Choosing a sending domain for cold email

The sending domain is the most consequential choice in a cold email setup, because reputation attaches to the domain. You can change IPs, providers and copy and keep your problem, because the problem is attached to the domain in the DKIM signature. So the decision is worth more care than it usually gets.

Two rules carry most of the value. Do not run outreach on the domain that carries your invoices, password resets and support mail. And pick a secondary domain a recipient can actually verify as yours — which means it resolves to a real page, not a parked redirect.

Root domain, secondary domain or subdomain

The subdomain option is underrated and worth understanding properly. It isolates the sending stream, can carry its own DKIM selector and SPF record, and keeps your brand name visible. What it does *not* do is fully isolate DMARC, because policy is evaluated against the organisational domain. That coupling is sometimes exactly what you want — brand recognition with a separate stream — and sometimes the reason to use a separate registrable domain instead.

A related secondary domain is the usual choice for high-volume outreach, and it is fine as long as the relationship is obvious. getacme.com is obvious. acme-inc-official.com is a phishing pattern.

Age, TLD and the things that are only weak signals

• Domain age is one input among many, and the signal is mostly at the extremes. A domain that starts sending hours after registration is the clearest possible pattern. A domain that has existed for a few months with a real site is unremarkable. Buying an expired domain for its age is a bad trade, because you inherit whatever its previous owner did — including blocklistings and a reputation you cannot inspect.
• TLD matters less than people think and more than zero. Common commercial TLDs are unremarkable. A few TLDs have a high enough concentration of abuse that some receivers treat them more sceptically. If you have a choice and no reason to be exotic, take the boring option.
• Length and spelling. A domain a recipient can read out loud is easier to trust and easier to type. Hyphen stacks and digit substitutions read as throwaway.
• WHOIS privacy is normal and fine on its own. Privacy plus a brand-new registration plus no website is the combination that looks bad.

A domain is not ready until all of this is true

1. Registered in your own registrar account, auto-renew on. Not in a vendor's account — if the registrar login is theirs, the reputation you build is theirs.
2. A real web page naming your company, linking to your main site, with a contact address. One page is enough. A domain resolving to nothing, or 301-ing straight to your main site with no content of its own, cannot be verified by a cautious recipient.
3. SPF listing only the services that actually send for the domain, and staying inside the hard limit of 10 DNS lookups during evaluation. Exceeding it turns a pass into a permanent error.
4. DKIM with your provider's selector, and a check in real received headers that the d= tag is your domain, not a vendor's. Unaligned DKIM means the reputation is accruing somewhere else.
5. DMARC published at _dmarc, starting at p=none with a reporting address someone reads, tightened to quarantine and then reject once the reports are clean.
6. MX and a monitored mailbox, so replies, out-of-office notices and bounce messages reach a human. A domain that cannot receive mail is a bad signal and a wasted pipeline.
7. Warm-up per mailbox, before any live sending and continuing alongside it. Reputation is per sending identity as well as per domain, so a warm domain does not make a new mailbox warm.

Verify step 3 to 5 from the recipient side rather than from a dashboard: send to a mailbox you control, open the raw headers, and confirm spf=pass, dkim=pass with your domain in the d= tag, and dmarc=pass.

Deciding how many

A small number of fully configured domains beats a large pool of thin ones. The reason to have more than one is blast radius — if one gets filtered, the others carry on while you diagnose. The reason not to have dozens is that a large set of freshly registered, contentless domains that all begin sending in the same week is a correlated group, and correlated groups are treated as one.

Map domains to meaningful segments — product line, region, client if you are an agency — so that per-domain reporting tells you something, and stagger registration and warm-up so the domains have different ages.

What not to do

Do not send outreach from your brand root domain. The downside is your own business mail.

Do not register lookalikes of your own name. You are training your prospects to trust the pattern that phishers use on them, and you may be creating a trademark problem for yourself.

Do not buy an aged domain for its history. You cannot see what it did before you, and you inherit it.

Do not point your brand domain's nameservers at an outreach vendor.

Do not skip the website. It is the cheapest trust signal available and the one most setups omit.

Do not skip DMARC because a vendor "handles authentication". The aggregate reports are the only independent view you get of who is sending as you.

Do not assume a warm domain means warm mailboxes. Nothing transfers.

Where MailPilot fits

MailPilot checks SPF, DKIM and DMARC on each sending domain — including whether DKIM is aligned to you rather than to a provider — warms every mailbox over OAuth on Gmail and Outlook or over SMTP/IMAP for SendGrid, Amazon SES, Mailgun, Postmark and custom SMTP, measures real inbox placement per receiving provider through a seed-inbox network, and tracks reputation per mailbox daily. Because every plan includes unlimited mailboxes, running several outreach domains properly does not mean choosing which ones you monitor.