Cold Email Inboxes: How Many You Need, How to Configure Them, and What Actually Keeps Them Out of Spam

A cold email inbox is a dedicated, fully authenticated mailbox on a secondary domain, used to send a deliberately small daily volume of outbound email, typically 20–40 sends per mailbox per day, with 2–3 mailboxes per domain. To hit a given send volume you divide your daily sends (including follow-ups) by that per-mailbox cap: 1,000 sends per day needs roughly 34–36 mailboxes across about 12 domains. The infrastructure decisions that matter most are mailbox provider (real Google Workspace or Microsoft 365, not shared SMTP panels), domain isolation from your primary domain, correct SPF/DKIM/DMARC, and whether you own the tenant.

Everything below is the operational detail behind that answer: the arithmetic, the DNS, the warmup sequencing, how to tell whether your mail is landing, and when to retire a domain. It applies whether you buy mailboxes from a provider or build them yourself.

What is a cold email inbox?

A cold email inbox is a mailbox you create specifically for outbound prospecting, separate from the mailboxes your company runs its business on. It has three defining properties:

• It lives on a secondary domain, not your main company domain. If the mailbox accumulates spam complaints, the damage is contained to a domain you can retire.
• It sends low, consistent volume. It is not a bulk relay. It behaves like a salesperson's mailbox, because that is the behavior mailbox filters are tuned to accept.
• It is a real mailbox: a genuine Google Workspace or Microsoft 365 user with its own IMAP/SMTP credentials or OAuth connection, not an alias, a catch-all, or a shared SMTP account impersonating a mailbox.

Cold email runs on many small inboxes rather than one large one because every major mailbox provider scores reputation at the sending domain and sending account level. A single mailbox pushing 500 messages a day to strangers looks nothing like normal human email. Thirty mailboxes sending 30 each look like a sales team. Same volume, completely different risk profile. And if one mailbox gets filtered, you lose 3% of capacity instead of 100%.

How many cold email inboxes do I need?

Work backwards from total daily sends, not from prospect count. This is where most people under-provision.

• Step 1: total daily sends. If you add 200 new prospects per day to a 4-step sequence, your steady-state daily send volume is not 200. Every prospect eventually receives up to four messages, so once the sequence is full you are sending roughly 500–600 per day. Model steady state, not day one.
• Step 2: divide by your per-mailbox cap. At 30 sends per mailbox per day, 600 daily sends needs 20 mailboxes.
• Step 3: add headroom. Provision 10–20% extra so you can pull a mailbox offline without pausing campaigns, and so you aren't running every mailbox at its ceiling.
• Step 4: group into domains at 2–3 mailboxes each. 24 mailboxes becomes 8–12 domains.

A worked example: a team targeting 1,000 sends per day at 30 per mailbox needs 34 mailboxes; rounded to a clean 3-per-domain layout, that's 36 mailboxes across 12 domains. That is a realistic footprint for one SDR-equivalent of outbound volume, and it surprises people who expected to run cold email from two inboxes.

Two refinements worth making from the start:

• Segment by offer and by geography. Don't mix a high-risk, broad campaign and your best-performing niche campaign on the same domains. If the broad one draws complaints, you don't want it dragging down the campaign that works.
• Match region to audience. Mailboxes and connection IPs located in the region you're selling into behave more consistently than mailboxes that appear to log in from the other side of the world. If you sell into both the US and Europe, split the pools. Inboxlogy provisions mailboxes with dedicated US or EU IPs for exactly this reason.

How many emails can one cold email inbox send per day?

The provider's technical limit and the safe operating limit are very different numbers, and conflating them is the single most common way people burn infrastructure.

• Technical ceiling: Google Workspace and Microsoft 365 both permit on the order of a couple thousand recipients per user per day. This number is irrelevant to you.
• Safe operating range for cold outreach: 20–40 sends per mailbox per day on a mature mailbox. Many experienced teams sit at 25–30 and simply add mailboxes when they need more volume.
• New mailboxes: start at 5–10 per day and ramp over 2–4 weeks.

Control the shape of sending too, not just the total: randomize intervals between sends rather than firing on a fixed cadence, confine sends to business hours in the recipient's timezone, send on weekdays, and cap how many messages go to any single recipient organization per week. Most sending tools expose all four settings. Use them.

Should I buy Google Workspace, Microsoft 365, or cheap SMTP inboxes?

There are three things sold as "cold email inboxes," and they are not interchangeable.

