Cold Email Domain Warming, Inbox Rotation, and Deliverability: A Practical Operating Guide

Warm a new cold email domain for 2–4 weeks before it touches a prospect list, then cap each mailbox at roughly 20–35 cold sends per day and rotate across multiple mailboxes spread over multiple secondary domains. Never your primary domain. Warming builds a sending history. Rotation keeps any single mailbox below the volume and complaint thresholds that trigger filtering, so one bad list or one burned domain can't take down your company's email.

That is the whole strategy in two sentences. The rest of this guide is the part that actually determines whether it works: the ramp schedule, the mailbox math, the DNS records that are wrong in most setups, what to monitor when Google Postmaster Tools shows you nothing, and what to do when numbers slide.

What is cold email domain warming, and does it actually work?

Warming is the process of establishing a sending reputation for a brand-new domain and mailbox by starting at very low volume and increasing gradually, while generating positive engagement signals: opens, replies, messages moved out of spam, messages marked "not spam."

In practice, "warmup" today means an automated peer network inside your sending tool. Instantly, Smartlead, and ReachInbox each run a pool: your mailbox sends small numbers of innocuous messages to other users' mailboxes in the pool, those mailboxes reply, mark as important, and rescue anything that lands in spam. Your mailbox does the same for them.

It works partially, and you should be clear-eyed about the limits. Warmup reliably accomplishes three things:

What warmup does not do: it does not make a bad list safe, it does not fix a domain with no authentication, and it does not immunize you against complaints. The engagement is synthetic. It comes from a closed network of other cold senders, not from your actual audience, and mailbox providers have gotten measurably better at discounting traffic patterns that look like warmup pools. Treat warmup as necessary but not sufficient. The signals that ultimately decide your fate are complaint rate, bounce rate, and whether real prospects reply.

How long should you warm a new domain before sending cold email?

Plan on 3–4 weeks from domain registration to first cold send, of which 2–3 weeks is active warmup.

The sequence that works:

Shorter is possible and people do it. The failure mode is not that your first campaign bounces. It's that the domain lands in spam quietly for a month while you keep paying for it and conclude cold email doesn't work.

What does a safe warmup ramp schedule look like, week by week?

Per mailbox. These are planning numbers, not published provider limits. Adjust down if your inbox-placement checks look bad.

Two refinements that matter more than the exact numbers:

Keep warmup running permanently at a reduced level, typically 5–15/day once you're in steady state. The argument against is that perpetual synthetic traffic is itself a pattern. The argument for is that cold campaigns generate almost no positive engagement, so without warmup your only signals are neutral-to-negative. In practice, continuous low-level warmup is the standard configuration across all three major tools and it's the right default. What you should avoid is running warmup at 40/day forever while sending 30 real emails. That ratio is conspicuous.

Ramp back up after any pause. If a mailbox sits idle for two weeks (holidays, campaign gap, a tool reconnect), don't resume at your old volume. Take three or four days to climb back.

How many mailboxes and domains do you actually need?

Work backwards from your target volume. The math is simple and it's the single most useful calculation in cold email planning:

Worked example: you want to reach 10,000 new prospects per month with a 4-step sequence, so roughly 25,000 sends/month. Across ~21 working days that's about 1,200 sends/day. At 30 sends per mailbox per day, you need 40 mailboxes. At 3 mailboxes per domain, that's ~14 domains.

Why 2–3 mailboxes per domain rather than 10? Because reputation is evaluated at the domain level as well as the mailbox level. Three mailboxes on one domain sending 30 each is 90/day from that domain, which is defensible. Ten mailboxes is 300/day from a domain nobody has heard of, with no website traffic, no transactional mail, and no inbound. That profile gets filtered. Concentration is also a blast-radius problem: if a domain burns, you'd rather lose 3 mailboxes than 10.

How should you choose and structure the sending domains?

What is inbox rotation and how do you configure it correctly?

