How Agencies Set Up Hundreds of Cold Email Inboxes Without Getting Domains Burned
Agencies avoid burned domains by making the domain disposable and the volume invisible: they send from cheap secondary domains that carry no business value, put only 2–3 mailboxes on each domain, cap each mailbox at roughly 20–30 sends per day, and authenticate every domain with aligned SPF, DKIM, and DMARC. When a domain does degrade, they retire it and replace it from a spare pool. The client's primary domain was never in the sending path, so nothing of value is lost.
Everything below is the operational detail behind that sentence: the math for sizing a fleet, what actually causes reputation damage (it is almost never raw volume), and how to run 100+ domains without manually touching each one.
What is the actual architecture agencies use to run hundreds of inboxes?
Every high-volume cold email setup is the same four-layer stack. Get the layering right and scale becomes arithmetic instead of guesswork.
- Layer 1: the primary domain. The client's real website and real email. It never sends cold email and never appears in any sending domain's SPF record. It is the asset you are protecting.
- Layer 2: secondary sending domains. Cheap, purpose-bought domains that exist only to send outbound. Each one is expendable by design.
- Layer 3: mailboxes. Real, individually addressable mailboxes on Google Workspace or Microsoft 365, 2–3 per sending domain, each with a distinct human name.
- Layer 4: the sending tool. Instantly, Smartlead, ReachInbox, or similar. This is where rotation, throttling, and warmup actually happen.
The sizing formula
Work backwards from daily send volume:
- Mailboxes needed = target daily sends ÷ sends per mailbox per day (use 25 as a safe planning number)
- Domains needed = mailboxes ÷ 3
- Spare capacity = add 15–20% more domains than you need, unwarmed and on the bench
A worked example for an agency that needs 5,000 sends per day:
- 5,000 ÷ 25 = 200 mailboxes
- 200 ÷ 3 = 67 sending domains
- Plus ~12 bench domains = ~79 domains total
Notice what this architecture does: 5,000 daily sends are spread so thin that no single domain sends more than about 75 messages a day. That is indistinguishable from a small sales team doing normal work. The provider-side daily caps (Google Workspace allows 2,000 messages per user per day) are irrelevant here. You will never come close, and you should not want to.
Why do cold email domains actually get burned?
Volume is the thing people blame and almost never the cause. Mailbox providers are reacting to recipient behavior and technical signals. In rough order of how often they kill a domain:
- Bounce rate from a bad list. The fastest way to destroy a fresh domain. Hard bounces above 2–3% tell filters you are working from scraped or stale data. Sustained double-digit bounce rates on a new domain can end it in under a week.
- Spam complaints. Google's bulk sender guidance sets the bar at a spam rate below 0.3%, and recommends staying under 0.1%. That is roughly one complaint per thousand messages. Bad targeting blows past it easily.
- Shared tracking domains. The most common invisible killer. If every campaign for every client routes links through one shared tracking domain, that domain accumulates the combined reputation of all of them. One client's bad list poisons every other client's links. Per-sending-domain tracking CNAMEs, or no link tracking at all, fixes this.
- Broken or unaligned authentication. Missing DKIM, an SPF record that exceeds the 10 DNS lookup limit in RFC 7208, or a DMARC record that doesn't align with the visible From address.
- Bad IP neighborhoods. Shared outbound IPs mean you inherit strangers' behavior. Dedicated IPs mean your reputation is yours.
- Identical content fingerprints. The exact same body text sent from 200 mailboxes is a trivially detectable pattern. Real variation in the opening line and body matters more than spintax on individual words.
- Ramping too fast. A domain registered on Monday that sends 40 cold emails on Tuesday looks exactly like what it is.
- Provisioning through unauthorized channels. Mailboxes created outside legitimate reseller channels (shared tenants, bulk-abused trials, grey-market accounts) get suspended in batches when the provider notices. This risk is invisible until your entire fleet goes dark at once.
How many mailboxes should go on one domain?
Two to three. The reason is blast radius, not cost.
