What is an outbound sending domain?
An outbound sending domain is a separate domain, registered alongside your main company domain, used only for cold or prospecting email. If your company is northwind.com, outbound might come from northwindhq.com or trynorthwind.com. The goal is to keep the reputation consequences of outreach away from the domain that carries your invoices, support conversations and customer marketing.
Setting one up properly takes an afternoon of DNS work and a few weeks of patience. Most problems we see come from skipping one of the two.
Should I use a subdomain or a separate domain?
For cold outreach, a separate registered domain usually makes more sense than a subdomain of your main domain. Mailbox providers associate subdomains with their parent: Google, for example, counts messages from subdomains toward the primary domain when deciding whether a sender is a bulk sender. A subdomain also inherits your main domain’s DMARC policy unless you set a separate one, which can lead to surprises in either direction.
Subdomains are the right choice for other things, such as separating marketing email from transactional email on platforms you control. For outbound, the separation you want is at the registered-domain level.
Choosing the domain name
The name should be obviously yours. A recipient who looks at the sender address should be able to tell which company is writing to them, and if they type the domain into a browser they should land on your real website.
Good patterns are close, honest variations: getnorthwind.com, northwindteam.com, northwind.io if you don’t use it. Avoid anything that could be mistaken for a different company, typo-style lookalikes of your own domain (which look like phishing), and generic names with no connection to your brand. CAN-SPAM requires header information that accurately identifies the sender, and recipients who can’t tell who you are tend to use the spam button.
How many domains? Enough to keep each one at modest volume, and no more than you can actually monitor. If nobody is checking bounce data for a domain each week, it’s one domain too many.
Step-by-step setup
Register the domain and point it to your website
Register through the same registrar or account you use for other company domains so access doesn’t sit with one person. Set up a permanent redirect from the new domain to your main website. A domain that resolves to nothing, or to a parked page, looks like a throwaway.
Create the mailbox tenant
Add the domain to Google Workspace or Microsoft 365, usually as a secondary domain or separate tenant depending on how you manage users. Verify ownership with the TXT record the provider gives you.
Add MX records
Outbound mailboxes must receive mail. Replies, out-of-office notices and bounces all come back here, and a domain that can’t receive email looks suspicious and loses you the replies you wanted. Use the MX records your mailbox provider specifies.
Publish SPF
Create one SPF TXT record at the root of the domain that authorizes your mailbox provider, for example “v=spf1 include:_spf.google.com ~all” for Google Workspace. Only one SPF record is allowed per domain, and SPF evaluation fails if it needs more than 10 DNS lookups, so don’t pile on includes for tools that don’t actually send from this domain.
Enable DKIM
Generate a DKIM key in the mailbox provider’s admin console, publish it as a TXT record (Google) or CNAME records (Microsoft 365), then turn signing on. Use a 2048-bit key where your DNS host supports it. Many people publish the record and forget the final step of switching signing on.
Publish DMARC
Add a TXT record at “_dmarc.yourdomain.com”. Start with monitoring, for example “v=DMARC1; p=none; rua=mailto:dmarc@yourmaindomain.com”, so you receive aggregate reports. Once reports show only your legitimate mailboxes sending and passing, move to “p=quarantine” and then “p=reject”. A strict policy protects the domain from being spoofed by someone else.
Set up a custom tracking domain if you track links
If your sending tool tracks link clicks, configure a custom tracking subdomain (a CNAME such as “links.yourdomain.com” pointing to the tool). Shared tracking domains are used by many senders, and you inherit their reputation.
Create mailboxes for real senders
Each mailbox belongs to a real person who can answer replies, with their actual name, a profile photo and a plain-text signature that includes your company name and, where required, a postal address. Keep the number of mailboxes per domain small.
Verifying the setup
Don’t trust the DNS panel; check what the world sees. Send a test from each mailbox to a Gmail and an Outlook address you control, open the original message or headers, and confirm:
- SPF: pass, with the envelope sender on your outbound domain.
- DKIM: pass, with “d=” matching your outbound domain.
- DMARC: pass, aligned with the From address.
Then add each domain to Google Postmaster Tools. It won’t show data until a domain sends meaningful Gmail volume, but when something goes wrong you’ll want the history. If you use our SPF, DKIM and DMARC guides, each one includes the common failure patterns for that record.
Ramping up a new domain
A new domain has no reputation, and that’s not the same as a good one. Start each mailbox with a small daily volume of normal, real email: replies to existing conversations, internal messages, emails to partners. Introduce cold sends gradually, to your best-verified and most relevant segment first, and increase only while bounces stay low and replies keep coming.
There’s no fixed schedule that works for every domain, and anyone offering one is guessing about your list. The domain warmup guide explains what to watch during this period and when to slow down.
A scenario we see often: a team registers five domains on Monday, creates fifteen mailboxes on Tuesday and launches a 6,000-contact campaign on Wednesday because the tool showed every mailbox as “connected.” By Friday, two domains are getting authentication-related rejections because DKIM signing was never switched on, and the others are seeing bounces from an unverified list. Everything about the setup was technically present. The order and pace were wrong.
Keep a domain register
Domains outlive the people who set them up. Keep a simple register, reviewed monthly:
- Domain: registrar, DNS host, renewal date and who has access.
- Purpose: which team or program uses it, and since when.
- Authentication: SPF, DKIM and DMARC status, and current DMARC policy.
- Mailboxes: named sender for each, and current daily limit.
- Sending tool: which tool connects to it, and the tracking domain if any.
- Health: last week’s bounce rate, opt-outs and any blocks or errors.
- Status: active, paused or retired, with the date and reason.
When a domain is retired, don’t let it lapse silently. Keep it registered for a while so no one else picks it up and receives replies meant for you, and keep its DMARC policy at “p=reject” so it can’t be spoofed.
Compliance details that live at the domain level
A few compliance requirements depend on how the domain and mailboxes are set up, not only on the campaign:
- The From name and address must identify your company honestly. No borrowed brands, no personas that aren’t real people.
- A working opt-out must reach someone who acts on it. If opt-out replies go to an unmonitored mailbox, you have an opt-out link that doesn’t work.
- CAN-SPAM requires a valid physical postal address in commercial email. Put it in the signature template so it can’t be forgotten.
- Opt-outs from every domain must feed one central suppression list, as described in our guide to cold email infrastructure.
How many outbound domains do I need?
As few as will keep each mailbox at a modest daily volume for the audience you’re targeting. More domains don’t fix a weak list, and every extra domain is something else to authenticate, renew and monitor.
Should outbound domains have a website?
They should redirect to your main website. Recipients and spam filters both check, and a domain that leads nowhere looks disposable.
Can I use the same DMARC policy as my main domain?
You can use the same approach: start at p=none with reporting, then move to quarantine and reject once you’ve confirmed only your mailboxes send from it. Each separate registered domain needs its own DMARC record.
What happens to replies sent to an outbound domain?
They arrive in the sender’s mailbox, which is why MX records and real, monitored mailboxes are essential. It’s common to also collect them in the sending tool’s shared inbox so interested replies can be routed to the CRM.