DEFINITIONS • OUTBOUND INFRASTRUCTURE

Secondary Domain Architecture: DNS Isolation, SPF, DKIM, and DMARC

Sending cold outbound sales messages from your primary company domain is operational malpractice. If spam complaints exceed 0.3%, Google Workspace throttles your entire organization. Invoices, calendar invites, and customer emails drop straight into junk folders.

The Blast-Radius Problem

Major email providers (Google, Microsoft, Yahoo) track sender reputation at the root domain level.

When an SDR runs an automated 500-message sequence from alex@company.com, recipient spam clicks degrade the domain reputation score for every employee at company.com. Once your root domain lands on spam blocklists, recovering inbox placement takes months of administrative intervention.

The engineering solution is secondary domain isolation: purchasing separate lookalike domains dedicated strictly to prospecting.

The Three Mandatory DNS Records

Every secondary outbound domain requires three cryptographic DNS configurations before sending a single message:

  1. 1. SPF (RFC 7208 Sender Policy Framework): Specifies which mail servers can send messages on behalf of your domain. Keep DNS lookups strictly under the 10-query limit:
    v=spf1 include:_spf.google.com ~all
  2. 2. DKIM (RFC 6376 DomainKeys Identified Mail): Signs outgoing email headers with a 2048-bit asymmetric private key, allowing recipient servers to verify the message was not altered in transit.
  3. 3. DMARC (RFC 7489 Domain-based Message Authentication): Instructs receiving mail servers how to treat messages that fail SPF or DKIM checks, per DMARC.org standards:
    v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc-reports@yourdomain.com

Volume Limits and Horizontal Mailbox Scaling

Spam filters penalize sudden spikes. To build predictable deliverability:

  • Warmup Period: Run 14 to 21 days of automated warmup exchanges before starting cold sequences. Ramp volume gradually from 5 to 30 emails per day.
  • Per-Mailbox Ceiling: Never exceed 30 to 50 cold messages per mailbox in a 24-hour window.
  • Horizontal Scale: To send 300 emails per day, set up 6 mailboxes across 2 secondary domains (50 emails × 6 inboxes) rather than 1 mailbox sending 300.
  • Root Web Redirect: Put a permanent 301 HTTP redirect on each secondary domain pointing directly to your primary website root. Curious prospects who type the secondary domain into a browser land on your main product site.

For pricing models on marketing database storage versus email transport, see our breakdown of The Contact-Tier Tax.

Size Your Outbound Architecture

Calculate the exact number of secondary domains, mailboxes, and monthly warmup costs required for your target pipeline:

Size Outbound Pipeline on the Free Sizer →