Real Google Workspace and Microsoft 365 mailboxes

Genuine mailboxes in a tenant, each a real user. They get the deliverability benefit of sending through Google's and Microsoft's own outbound infrastructure, they support proper DKIM signing, and they have real inboxes you can read. This is what you want for anything you care about. Running a mix of both providers is also worth doing: Google-hosted recipients and Microsoft-hosted recipients filter differently, and a mixed pool keeps a single platform-level problem from taking out everything.

Shared SMTP / "unlimited inbox" panels

These sell you addresses on a server where your reputation is pooled with every other customer on that server. They're cheap and provision instantly, and the sending IP's reputation is outside your control. They are defensible only for low-stakes or throwaway sending. Treat per-mailbox prices that are drastically below real mailbox economics as a signal that you're buying something other than a real mailbox.

Aliases and catch-alls dressed up as mailboxes

Some setups give you one real mailbox and a pile of aliases or send-as addresses. This saves money and defeats the purpose: aliases share the underlying account, so per-account reputation and per-account sending limits are shared too. You're paying for the appearance of a distributed footprint without getting one.

Tenant ownership matters more than the platform

Plenty of providers sell Workspace or M365 mailboxes inside their own tenant. You get credentials; they keep the keys. The practical consequences:

• You can't change MX records, add DNS records, or configure routing.
• You can't export mail or migrate elsewhere, so leaving means losing your reply history.
• Tenant-level reputation and tenant-level enforcement are shared with every other customer in it. One abusive tenant-mate can affect you.
• If the provider's reseller relationship ends or the tenant is suspended, your mailboxes go dark with no recourse. This is the common failure mode for grey-market mailbox sellers who provision outside official reseller programs.

Insist on authorized provisioning and your own tenant with full admin access. That's the model Inboxlogy runs: authorized Google Workspace and Microsoft 365 mailboxes, 100% customer ownership with admin access, and SPF/DKIM/DMARC configured automatically at provisioning. You keep the ability to change DNS, add users, export data, or walk away with your mailboxes intact.

How should I set up domains for cold email inboxes?

Domain strategy does more for long-run deliverability than any tool setting.

• Never send cold email from your primary domain. That domain carries your transactional mail, your invoices, and your recruiting. Spam complaints there are not recoverable in any reasonable timeframe.
• Use separate registered domains, not subdomains of your primary. Subdomains are cheaper and easier, but they share an organizational domain with your main brand, and reputation and policy signals can be grouped at that level. Prudent isolation means a distinct registrable domain.
• Pick plausible variants: getbrand.com, brandhq.com, brand.io, try-brand.com. Prefer .com where you can get it; avoid the handful of TLDs with heavy abuse histories, which get scored more harshly regardless of your behavior.
• Make each domain resolve to something real. At minimum a 301 redirect to your main site; better, a one-page site that explains who you are. A domain whose homepage returns nothing is a flag for both filters and curious prospects.
• Let new domains sit a few days before sending, with DNS already in place. Brand-new registrations are treated with more suspicion than week-old ones.
• Keep WHOIS privacy on. It's standard and not a negative signal.
• Use real names on mailboxes. [email protected], not sales@, info@, or outreach7@. Role addresses attract filtering, and real names get replies.

What DNS records does every cold email inbox need?

Authentication is table stakes now, not an optimization. Google's published bulk sender requirements oblige high-volume senders to Gmail to authenticate with SPF and DKIM, publish a DMARC record, and keep spam complaint rates low. Google's guidance is to stay below 0.3%, ideally under 0.1%. Microsoft introduced comparable requirements for high-volume senders to consumer Outlook domains in 2025. Cold senders generally sit well under those volume thresholds, but the same authentication signals are evaluated at every volume, so configure as if the requirements applied to you.

• MX: pointing at Google or Microsoft, so the domain can actually receive mail. A sending domain that can't receive mail is a hard negative signal, and you need replies anyway.
• SPF: exactly one SPF record per domain, including your mailbox provider's mechanism. Multiple SPF TXT records is a permanent-error misconfiguration that breaks SPF entirely. Stay inside SPF's 10-DNS-lookup limit; chaining several include: statements for tools you no longer use is a common way to exceed it silently.
• DKIM: enabled and signing with your sending domain, at 2048-bit where the platform supports it. Workspace requires you to generate and publish the key; it is not on by default. Microsoft 365 uses CNAME records that must be published before you enable signing.
• DMARC: start at p=none with a rua= address so you receive aggregate reports, confirm alignment is passing, then tighten to p=quarantine. DMARC passes only if SPF or DKIM passes and aligns with the domain in your visible From address, which is why mailbox-provider-signed DKIM matters.
• Custom tracking domain: if your sending tool offers link tracking, use a tracking subdomain on the sending domain rather than the tool's shared default, which is shared with every other customer. Better still, consider turning open tracking off entirely. It adds a tracking pixel and a rewritten link to every message, both of which are content signals, and open data has become unreliable since mail clients began pre-fetching images.

