Setting Up Secondary Domains for Cold Email: What It Protects

Register a domain close to your brand, redirect its website to your main site, and give it its own MX, SPF, DKIM and DMARC records. Create a few inboxes on it, warm them up, and verify every list before sending. A separate domain isolates domain reputation. It doesn't hide your content, links or behaviour.

That last sentence is what most setup guides skip, so it gets its own section below. First, the mechanics.

What a separate domain does and doesn't isolate

Signal	Isolated by a separate domain?	Why
Domain reputation (complaints, bounces against the sending domain)	Yes	Gmail and Yahoo both evaluate senders at the authenticated or From domain level
Gmail bulk-sender count	Yes	Google counts "all messages sent from the same primary domain", and a separate registered domain is a different primary domain
DMARC policy	Yes, which means you have to publish one	Policy is looked up from the From domain, not your main brand
Sending IP reputation	No	If your outreach and your main mail share a provider's IPs, they share IP reputation regardless of domain
Links in the body	No	A link to yourbrand.com in every cold email ties that domain to the campaign. Google's guidelines tell senders to check the Safe Browsing status of "any domains that are linked to yours"
Content and behaviour	No	Yahoo's FAQ says it will "use all of the information available (content, IP, etc.) to review sender compliance"

The point of a secondary domain is that if outreach goes badly, your main domain's reputation is not the one that pays. It is not a way to send mail that would otherwise be filtered. And it doesn't change the rules: Google's sender guidelines say "Don't send messages to people who didn't sign up to get messages from you," which is a candid description of cold email. Gmail's and Outlook.com's published bulk-sender enforcement applies to consumer mailboxes, so B2B outreach to Google Workspace or Microsoft 365 business mailboxes falls outside it, but recipients can still report you, and spam filtering applies to everyone.

The law is separate again. See our posts on CAN-SPAM and GDPR for B2B cold email before you send anything.

Subdomain or separate domain?

	Subdomain (outreach.example.com)	Separate domain (getexample.com)
DMARC	Inherits the parent's policy unless it publishes its own	Needs its own record
Gmail bulk count	Rolls up into example.com	Counted on its own
Reporting	Gmail's Postmaster compliance status is reported for the parent domain	Reported on its own
Recipient trust	Clearly your company	Recognisable only if the name is close to your brand
Best for	Opt-in marketing and transactional streams you want to separate	Cold outreach

For opted-in newsletters and product mail, a subdomain is usually the better choice, because you want the connection to your main brand. For cold outreach, use separate domains.

Choosing the domain

The domain should be obviously yours to a recipient who looks: your brand plus a short word, such as getexample.com, tryexample.com or examplehq.com. Prefer .com or your country's usual TLD.

Avoid two things:

• Anything that imitates another organisation. That includes names close to a customer's or competitor's brand.
• Look-alike characters. Google asks senders to format internationalised domain names according to Unicode Technical Standard #39, which exists to detect confusable characters. A domain using a Cyrillic "а" in place of a Latin "a" looks like phishing because it is the technique phishing uses.

Register it, then point the website at your main site with a permanent (301) redirect, so anyone who types it in or checks it lands somewhere real.

The DNS records each domain needs

Treat every secondary domain as a full sending domain. Each one needs:

Record	Example	Purpose
MX	Your mailbox provider's MX hosts	Replies have to arrive. Microsoft's sender guidance asks that the From address "can receive replies"
SPF	v=spf1 include:_spf.google.com ~all	Authorises your mailbox provider to send for this domain
DKIM	Key from your mailbox provider, 2048-bit	Signs mail with this domain
DMARC	v=DMARC1; p=none; rua=mailto:dmarc@example.com	Required by Gmail, Yahoo and Microsoft for bulk senders. Move to enforcement later
Website redirect	301 to your main site	Recipients and filters see a real destination

Two details catch people out. First, the DMARC record must be on the secondary domain itself. It doesn't inherit anything from your main domain, because in DNS the two are unrelated. Second, keep each domain's SPF record minimal. A cold-outreach domain should only include the provider hosting its inboxes, nowhere near the 10-lookup limit.

Check each domain once it's set up with our deliverability audit. It reads MX, SPF, DKIM and DMARC in one pass. For the DKIM key, generate 2048-bit if your provider offers it. Our DKIM key-length post explains why.

How many inboxes and domains?

Work backwards from the number of new people you want to reach each day. No mailbox provider publishes a "safe" cold-email volume, so you need an assumption, and it should be stated.

For example, Instantly's own setup guide recommends "max 3-5 email accounts" per domain and "only 30-50 emails a day" from each. That's one vendor's guidance, not a provider rule, but it's a published and reasonable starting point. Our post on cold emails per day per inbox goes into the provider limits behind it.

A worked example, using 40 sends per inbox per day and 4 inboxes per domain:

Input	Value
New contacts per working day	100
Emails in the sequence (first email plus follow-ups)	3
Steady-state sends per day (100 x 3)	300
Sends per inbox per day (assumption)	40
Inboxes needed (300 / 40, rounded up)	8
Inboxes per domain (assumption)	4
Domains needed	2

The step most people miss is the multiplier. Once a sequence is running, every day's sends include follow-ups to people contacted in earlier days, so daily volume is roughly new contacts times sequence length. Planning inboxes on new contacts alone undersizes the setup by a factor of three here.

The provider's own limits sit far above these numbers. Google Workspace allows 2,000 messages a day per user, or 500 for trial accounts, and limits each user to 2,000 unique external recipients a day. Microsoft 365 allows 10,000 recipients a day and 30 messages a minute per user, with a tenant-wide external recipient limit. Those are hard ceilings for account safety, not targets for cold email.

Warm-up and the first sends

A new domain and new inboxes have no history, and Google's guidelines say "Avoid introducing sudden volume spikes if you do not have a history of sending large volumes." Start low and increase gradually, as described in our warm-up schedule. Instantly's guide, for example, says to warm up "for at least 2 weeks" before launching campaigns.

Before the first campaign from any domain, verify the list. A new domain has no reputation to absorb a bad first send, and hard bounces are the fastest way to give it a bad one. Our free email checker handles single addresses. For whole lists, clean before you upload.

Maintenance

• Keep every domain renewed, with auto-renew on. A lapsed domain can be re-registered by someone else, along with any replies still arriving.
• Read DMARC reports for each domain. They'll show anything else sending as it.
• Watch reply and bounce rates per domain. If one domain's numbers go wrong, pause it rather than sending the same list through another domain. Moving a bad list to a fresh domain moves the problem, not the cause.
• Retire domains deliberately. If you stop using one, keep it registered and keep the MX so late replies still reach someone.

The practical takeaway

Secondary domains are insurance for your main domain, not a way around filtering. Register names that are clearly yours, give each a complete set of DNS records including its own DMARC, size the number of inboxes from your real daily volume including follow-ups, and verify lists before they go out. Then the main thing a secondary domain has to protect you from is your own targeting, which no DNS record can fix.