Primary Domain Isolation for Cold Email

Your primary domain carries: Sales and support email to existing customers. Invoices and contracts. Password resets, signups, and transactional mail from your product. Recruiting, partner, and investor email.

Domain reputation is shared across everything sent from that domain. Cold email to people who did not ask to hear from you produces more ignores, deletes, and complaints than any of the above. Run it on the main domain and those signals mix with the mail you cannot afford to lose. Recovering a damaged primary domain is slow, and you cannot swap it for a new one.

1. Dedicated sending domains, for example brand plus a short word, on .com or .co. They should look clearly related to you so prospects trust them.
2. Separate mailboxes on those domains, two or three per domain.
3. Their own authentication: SPF, DKIM, DMARC, and MX published per sending domain.
4. Their own warmup and health monitoring.
5. A redirect from each sending domain to your main website, so curious prospects land somewhere real.
6. Replies routed to the people who need them, either through your sequencer's inbox or a unified reply inbox, without forwarding everything into primary mailboxes by default.

1. Buy sending domains that match your brand. Avoid hyphen or number heavy names.
2. Set up Google Workspace (or Microsoft) on each domain. Keep sending domains on their own tenants or groups rather than adding them as aliases inside your primary tenant.
3. Publish MX, SPF, DKIM, and DMARC for each sending domain and confirm all three authentication checks pass on a test email.
4. Configure forwarding of the website to your main domain.
5. Create mailboxes with real sender names that match your team.
6. Warm up for roughly two to three weeks.
7. Connect only the sending mailboxes to your sequencer. Remove any primary domain mailbox that is connected for cold campaigns.

Primary mailbox still connected to the sequencer for a few warm leads, and it ends up in a cold campaign. Sending domains added as aliases on the primary Workspace tenant, so a suspension on the tenant affects everyone. Links pointing to a tracking domain on the primary domain. Signatures with the primary domain email that invite prospects to reply to the main address, where a burst of out of office and complaint replies lands. Shared DMARC reports that nobody separates, so you cannot tell which domain is causing a problem.

Agencies need two layers of isolation:

Agency from clients. Your agency's domain never sends client outreach.

Client from client. Each client gets its own sending domains and mailbox pool. A bad list for client A should never touch client B's results. Practical rules: No shared sending domains across clients. Separate tenants or at minimum separate organizations per client. Mailboxes tagged by client in your sequencer. Clear ownership of domains in the contract, so offboarding is clean.

Isolation limits the blast radius. It does not make cold email safe on its own. You still need verified lists, sensible volume per mailbox, authentication that passes, and copy written for the person reading it. A sending domain that burns still costs you a domain and the campaign time on it; the point is that it does not cost you your company email.

1. List every mailbox connected to your sequencer. Any on the primary domain?
2. List every domain sending outbound. Each has SPF, DKIM, and DMARC passing?
3. Are any sending domains aliases on the primary tenant?
4. Do any templates or signatures point replies to a primary domain address?
5. For agencies: does any sending domain carry more than one client?

Anything that answers yes to the wrong question is a fix for this week.

ColdMail is built around isolation. It provisions official Google Workspace mailboxes on dedicated domains, each with its own official admin panel and 2FA, and publishes SPF, DKIM, DMARC, and MX automatically, so keeping outbound off your primary domain does not mean days of setup. Agencies can run multiple organizations to keep clients apart, and the unified reply inbox collects replies from every sending mailbox in one place, labeled by intent. AI warmup is an optional add on. ColdMail sits under Instantly, Smartlead, or n8n and does not replace them.

Get started at coldmail.app.