Doing this by hand across a dozen domains is where errors creep in: a stray second SPF record, DKIM enabled in the admin console before the key is published, DMARC with a typo in the rua address. Automating it is worth the effort. If you buy mailboxes, automated SPF/DKIM/DMARC setup (which Inboxlogy includes) removes an entire category of silent failure. Verify it afterward anyway, with a DMARC checker or by sending a test message to a mailbox you can inspect headers on.

How do I warm up cold email inboxes?

Warmup happens in your sending tool, not at your infrastructure provider. Instantly, Smartlead, and ReachInbox all include warmup; you connect your mailboxes and the tool handles it. Inboxlogy provisions and authenticates the mailboxes. It does not run warmup itself, so plan on your sending tool doing that job.

What warmup actually does: the tool exchanges low-volume mail between mailboxes in a pool, with recipients opening, replying, and marking messages as important or moving them out of spam. That builds a baseline of positive engagement signals before real campaigns start.

A reasonable approach:

• Weeks 1–2: warmup only, no campaigns. Low daily volume, gradually increasing.
• Weeks 3–4: begin campaigns at 5–10 sends per mailbox per day, ramping weekly, with warmup still running.
• Ongoing: leave warmup on permanently at a low level. It's cheap insurance and it keeps a floor of positive signal under every mailbox.

Two honest limits. First, warmup pool traffic is synthetic, and filters are increasingly good at recognizing it; it establishes a baseline but it does not create reputation you haven't earned. Second, nothing in warmup can offset a bad list or a bad message. Genuine replies from real prospects are the strongest positive signal available, and spam complaints from poorly targeted sending are the strongest negative one. Teams that blame deliverability for a targeting problem buy more inboxes and burn those too.

How do I tell whether my cold email inboxes are actually landing in the inbox?

You cannot tell from your sending tool's dashboard. "Delivered" means the receiving server accepted the message. It says nothing about whether it landed in the inbox, in Promotions, or in spam. Use these instead, in rough order of usefulness:

• Reply rate per mailbox, tracked over time. The most reliable signal you own. When one mailbox's reply rate drops while its peers hold steady on the same campaign and list, that mailbox is being filtered. Watch per-mailbox, not just per-campaign.
• Seed/placement testing. Send a test to a set of real mailboxes you control across Gmail, Outlook, and a corporate M365 tenant, and check where it landed. Do this before launch on every new domain, and periodically after. Treat the result as directional, not precise; seed accounts don't engage the way prospects do.
• DMARC aggregate reports. The rua= address receives XML showing which sources are sending as your domain and whether they're passing authentication. Catches both misconfiguration and anyone spoofing your domain.
• Google Postmaster Tools. Genuinely useful for domain-level spam complaint rates and reputation. It requires meaningful daily volume to Gmail before it shows data, though, and a properly distributed cold setup may never cross that threshold per domain. Set it up, but don't expect it to be your primary instrument.
• Bounce and rejection text. Read the actual SMTP responses. Rejections frequently name the reason, whether rate limiting, reputation, policy, or a specific blocklist, and that tells you precisely what to fix.

When should I retire a cold email inbox or domain?

Retire, don't rehabilitate. A domain with a damaged reputation can take months to recover, and a new domain costs about a dollar a month. The arithmetic is not close.

Signals it's time to rotate a domain out:

• Reply rate on that domain falls well below its peers running the same campaign and list segment, and stays down after a week of reduced volume.
• Seed tests consistently land in spam across multiple providers.
• You see reputation-based rejections in bounce text, or the domain appears on a major blocklist.
• Postmaster Tools (where you have data) shows spam rates above Google's 0.3% guidance.

The practical discipline: keep a small bench of warmed spare domains so rotation doesn't mean downtime. Provision a few domains ahead of need, run warmup on them, and swap them in when something degrades. With $0 setup fees and monthly billing, carrying spare capacity costs a few dollars, far less than a week of paused pipeline. When you retire a domain, stop sending from it entirely rather than resting it and resuming. The reputation signal that caused the problem does not expire on a convenient schedule.