Reputation is evaluated substantially at the domain level. If a domain degrades, every mailbox on it degrades with it. Ten mailboxes on one domain means one bad list takes out ten sending slots. Three mailboxes means you lose three, and you swap in a bench domain the same afternoon.
Three mailboxes per domain also happens to look like a real small company: a founder, an SDR, and an ops person. Fifteen mailboxes on a two-month-old domain does not.
Do email aliases count as separate mailboxes?
No, and this is worth being precise about because aliases are marketed as a cost hack. An alias routes through the same underlying mailbox: it shares that mailbox's sending reputation, its throttle limits, and its fate. If the parent mailbox is restricted, every alias on it stops working simultaneously. Aliases are useful for catching reply variants and inbound routing. They are not a way to multiply sending capacity, and treating them as one concentrates risk in exactly the way this whole architecture exists to avoid.
Which domains should you buy, and which will burn on day one?
Rules that hold up in practice:
- Never send from the client's primary domain. Not once, not for "just a small test."
- Use recognizable variants, not confusing impersonations:
getacme.com,acmehq.com,acme.io,try-acme.com. The prospect should be able to connect it to the brand when they check. - Prefer .com, then .co and .io. Avoid the TLDs with the worst abuse histories:
.xyz,.top,.click,.info,.biz. You are starting from a reputation deficit before you send anything. - Stand something up on the domain. A one-page landing site or a 301 redirect to the client's main site. A sending domain that resolves to nothing is a signal.
- Age the domain before real sending. Register, configure DNS, and let it sit for 2–4 weeks while warmup runs. Registration-to-first-cold-send is a feature filters look at.
- Don't buy expired domains for outbound. You inherit whatever the previous owner did, including existing blacklist entries.
- Keep all domains at one registrar with a usable API (Cloudflare and Namecheap are the common choices). At 80 domains, manual DNS editing stops being viable.
Should you use Google Workspace, Microsoft 365, or your own SMTP?
Use Google Workspace and Microsoft 365, mixed. Their outbound reputation is strong, they land well at their own destinations, and mixing both lets you route Gmail-heavy prospect lists through Workspace mailboxes and Outlook-heavy lists through 365 mailboxes.
Self-hosted SMTP on a VPS is cheaper per mailbox and worse at almost everything that matters: you start with zero IP reputation, you are responsible for PTR records and blacklist remediation, and consumer inboxes treat a fresh VPS IP with justified suspicion. It can work, but it is an infrastructure project, not a cost saving.
Why the provisioning channel matters more than the price
This is the part that determines whether a 300-mailbox fleet survives. Mailboxes sold cheaply are sometimes created through channels the providers do not sanction, or held inside a tenant you don't control. Two failure modes follow: mass suspension when the provider acts on the pattern, and no recourse when it happens, because the accounts were never yours.
What to require from any mailbox vendor, regardless of who you buy from:
- Authorized reseller provisioning of genuine Google Workspace and Microsoft 365 accounts
- Full admin access to the tenant, and documented ownership of it
- Dedicated outbound IPs, with a region you choose, so you aren't sharing reputation
- The ability to leave and keep the mailboxes and domains
This is the specific gap Inboxlogy fills: authorized Google Workspace and Microsoft 365 mailboxes on dedicated US or EU IPs, with 100% ownership and admin access handed to you, SPF/DKIM/DMARC configured automatically at provisioning, and a full API for programmatic setup, from $2.80 per mailbox per month, $0 setup, billed monthly. That combination matters to an agency because "cheap mailboxes" and "mailboxes you actually own" are usually not the same product, and you only find out which one you bought when something goes wrong.
How do you set up SPF, DKIM, and DMARC correctly across dozens of domains?
Every sending domain needs all three, and they need to be consistent. The specifics:
- SPF: one record per domain, and only the providers that actually send. For Workspace:
v=spf1 include:_spf.google.com ~all. For Microsoft 365:v=spf1 include:spf.protection.outlook.com -all. Do not stack sixincludestatements "just in case." You will hit the 10 DNS lookup limit and the record will fail. Critically: never add the client's primary domain to a sending domain's SPF record, or vice versa. That link is how reputation leaks between layers. - DKIM: generate and publish a 2048-bit key per domain, and confirm it is actually enabled in the admin console. Generating the key without turning on signing is the single most common misconfiguration.
