Buying a domain for email: what to check before you pay

Buying a domain for email is two decisions: which name, and whether it has a past. The second one is where money is lost. A previously-spammed domain can arrive already listed on blocklists, already distrusted by filters, and the only remedy is to stop using it. Check before you buy, not after your first campaign lands in spam.

A domain name and email hosting are separate purchases. Registering example.com gives you the name and DNS control; it does not give you a mailbox. You add mailbox hosting (Google Workspace, Microsoft 365, Zoho, Fastmail, or a host-bundled mailbox) by pointing MX records at it, and for campaigns you add a sending platform on top.

Routes to a custom email domain

Whichever route, insist on two things: the ability to publish arbitrary TXT and CNAME records, and a transfer-out path. A domain you cannot move is a dependency, not an asset.

Choosing the name

• Short, sayable, spellable over the phone. You will read it aloud more than you expect.
• `.com` where you can get it. For a country-specific business, the country code is equally fine. Both are familiar to filters and to people.
• Be careful with cheap new gTLDs. Several of the cheapest TLDs are heavily abused, and some filters and blocklists weight the TLD. If you must use one, be aware you start from a worse position than a .com and warm up accordingly.
• No hyphens or digits. They cause transcription errors in exactly the moment that matters — someone typing your address.
• Avoid lookalike ambiguity (rn for m, l for 1). It helps anyone phishing your customers and hurts you.
• Check trademark conflicts before buying. Losing a domain to a dispute after building reputation on it is an expensive lesson.

For outbound prospecting specifically, use a separate domain from your primary brand domain — a close variant you own and control. Keep the brand domain for the mail your business depends on, and never put cold outreach on it.

Check the history before you buy

For any domain that is not brand-new, spend ten minutes:

1. Blocklists. Check the domain against Spamhaus DBL, Barracuda, SURBL and URIBL, plus the domain's historical IPs if you can find them. A current listing is a reason to walk away.
2. Archived content. Look it up in the Internet Archive. A former pharmacy affiliate, casino or adult site is a reputation you are inheriting.
3. DNS history. Previous MX, SPF and DMARC records tell you whether it sent mail, through whom, and at what scale. An old SPF record with six bulk-sender includes is a red flag.
4. Search for the domain name in quotes. Complaint forum posts and scam reports are easy to find and decisive.
5. Registration and drop history. A domain that has changed hands repeatedly and dropped twice is usually dropping for a reason.
6. Google Safe Browsing status for the domain.

If any of these are bad, the discount is not a discount. Age only helps when the age is clean.

Publish these records before the first send

example.com.                   MX    1  mx-host.provider.example.
example.com.                   TXT   "v=spf1 include:_spf.provider.example ~all"
selector1._domainkey.example.com. CNAME selector1.dkim.provider.example.
_dmarc.example.com.            TXT   "v=DMARC1; p=none; np=reject; rua=mailto:dmarc@example.com"
links.example.com.             CNAME tracking.provider.example.

Rules behind that block: exactly one SPF record, within the 10 DNS-querying mechanism and 2 void lookup limits. DKIM published at the selector your provider actually signs with. DMARC starting at p=none with rua so you can see every sending source, then tightened to p=reject once reports are clean — with np=reject from the start, because nothing legitimate sends from a subdomain that does not exist. Tracking links on a subdomain of your own domain, never a public shortener.

If the domain will never send mail — a redirect or a defensive registration — say so explicitly: "v=spf1 -all" and "v=DMARC1; p=reject;". An unprotected non-sending domain is an easy spoofing target.

Then verify on a delivered message rather than in a DNS checker. Read Authentication-Results and confirm spf=pass, dkim=pass and dmarc=pass with header.from aligned to whichever mechanism authenticated.

Before you send anything real

A newly registered domain has no sending history, and receivers treat unknown as suspicious. Let it exist for a few weeks, publish a real website on it, then warm it: low initial daily volume, genuine two-way engagement, and a gradual ramp of no more than roughly 30–50% a day while reputation is young. Treat 421 and 450 deferrals as instructions to slow down.

What not to do

1. Do not buy an aged domain without checking blocklists, archives and DNS history.
2. Do not send campaigns from a domain registered last week.
3. Do not use a cheap, heavily-abused TLD for mail that matters.
4. Do not register a near-identical variant of a well-known brand; you will lose it and you will have warmed it first.
5. Do not let a registrar hold your DNS hostage. Verify you can publish arbitrary TXT and CNAME records before you commit.
6. Do not skip DMARC on parked and defensive domains.
7. Do not put outbound prospecting on your primary brand domain.
8. Do not let the domain auto-renewal lapse. An expired domain means lost mail, and someone else can register it next.

MailPilot takes it from registration onwards: warm-up over OAuth (Gmail, Outlook) or SMTP/IMAP including custom SMTP, SendGrid, Amazon SES, Mailgun and Postmark, SPF/DKIM/DMARC checks against mail as delivered, daily per-mailbox reputation tracking, and real inbox placement per provider from a seed-inbox network — so a new domain's first weeks are measured rather than assumed.