What does a cold email inbox setup actually cost?

Using the 1,000-sends-per-day example of 36 mailboxes across 12 domains:

• Mailboxes: 36 × $2.80 = $100.80/month at Inboxlogy's entry pricing, with no setup fee and monthly billing.
• Domains: 12 domains at typical .com registration rates of roughly $10–15/year ≈ $10–15/month.
• Sending tool: Instantly, Smartlead, or ReachInbox, priced per plan, usually by contact or mailbox volume. This is where warmup and sequencing live.
• Data: list sourcing and verification, which is often the largest line item and the one most worth spending on.

Buying the same 36 seats at retail list price directly from Google or Microsoft costs multiples of that, because you're paying for collaboration suites you'll never open. Per-mailbox cost matters beyond the invoice: cheap mailboxes let you run a wider footprint at lower volume per mailbox, and that's the configuration that actually survives. Expensive mailboxes push teams toward sending 100 a day from a handful of inboxes, which is the configuration that fails.

How do I evaluate a cold email inbox provider?

Ask these before you buy. The answers separate infrastructure from resale.

• Are these real Google Workspace / Microsoft 365 mailboxes, or SMTP accounts? Ask directly.
• Is provisioning authorized through official channels? Unauthorized provisioning is the main cause of mass mailbox suspensions.
• Do I own the tenant, with super-admin access? If the answer is qualified, you don't.
• Can I change DNS and MX records myself?
• Are these full mailboxes or aliases on a shared account?
• Is SPF/DKIM/DMARC configured automatically, and can I verify it?
• Can I choose the IP region to match the market I'm selling into?
• Is there an API for provisioning, rotation, and credential export? At 36+ mailboxes with regular rotation, manual provisioning becomes the bottleneck. Inboxlogy exposes a full API for this.
• What's the export path if I leave? Mail data and domain control should both come with you.
• Is billing monthly, with no setup fee? Annual contracts for infrastructure you rotate quarterly are a poor fit.
• Who runs warmup? Expect the answer to be your sending tool. A provider claiming to do warmup for Workspace mailboxes it doesn't control is worth questioning.

Pre-launch checklist

Before the first campaign send on any new domain:

• MX records resolve and the mailbox can receive mail (send it a test from an outside address).
• Exactly one SPF record, inside the 10-lookup limit.
• DKIM enabled and verified signing on the sending domain.
• DMARC published, aggregate reports arriving at an address you read.
• Domain resolves to a real page or redirect over HTTPS.
• Mailbox display names are real human names; signature includes a working unsubscribe or opt-out line.
• Custom tracking domain configured, or link tracking disabled.
• Warmup has been running in the sending tool for at least two weeks.
• Daily cap set to 5–10 for the first week, with randomized intervals and a business-hours sending window.
• One seed test completed across Gmail, consumer Outlook, and a corporate M365 tenant.
• List verified; sending domain and campaign recorded in whatever you use to track which domains carry which offers.

FAQ

How many mailboxes should I put on one domain?

Two to three. More than that concentrates risk: if the domain's reputation degrades, every mailbox on it degrades together, and you lose a larger share of capacity at once. Spreading the same mailbox count across more domains costs only the extra domain registrations.

How long does it take before cold email inboxes are ready to send?

Plan on two to four weeks from provisioning to full volume. Mailboxes and DNS can be ready the same day, and the domain should rest a few days with DNS in place, but warmup in your sending tool is the long pole. You can start real campaigns at very low volume after about two weeks of warmup and ramp from there.

Can I just use my existing company mailbox for cold email?

You can send small volumes of genuinely personalized, well-targeted email from it. A founder emailing 10 carefully chosen prospects a day is normal business correspondence. What you should not do is run automated sequences at volume from your primary domain. The downside case is your invoices, password resets, and support replies landing in spam, and that's not a problem you can buy your way out of quickly.

Do dedicated IPs matter for Google Workspace or Microsoft 365 mailboxes?

Not in the way they matter for a bulk relay. When you send through Workspace or M365, outbound mail leaves via Google's or Microsoft's own IP ranges. You don't control those, and that shared-but-well-maintained reputation works in your favor. Dedicated IPs matter at the connection layer: your sending tool authenticating into mailboxes from a stable, regionally consistent IP that isn't shared with hundreds of unrelated accounts, which is one of the behavioral signals that keeps mailboxes from being flagged for suspicious access. That's what dedicated US/EU IPs on a mailbox provider like Inboxlogy are for.