- DMARC: start at
v=DMARC1; p=none; rua=mailto:[email protected], read the reports for a week or two, then move top=quarantine. Alignment is the point: the domain in the visible From address must match the DKIM signing domain. - Custom tracking domain: a CNAME on each sending domain (e.g.
links.getacme.com) pointed at your sending tool's tracking host. Per-domain, never shared across clients. - Unsubscribe handling: include a plain-text opt-out line, honor it immediately, and use your tool's list-unsubscribe header support. Google's bulk sender requirements mandate one-click unsubscribe above 5,000 daily messages to Gmail. Per-domain you are far below that, but honoring opt-outs is what keeps complaint rates down, which is the actual goal.
At 60+ domains, do this through your registrar's API or a provider that configures DNS at provisioning time. Hand-editing zone files across dozens of domains produces exactly the kind of silent single-domain misconfiguration that is hardest to find later.
How do you warm up hundreds of mailboxes?
Warmup happens in your sending tool, not at the infrastructure layer. Instantly, Smartlead, and ReachInbox all include warmup networks that exchange and engage with messages between participating mailboxes. To be clear about the division of labor: Inboxlogy provisions and authenticates the mailboxes; warmup runs in whichever sending tool you connect them to. Any vendor claiming to warm mailboxes for you is either running a tool on your behalf or describing something else.
A ramp that holds up:
- Days 1–14: warmup traffic only. No cold sends at all. Enable warmup the day the mailbox is provisioned and DNS has propagated.
- Days 15–21: warmup continues, plus 5–10 real sends per mailbox per day. Use your best list here, the cleanest data and highest-relevance segment you have, because early engagement disproportionately shapes the domain's baseline.
- Days 22–28: 15–20 real sends per mailbox per day.
- Day 29 onward: 20–30 per mailbox per day as steady state. Leave warmup running permanently at reduced volume.
Two things that break warmup: pausing it once campaigns start (reputation decays without positive signal), and ramping a whole cohort of 60 mailboxes on the same day. Stagger provisioning in batches of 15–20 per week so your fleet has mixed ages and you always have mailboxes finishing warmup as others are being retired.
How do you isolate clients so one bad campaign doesn't take down the rest?
This is what separates an agency setup from a scaled-up single-sender setup. Isolation boundaries you should enforce:
- One client per domain. Never share a sending domain across clients. Ever.
- Per-domain tracking subdomains. As above, a shared tracking domain defeats every other isolation measure you take.
- Separate workspaces in the sending tool, so throttling, suppression, and reporting are scoped per client.
- A global suppression list across all clients. If three clients target the same vertical, the same prospect can receive three cold emails in a week from your agency's infrastructure. That is a complaint generator, and it is entirely self-inflicted.
- Per-client bounce gates. Require verification before any list goes live, and have a hard rule: a campaign that crosses 3% bounce rate pauses automatically for list review rather than continuing to damage the domain.
How do you monitor 100+ domains without checking each one manually?
Instrument these, and review weekly:
- Google Postmaster Tools. Add every sending domain. This is your only direct read on Gmail-side spam rate, domain reputation, and authentication pass rates. Free, and the most valuable signal available.
- Microsoft SNDS / Smart Network Data Services. For the 365 side of the fleet and your dedicated IPs.
- Per-mailbox reply rate in your sending tool. The most practical early warning you have. When a mailbox's reply rate drops sharply while the copy and list are unchanged, placement is degrading before any blacklist reflects it.
- Bounce rate per domain per day, not per campaign. Campaign-level averages hide a single failing domain.
- Blacklist checks against Spamhaus and similar, run programmatically across all domains and IPs rather than checked by hand.
- Seed/placement tests per domain cohort: a handful of seed addresses on Gmail, Outlook, and one corporate Microsoft tenant, checked weekly.
When should you retire a domain, and how does rotation work?
