Protecting your domain reputation in cold outreach

You sent forty messages, got no replies, and sat down to rewrite the message. There is one more possibility to rule out first: they were not read because they never reached an inbox.

Authentication is three DNS records

Three DNS records prove an email really came from your domain, and all three are set up once and then forgotten.

SPF lists which servers may send mail on your behalf. DKIM signs every outgoing message, and the receiving server checks the signature against your public key. DMARC says what to do when those two fail, and gives you reporting.

Google’s published requirements for bulk senders name all three: set up SPF and DKIM for your domain, set up DMARC for your sending domain, and align the domain in the From: header with either the SPF domain or the DKIM domain. The same document requires one-click unsubscribe on marketing messages and asks senders to keep the spam rate reported in Postmaster Tools below 0.30%.

Those thresholds are defined for senders of roughly five thousand messages a day or more. At twenty messages a week you are not in that class, but the authentication half applies to you exactly the same way: a message from a domain with no records looks suspicious whatever it says.

Don’t send from your main domain

Using a separate domain for cold outreach is the most important decision in the setup.

The reason is simple: reputation attaches to the domain. If your outreach collects complaints, what suffers is the address you send quotes and invoices from. A separate domain keeps a campaign that goes badly away from the work that pays.

A separate domain is also new, so it is building reputation from nothing, which forces you to ramp volume gradually. Five in the first week, ten in the second, twenty in the third. A hundred messages leaving a brand-new domain at once is a familiar pattern to providers.

Why bounces are expensive

The cost of writing to an unverified list is not the wasted time. Sending to addresses that don’t exist is the strongest signal a receiving server has that a list was bought or has gone stale.

A high bounce rate lowers reputation directly, and lowered reputation affects the valid addresses on the same list. Nine dead addresses in a list of forty can be the reason the other thirty-one never reach an inbox.

Which is why basic verification is better understood as a step that protects the remaining records than as one that shortens the list.

What the content contributes

If authentication is in place and messages still land in spam, the content is next. The things that trip filters are predictable: shortened links, a body that is one big image, a lot of links, identical text to every recipient.

Writing to a local business you need none of those anyway. Plain text, two short paragraphs, one link and one sentence specific to the recipient both works better and stays out of the filter.

The legal side is a separate question

Everything above is about deliverability, not permission. Rules for unsolicited commercial email differ by country, and in most of them it matters whether the recipient is a private individual or a registered business.

Check that against current law where you and your recipients are, not against a blog post. A flawless technical setup does not turn a message that needed consent into one that had it; the two questions are independent and both have to be answered.