?

Google recommends ~all for Google Workspace and Microsoft recommends -all for Microsoft 365 when DKIM and DMARC are also set up. Either passes the providers' requirements. Use one SPF record per domain and keep it under 10 DNS lookups.

Is Google Workspace or Microsoft 365 better for cold email?

Neither is built for it, and both have sending limits far above the 50 per mailbox a day that sending platforms advise. We split inboxes across both on larger programs so one provider's filtering does not stop everything.