Inbox rotation (also called mailbox rotation or sending-account rotation) means a single campaign distributes its sends across many mailboxes instead of one, so each mailbox stays under its daily cap and no single sending identity carries the whole campaign's reputation risk. Every serious sequencer supports it: you attach a pool of connected mailboxes to a campaign and the tool round-robins across them.

Configured badly, rotation creates problems instead of solving them. The rules:

What DNS records does every cold email domain need?

This is where most setups are quietly broken. Mailbox providers hardened their requirements in 2024–2025: Google and Yahoo's bulk sender rules (effective February 2024) and Microsoft's Outlook.com requirements (enforced from May 2025) both require SPF, DKIM, and a DMARC record with at least p=none, plus alignment, for high-volume senders to consumer inboxes. Most cold senders don't hit the 5,000-messages-per-day threshold those rules target, and B2B recipients are mostly on Workspace and Microsoft 365 rather than consumer Gmail or Outlook.com. The same authentication signals still feed the same filters. Treat all of it as table stakes.

SPF

One SPF record per domain. Two TXT records starting v=spf1 is a permanent error, not a warning. Stay within the 10 DNS-lookup limit (RFC 7208); exceeding it causes a permerror and SPF simply fails. For a Workspace mailbox this is usually just v=spf1 include:_spf.google.com ~all; for Microsoft 365, v=spf1 include:spf.protection.outlook.com -all. Don't stack includes for tools that don't actually send on your behalf.

DKIM

The most common real-world failure: Google Workspace does not sign with your domain until you turn DKIM on. Out of the box, Workspace signs with a …gappssmtp.com key. DKIM passes, but it isn't aligned with your From domain, so DMARC has to lean entirely on SPF. Generate the 2048-bit key in Admin console (Apps → Google Workspace → Gmail → Authenticate email), publish the TXT record, and click Start Authentication. On Microsoft 365, publish the two selector1/selector2 CNAMEs and enable DKIM for the custom domain in the Defender portal. It is off for custom domains by default.

DMARC

Start at v=DMARC1; p=none; rua=mailto:[email protected]. Publish a real mailbox or aggregate-report service in rua; a DMARC record you never read is decoration. Once reports confirm clean alignment for a couple of weeks, move to p=quarantine. For a secondary domain used only for outreach, quarantine or reject is the right end state: nobody else should ever be sending as that domain.

MX and reply handling

The domain must receive mail. Warmup depends on two-way traffic, replies are the point of the exercise, and a sending domain with no MX record looks like infrastructure built to be thrown away.

Tracking domain — and why to consider turning tracking off

If you use open or click tracking, set up a custom tracking domain (a CNAME on a subdomain of the sending domain) so links don't point at a shared tracking host used by thousands of other senders. Better still for cold email: turn open tracking off entirely. The tracking pixel is a classic spam signal, it rewrites every link through a redirect, and Apple Mail Privacy Protection has made open data largely fictional anyway. Measure replies and meetings, the metrics you actually get paid on.

Which sending limits actually matter?

There are two kinds of limit and people confuse them constantly.

Policy limits are what the provider will let you do. Google Workspace caps paid accounts at 2,000 messages per day (lower on trial accounts). Microsoft 365 historically allowed 10,000 recipients/day per mailbox, and Microsoft has been rolling out a tighter external-recipient cap of 2,000 per 24 hours. Hit these and you get a hard error or a temporary suspension.

Reputation limits are what the filters will tolerate, and for cold outreach they bind far earlier, somewhere around 30–50 sends/day per mailbox. You will destroy your deliverability at roughly 2% of your policy limit. Anyone selling you "2,000 emails/day per mailbox" is quoting the wrong number.

The thresholds worth memorizing:

How do you monitor deliverability when Google Postmaster Tools shows nothing?

Register every sending domain in Google Postmaster Tools and Microsoft SNDS, because they're free and occasionally decisive. Then accept the honest limitation: Postmaster Tools only populates its charts above a daily-volume threshold Google doesn't publish, and a domain sending 90 cold messages/day to a mixed B2B audience will usually show empty dashboards forever. SNDS is IP-based, so it tells you nothing about mail you send through Google's or Microsoft's shared outbound IPs.

