Email warmup and cold email deliverability: the 2026 setup guide
How to set up domains, SPF, DKIM and DMARC, warm up new mailboxes, and stay inside Gmail, Yahoo and Outlook's sender rules, so your cold emails land in the inbox.
The best cold email in the world does nothing in a spam folder. Deliverability is the boring foundation under every outbound campaign, and since 2024 the big mailbox providers have turned many "best practices" into hard requirements.
This guide walks through the setup in the order you'd actually do it: domains, authentication, warmup, sending limits, list hygiene and monitoring.
1. Use secondary domains, never your main one
Don't send cold email from the domain your team, customers and invoices use. If a campaign goes badly, you don't want your main domain's reputation to take the hit.
Instead, register one or more secondary domains that are clearly yours, for example getacme.com or acmehq.com for acme.com. Point the website on each one to your main site, so a curious prospect lands somewhere real.
How many? A common, conservative setup is 2–3 mailboxes per secondary domain, with each mailbox sending a modest daily volume. Spreading volume protects you: if one domain has a problem, the others keep working.
Use a real person's name on each mailbox. Inventing sender names erodes trust the moment someone replies.
2. Set up SPF, DKIM and DMARC
These three DNS records prove that your emails really come from you.
- SPF lists the servers allowed to send mail for your domain.
- DKIM adds a cryptographic signature to every email, so receivers can check it wasn't altered.
- DMARC tells receivers what to do when SPF or DKIM fail, and where to send reports. Start with p=none to collect reports, then tighten once everything passes.
Your email provider (Google Workspace, Microsoft 365 or another host) gives you the exact records. Add them before you send a single email.
What the big providers now require
Gmail requires all senders to authenticate with SPF or DKIM. Senders of around 5,000 or more messages a day to Gmail must have SPF, DKIM and DMARC, with the From domain aligned. They must also support one-click unsubscribe for marketing and promotional mail and honour opt-outs within two days, and keep their reported spam rate below 0.3%, ideally below 0.1%. Yahoo introduced matching rules at the same time.
Microsoft (Outlook.com, Hotmail, Live) started enforcing similar rules on 5 May 2025 for domains sending more than 5,000 emails a day: SPF and DKIM must pass, and DMARC must be at least p=none and aligned. Non-compliant mail is rejected with the error 550 5.7.515 Access denied.
Cold outreach from a handful of mailboxes won't hit 5,000 a day. Meet these rules anyway. The thresholds are where enforcement is strict, and below them the same signals still feed into filtering.
3. Warm up new mailboxes
A brand-new mailbox that suddenly sends hundreds of emails looks exactly like a spammer. Warmup is the process of building a sending history gradually.
There are two parts:
- Ramp your real volume slowly. Start with a handful of emails a day and increase over several weeks.
- Generate positive engagement. Warmup services send emails between a network of real inboxes that open them, reply and move them out of spam. That builds a positive signal while your real volume is still low.
A sensible ramp for a new mailbox:
| Week | Warmup emails / day | Real outreach / day |
|---|---|---|
| 1 | 5–10 | 0 |
| 2 | 10–20 | 0–5 |
| 3 | 20–30 | 5–10 |
| 4 | 20–30 | 10–20 |
| 5+ | Keep running at a low level | 20–30 |
Most teams cap cold outreach at roughly 20–30 emails per mailbox per day, then add mailboxes to grow. Keep warmup running in the background after you start.
What warmup can't fix
Warmup builds a reputation. It doesn't protect one. If you then send to unverified lists, write spammy copy or ignore opt-outs, complaints and bounces will undo weeks of warmup in days.
4. Keep your list clean
Bounces are one of the strongest negative signals you can send. Keep hard bounces well under 2% of sends, and lower is better.
- Verify every address before the first email, not after it bounces.
- Treat catch-all addresses with care. A catch-all domain accepts any address, so verification can't confirm the mailbox exists. Send to them in smaller proportions, or not at all on new domains.
- Suppress hard bounces immediately and permanently.
- Respect opt-outs across every campaign and every domain you send from.
5. Write emails that filters (and people) trust
Spam filters and humans dislike the same things:
- Plain text, short and specific. Heavy HTML, images and big signatures look like marketing.
- One link at most in a first email, ideally none. Avoid link shorteners.
- No tracking pixels on cold email. Open tracking adds a remote image and a tracking domain. Privacy features already make open rates unreliable, so the trade-off is poor.
- No spam-trigger formatting: all caps, many exclamation marks, "100% free", fake "Re:" on a first email.
- A real opt-out. An easy unsubscribe is far better than a "report spam" click. That's why Gmail requires one-click unsubscribe for bulk senders.
6. Monitor, and know what to do when it drops
Set up these before you scale:
- Google Postmaster Tools for your sending domains, to see spam rate and domain reputation at Gmail.
- DMARC reports to catch authentication failures and anyone spoofing your domain.
- Your own bounce and reply rates per mailbox. A sudden drop in replies on one mailbox, while others hold steady, usually points to a deliverability problem on that mailbox.
If a mailbox's numbers drop: pause cold sending on it, keep warmup running, check authentication and blocklists, and look at what changed (a new list, new copy, a volume jump). Restart slowly.
A deliverability checklist
- Secondary domains, with web redirects to your main site
- Real sender names on every mailbox
- SPF, DKIM and DMARC published and passing, with aligned From domains
- Two to four weeks of warmup before real volume
- 20–30 cold emails per mailbox per day, sent in the recipient's working hours
- Every address verified, hard bounces suppressed instantly
- Plain-text emails, no open tracking, one-click unsubscribe, postal address in the footer
- Postmaster Tools and DMARC reports monitored weekly
How Imperagent helps
Imperagent sends from your own mailboxes at a safe pace, with per-mailbox daily and hourly limits and minimum gaps between sends. It sends in each recipient's local working hours and verifies addresses before sending. It also adds a List-Unsubscribe header and a postal footer to every email, and suppresses bounces and opt-outs across your whole organisation. Founding members also get a guided mailbox setup. Claim a seat.
Want the bigger picture? Read What is an AI SDR?
Sources
Outbound that runs itself, under your own name.
- Finds and verifies the right people
- Writes from facts you've approved
- Sends from your mailboxes and stops on reply