Treat domains as consumables with a service life. Retire a domain when any of these hold:
- Postmaster Tools shows domain reputation at Low, or spam rate above 0.3%
- Reply rate on its mailboxes falls by more than half with list and copy unchanged
- Seed tests show consistent spam placement at Gmail or Outlook after a 7–10 day pause
- It appears on a major blacklist and is still listed after remediation and a cool-down
The recovery attempt is worth one try: pause all cold sending for 7–14 days, keep warmup running, then restart at 5 sends per mailbox per day. Light damage from a single bad list often recovers. If two weeks of rest produces no improvement, the domain is done. Stop sending from it and do not reuse it later. Retire the domain, keep the redirect live for a few months so old links don't 404, and promote a bench domain.
The operational pattern that makes this painless: keep 15–20% spare domains permanently in warmup so a retirement is a swap, not an outage. Budget for replacing a portion of your fleet on an ongoing basis rather than treating each retirement as a failure. Domains burn. The architecture exists so that it doesn't matter when they do.
What does this cost at agency scale?
For the 200-mailbox / 79-domain example above:
- Mailboxes: 200 × $2.80 = $560/month (Inboxlogy pricing, $0 setup, monthly)
- Domains: 79 × ~$12/year ≈ $79/month amortized
- Sending tool: varies by vendor and seat count
- Email verification: usage-based, and non-negotiable. It is cheaper than a burned domain.
Roughly $650/month of infrastructure to support 5,000 daily sends, before tooling. The number worth watching isn't cost per mailbox, it's cost per replacement cycle: monthly billing and $0 setup mean retiring 12 mailboxes and provisioning 12 new ones is a routine line item, not a sunk annual commitment you're stuck sending from.
Pre-launch checklist
Before the first cold send from any new domain:
- Domain registered 14+ days ago, with a live site or 301 redirect
- SPF published, single record, under 10 DNS lookups, primary domain not included
- DKIM generated and enabled in the admin console, verified by sending a test to a Gmail address and checking the headers
- DMARC published at
p=nonewith a workingruaaddress - Per-domain tracking CNAME configured, or link tracking disabled
- Maximum 3 mailboxes, each with a distinct real human name, photo, and signature
- 14 days of warmup completed in the sending tool
- Domain added to Google Postmaster Tools
- List verified, bounce estimate under 2%
- Global suppression list applied across all clients
- Daily cap set to 25 per mailbox in the sending tool, not left at default
FAQ
Can a burned secondary domain damage the client's primary domain?
Not through sending reputation, provided the two are genuinely separated. Separate domains have separate reputations. Damage travels through shared elements: a shared tracking domain, a shared outbound IP, or an SPF record on one domain that includes the other. Keep those separate and the primary domain is insulated. One nuance worth knowing: if your cold emails link to the client's primary website, that URL accumulates link reputation from the campaign. It's a different signal from sending reputation and generally low-risk, but agencies sending very large volumes often link to a page on the sending domain or a neutral booking link instead.
How long does it take to stand up 200 mailboxes and start sending?
Plan on 4–6 weeks from purchase to full-volume sending. Provisioning and DNS can be done in a day or two through an API. The two weeks of warmup per mailbox is the fixed cost, and staggering cohorts across several weeks instead of launching all 200 at once adds time but produces a fleet with mixed ages that degrades gracefully.
Is it cheaper to buy 50 mailboxes on 5 domains instead of 17?
Marginally, and it's the wrong trade. Domains cost about $12/year; a burned domain costs you every mailbox on it plus a warmup cycle to replace them. Ten mailboxes per domain means one bad list removes 10 sending slots at once. Domain count is the cheapest insurance in this entire stack.
Do I need a warmup service separate from my sending tool?
No. Instantly, Smartlead, and ReachInbox all include warmup, and running two warmup systems against the same mailbox produces conflicting traffic patterns rather than better results. Infrastructure providers, Inboxlogy included, supply authenticated mailboxes. The warmup itself runs in whichever tool you connect them to, so pick one tool and let it manage the ramp.