So monitor these instead, weekly, per domain:

What should you do when deliverability drops?

In order, and resist the urge to change five things at once:

Can you recover a burned domain?

Sometimes, over 4–8 weeks of near-zero volume plus heavy warmup, and only if the damage is domain reputation rather than a blocklisting with a clear policy cause. Be pragmatic: a replacement domain costs about $10 and three weeks of warming. If a domain has been visibly filtered for more than a couple of weeks despite reduced volume, retire it, keep the MX live for a few months so replies to prior threads still arrive, and move on. Build this into your planning. Assume you'll rotate some portion of your domain pool every year, and keep 15–20% spare warmed capacity so a retirement doesn't stall a campaign.

What should the infrastructure layer provide — and where does Inboxlogy fit?

At 40 mailboxes across 14 domains, the operational problem isn't strategy, it's logistics: provisioning, DNS for every domain, DKIM enabled per domain, app passwords or OAuth for every mailbox, replacements when a domain is retired. The decisions that save you pain later:

One thing to be explicit about: Inboxlogy does not run warmup. Warmup happens in your sending tool, whether Instantly, Smartlead, or ReachInbox, where the pool, the ramp schedule, and the daily caps live. The infrastructure provider's job is correctly authenticated, genuinely owned mailboxes that you connect to that tool. If a vendor advertises both the mailboxes and a proprietary warmup network, ask exactly whose mailboxes are in the pool.

Is cold email legal, and what does compliance require?

Deliverability and compliance aren't the same thing, but non-compliance reliably produces complaints, and complaints destroy deliverability. Briefly, and this is not legal advice:

Practically: include a plain-language opt-out line in every cold email (a sentence works; you don't need a marketing footer), process opt-outs immediately and globally across every domain and tool you run, and keep a suppression list that survives tool migrations.

The operating checklist

Before the first send: domains registered and resolving over HTTPS; one SPF record under 10 lookups; DKIM enabled and aligned on each domain; DMARC published with a monitored rua; MX live; custom tracking domain configured or tracking disabled; 2–3 mailboxes per domain; full names and real signatures on every mailbox; 2–3 weeks of warmup completed; list verified; suppression list imported.

Every week: reply rate and bounce rate reviewed per domain; placement test per domain; DMARC reports scanned; blocklist check; opt-outs confirmed suppressed everywhere.

Every month: retire underperforming domains; add replacements to the warming queue so you're never provisioning under pressure; re-verify any list segment older than 90 days; confirm per-mailbox caps haven't drifted upward across stacked campaigns.

FAQ

How many cold emails per day can one mailbox safely send?

20–35 per day in steady state, after a 2–4 week warmup. Google Workspace's policy ceiling is 2,000/day on paid accounts, but reputation breaks long before you approach it. If you need more volume, add mailboxes and domains instead of raising the per-mailbox cap.

Should I keep warmup running after my campaigns go live?

Yes, at a reduced level of roughly 5–15 messages/day per mailbox. Cold campaigns generate very little positive engagement on their own, so continuous low-level warmup keeps some favorable signal in the mix. Avoid the opposite extreme of running warmup at volumes that dwarf your real sending.

Does inbox rotation hurt reply rates or break email threads?

Not if it's configured properly. Rotation distributes new prospects across mailboxes; every follow-up in a sequence must stay on the mailbox that sent the first touch, in the same thread. All the major sequencers do this by default. Confirm it in your campaign settings before launch, because the alternative is a stranger quoting a message your prospect never received.

Can I use subdomains instead of buying separate domains?

You can, but it's weaker protection than it looks. Subdomains inherit some reputation from the parent domain and mailbox providers can and do associate them, so burning mail.yourcompany.com can affect yourcompany.com. Separate registered domains give genuine isolation for about $10 each per year, the cheapest insurance in the stack.