Managing DNS for Many Cold Email Domains Without Mistakes

The safe way to run DNS for many cold email domains is one record template, filled in per domain, applied with a tool you understand, then checked in bulk. MX, SPF and DMARC are normally the same on every domain apart from the name. DKIM is the one record that differs, because each inbox provider generates a key per domain, so it goes in last and by hand. Bulk tools save hours but can replace records you meant to keep, so export first. After every change, check all domains in one pass instead of trusting your eyes.

For the records themselves and the order to add them, see our cold email domain setup guide. For how many domains you need, see how many domains for cold email. This post is about doing it at scale.

Step 1: write one template

Write the records once, with placeholders. An example for domains whose inboxes are on Google Workspace and that send only from those inboxes:

Type	Host	Value	Per domain?
MX	@	1 smtp.google.com	Same
TXT (SPF)	@	v=spf1 include:_spf.google.com ~all	Same
TXT (DMARC)	_dmarc	v=DMARC1; p=none; rua=mailto:dmarc@{yourmaindomain}	Same
TXT (DKIM)	google._domainkey	Key from the Google admin console	Different
CNAME (tracking)	track	Your sequencer's tracking host	Same, if you use custom tracking
Redirect	@ / www	Your main website	Same

Check current values against your provider's own setup page before you copy them, because providers update their recommended records. Our free SPF generator and DMARC generator produce valid records, and the Google Workspace MX records page lists Google's current MX.

Two template rules:

• One SPF record per domain. If a sending tool also sends from the domain, add its include to the template rather than adding a second TXT record. Count lookups with the SPF lookup counter; the limit is 10.
• One DMARC record per domain, starting at p=none with a reporting address you actually read.

Step 2: choose how to apply it

Method	Good for	Watch out for
By hand in the registrar's DNS panel	Up to a handful of domains	Typos; forgetting one record on one domain
Registrar bulk tool (e.g. Namecheap bulk host records)	Same records on many domains at one registrar	It may replace existing records
Zone file import (e.g. Cloudflare)	Moving many records at once into a fresh zone	Rate limits; checking what was imported
DNS provider API or infrastructure-as-code	20+ domains, or frequent changes	Needs a token with write access; test on one domain first

Namecheap bulk host records

Namecheap lets you select domains in the Domain List and apply host records to all of them through Actions → DNS/Host Records, on its BasicDNS. Its own article warns that "the bulk host records update will replace current DNS settings" and that it will not be possible to restore them (Namecheap, updated 23 April 2025). Mail settings (MX) are a separate option in the same flow. So include every record a domain needs in the bulk update, not just the one you are adding, and note the current records first.

Cloudflare zone import and API

Cloudflare imports records from a BIND-format zone file in the dashboard (DNS → Records → Import and Export) or through the API at POST /zones/{zone_id}/dns_records/import, using a token with DNS Write permission. Its documentation lists a 256 KiB file limit and an API rate limit of three import requests per minute per user (Cloudflare, updated 16 April 2026). For 30 domains that means about ten minutes of imports, which is fine if your script waits between calls.

A zone file from the template, for one domain:

example-send.com.          3600 IN MX  1 smtp.google.com.
example-send.com.          3600 IN TXT "v=spf1 include:_spf.google.com ~all"
_dmarc.example-send.com.   3600 IN TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

Generate one file per domain with a find-and-replace on the domain name, and leave DKIM out of it.

Moving nameservers

If you move domains to a different DNS provider, do it before you add records, and before the domains carry live campaigns. A nameserver change takes time to spread; check it with the DNS propagation checker.

Step 3: add DKIM per domain

DKIM is generated by the inbox provider for each domain: in Google Workspace under Gmail authentication, in Microsoft 365 in the Defender portal. The value is long and easy to break when pasted. For each domain:

1. Generate the key in the provider's admin console.
2. Add the TXT (Google) or CNAME records (Microsoft) at the selector host the provider shows.
3. Start authentication in the provider's console.
4. Check it with the DKIM checker.

Our setup guides for Google Workspace DKIM and Microsoft 365 DKIM go through each console.

Step 4: keep an inventory

A sheet with one row per domain saves the most time later:

Column	Why
Domain
Registrar and renewal date	Expired sending domains are a common, avoidable outage
DNS host	Where to make changes
Inbox provider and number of inboxes	Ties DNS to the accounts sending from it
DKIM selector	Needed to check DKIM
Date records last changed	Matches a deliverability change to a DNS change
Status: warming, live, resting, retired	See when to retire a cold email domain

Keep retired domains registered with working MX for a while, so replies and bounces from old campaigns still arrive.

Step 5: check all domains in one pass

After any change, and weekly:

• Bulk email authentication checker: SPF, DKIM and DMARC for a list of domains.
• Bulk DNS lookup: MX and other records across the list.
• Bulk domain expiry checker: renewal dates.
• Blacklist check: domain blocklists, one at a time.

What to look for: a domain missing one record, two SPF records on one domain, a DMARC record at the wrong host, a DKIM selector that does not resolve, and any domain whose MX does not match the template.

Common mistakes at scale

Mistake	What happens
Bulk update replaced the MX	Replies stop arriving; nobody notices for days
Second SPF record added for a new tool	SPF fails with permerror on that domain
DKIM key truncated when pasted	DKIM fails; mail from that domain loses alignment
DMARC rua pointing at an inbox nobody reads	You never see authentication problems
Domain renewal missed	All inboxes on it stop sending and receiving

Where SimpleVerifier fits

Correct DNS gets your mail accepted. Verified lists keep it from bouncing. Use the free bulk checkers above for the domains, then upload your lead list on the verify page; the first 100 checks are free with a Google sign-in. Pro is $39 a month with the first 100,000 checks a month at full speed, then slower, never cut off. See pricing.