Construyendo tus cimientos

Your sending setup decides whether anyone sees your email at all. This chapter walks through it in the order you should build it: domains, mailboxes, the three DNS records that prove you are you, and the small extras that keep the whole thing clean. Do it once, carefully, and it will hold up for years.

Why the foundation comes first

When your email reaches Gmail or Outlook, the receiving server asks two questions before it looks at a single word you wrote. Is this sender who they say they are? And how have people reacted to mail from this sender before? The first question is answered by your DNS records. The second is answered by your history. You control the first one completely, today, in about an hour of work.

Our advice is simpler than the thresholds: set up all three on every sending domain, no matter how little you send. It costs nothing, it removes a whole category of problems, and it means you never have to fix your setup in a panic when volume grows.

Step 1: separate your sending domains

Never send cold email from the domain your company runs on. Your main domain carries invoices, password resets, support replies and messages between colleagues. If cold outreach damages its reputation, all of that starts landing in spam too. Instead, buy a few separate domains that clearly belong to the same brand.

Start with two or three domains. Point each one's website address at your real site with a permanent redirect, so a curious reader who types it in lands somewhere that makes sense. A sending domain that shows an empty parking page looks like a spammer's domain, because that is exactly what spammers' domains look like.

Step 2: create real mailboxes

Each sending domain gets two or three mailboxes on a proper business mail provider, such as Google Workspace or Microsoft 365. Use real names of real people on your team: first name at domain is the clearest. Fill in the profile photo and a plain signature with name, role, company and website. These details are small, but they are exactly what a reader checks when deciding whether you are a person or a machine.

• One person per mailbox. Do not invent sender personas. If the person leaves, keep the mailbox and change the name honestly, or retire it.
• Replies must reach a human. Check that every sending mailbox delivers replies to someone who reads them, the same working day.
• Keep a modest daily cap per mailbox. Spread volume across more mailboxes instead of pushing one hard. Chapter 4 gives the ramp, Chapter 14 the scaling rules.
• Forwarding is fine, aliases are not a shortcut. An alias still sends from the same mailbox and shares its reputation. Count it as the same sender.

Step 3: the three records that prove you are you

Email authentication sounds technical, but each record answers one plain question. SPF answers "which servers are allowed to send for this domain?" DKIM answers "was this message signed by the domain and left unchanged?" DMARC answers "what should a receiver do when those checks fail, and where should it send reports?" All three live as TXT records in your domain's DNS settings.

SPF: the allowed sender list

Your mail provider gives you the exact SPF line to publish. For Google Workspace it looks like "v=spf1 include:_spf.google.com ~all". Publish exactly one SPF record per domain. If you send through more than one service, merge them into a single record with several include entries. Two separate SPF records on the same domain break the check entirely.

This limit is why we recommend sending domains that do one job. A sending domain only needs your mail provider in its SPF record. Your main domain, which may also send through a billing tool, a help desk and a newsletter service, is where SPF records quietly grow past the limit.

DKIM: the signature

In your mail provider's admin panel, generate a DKIM key for each sending domain. Choose a 2048-bit key if offered. The provider shows you a record name (often something like "google._domainkey") and a long value. Paste both into DNS, wait for it to show up, then press the button in the admin panel that starts signing. Many people publish the record and forget that last step, so their mail goes out unsigned.

DMARC: the policy and the reports

DMARC ties the other two to the domain your reader actually sees in the From line, and tells receivers what to do when checks fail. Start with a monitoring policy: "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com". That changes nothing about delivery but sends you daily reports showing who is sending as your domain and whether they pass.

1. 01

   Week 1 to 2: p=none

   Collect reports. Confirm your mail provider passes SPF and DKIM, aligned to your From domain.

2. 02

   Week 3 onward: p=quarantine

   Once reports are clean, tell receivers to treat failures as suspicious. This protects your domain from people faking it.

3. 03

   When confident: p=reject

   Optional for sending domains. Tells receivers to refuse anything that fails. Only do this when you are sure every real sender passes.

Step 4: the small extras

• MX records on every sending domain. Each domain should be able to receive mail, so replies and bounce notices arrive. A domain that sends but cannot receive looks fake.
• A custom tracking domain, or no tracking. If your tool rewrites links for click tracking, point the tracking at a subdomain of your own sending domain. Shared tracking domains mix your reputation with strangers'. Better still for cold email: turn open tracking off and keep links few.
• Reverse DNS and dedicated IPs are not your job. On Google Workspace or Microsoft 365, the provider runs the servers. Do not buy dedicated IPs for cold email. You would be taking on a reputation job the providers already do well.
• Postmaster Tools. Add each sending domain to Google Postmaster Tools so you can see the spam rate Google measures. Chapter 9 explains what to watch.

Check everything before you send

Send a test message from each mailbox to a personal Gmail address. Open it, click the three dots, choose "Show original", and read the top of the page. You want to see SPF: PASS, DKIM: PASS and DMARC: PASS, each with your sending domain. If any line says FAIL or is missing, fix it before going further. This one screen catches almost every setup mistake.

Common mistakes

• Two SPF records because a second service added its own. Merge them into one line.
• DKIM record published, signing never switched on. The record sits there unused and mail goes out unsigned.
• DMARC copied from a blog post with someone else's report address. Your reports go to a stranger. Use an address you own.
• Sending domain with no website. Readers who check find nothing, and so do filters.
• Main domain used "just for a small test". Small tests become habits. Keep cold mail off the main domain from day one.
• Skipping warm-up because the records pass. Passing authentication proves identity, not trustworthiness. History comes from Chapter 4.

How long it takes

Buying domains and creating mailboxes takes an afternoon. DNS changes usually show up within an hour, sometimes longer. The waiting is the slow part: give new domains time to age while warm-up builds history. Plan for two to four weeks between buying a domain and sending real cold email from it. That feels slow when you are eager to start, which is exactly why you should buy the domains now, while you build your list in parallel.

Doing this in FirstSales

When you connect a mailbox in FirstSales, it checks the domain's SPF, DKIM and DMARC records and shows you which ones pass, which are missing, and the exact value to add. Daily caps are set per mailbox, and sending spreads across all connected mailboxes in a campaign. You can see the mailbox screens with sample data in the demo.

Key takeaways

• Use separate sending domains that clearly belong to your brand. Never your main domain.
• Two or three real mailboxes per domain, with real names, photos and signatures.
• Publish SPF, DKIM and DMARC on every sending domain, whatever your volume.
• Keep SPF to one record and switch DKIM signing on in the admin panel.
• Start DMARC at p=none, read the reports, then tighten.
• Check Show original for three PASS lines before any cold email goes out.