Affiliate disclosure: This publication may earn commissions through PlusVibe and Instantly referral links. Our evaluation criteria and limitations are explained in the methodology.
Cold email infrastructure is the combination of domains, mailboxes, authentication, list controls, sending software and operational monitoring that makes an outbound program manageable. For agencies, the hard part is repeating that system for different clients without crossing data or ownership boundaries.
Infrastructure is not an inbox placement hack. A sound setup protects account ownership, authenticates legitimate messages, honors recipient choices, follows provider policies and makes errors visible. No domain-count formula or warm-up schedule guarantees delivery.
Once DNS, mailbox ownership, opt-out handling, and monitoring are planned, review PlusVibe as one documented option for running the outreach workflow.
Choosing a platform is not a substitute for authentication or provider compliance.
Shopping for a mailbox or sending-infrastructure provider instead? Use the separate infrastructure-provider selection guide for procurement criteria. This guide covers the operational setup and evidence you must retain regardless of provider.
Client launch signoff: evidence and stop conditions
Give each launch item an accountable owner and retain an artifact before changing a client's sending state. “Pass” should be based on a verified sample or provider record, not an unreviewed configuration screenshot.
| Control and owner | Verification artifact | Pass requirement | Stop / escalation |
|---|---|---|---|
| Domain ownership · client | Registrar access + renewal record | Client controls domain and renewal recovery | No authorized owner or expired renewal |
| SPF/DKIM/DMARC · technical operator | Headers from an actual test message | Required authentication passes and aligns as applicable | Auth error or unauthorized sender |
| MX and reply routing · mailbox owner | Real incoming reply/recovery test | Named human receives and can act on replies | Replies lost or sent to wrong client |
| Provider policy / security · account admin | Provider terms + MFA/access check | Authorized use and known rate controls | Sending prohibited or account access exposed |
| Prospect provenance · client compliance lead | Source, purpose, review of recipient eligibility | Legitimate acquisition and legal review completed | Unknown provenance or prohibited outreach |
| Opt-out / suppression · campaign operator | Test unsubscribe and block-list audit | Suppression prevents future sends across client workflow | Re-contact risk |
| Sending/complaint watch · deliverability owner | Initial monitoring log with accountable reviewer | Deferrals, bounces and complaints monitored | Provider warning or unexplained spike: pause |
| CRM and client access · account lead | Role and reply-to-CRM demonstration | Correct client boundaries, stages and inbox owner | Cross-client exposure or missing replies |
| Client go-live approval · client sponsor | Dated signoff and rollback contact | Client approves named campaign and pause authority | Approval absent: do not launch |
Illustrative recurring budget: 10 client-approved inboxes × $12/month + two domains × $18/year ÷ 12 + $50/month verification = $173/month before software and labor. All unit costs are assumptions, not vendor prices. Change these assumptions in the agency calculator. See Google sender guidelines and the FTC CAN-SPAM guidance for actual applicable sender requirements.
Map your infrastructure before creating accounts
| Layer | Owner / purpose | Minimum operating record |
|---|---|---|
| Client identity | Which business is actually sending, and who is accountable? | Client name, authorized domains, consent/legal basis review and approver. |
| Domains and DNS | Domain controls and sending authentication. | Registrar, renewal owner, DNS provider, SPF, DKIM and DMARC records. |
| Mailboxes | Real users/sender identities and provider permissions. | Mailbox provider, account owner, recovery methods, billing and allowed uses. |
| Data controls | Prospect source, accuracy, suppression and deletion. | Source, verification date, unsubscribe list, retention schedule. |
| Software | Campaign workflows, reply handling and reporting. | Platform tier, users, workspaces, API scopes, billing and export plan. |
| Health and monitoring | Bounce, complaint and incident response. | Baseline dashboard, alerts, review cadence and stop conditions. |
Step 1: domain ownership and separation
Decide whether the client or the agency owns each domain. A client-owned domain should not be left inside a departing contractor's registrar account. Record who can update DNS, renew registrations and revoke access. If multiple domains are used, make the reason operationally clear—different brands or legitimate sending streams, not a way to evade provider enforcement or spam complaints.
For each domain, keep a small runbook: registrar login owner, authoritative name servers, billing schedule, DNS changes, provider connections, DMARC reporting and the person who can authorize deletions. Avoid mixing sensitive transactional email with cold outreach when different policies or risks apply.
Step 2: configure SPF, DKIM and DMARC
SPF: who is authorized to send
Sender Policy Framework publishes authorized sending systems for a domain. Start from each actual mailbox/email-service provider's documentation and consolidate into one valid SPF record for that domain. Blindly copying example records between providers can break legitimate sending. Test the record after changing vendors.
DKIM: authenticate message signatures
DomainKeys Identified Mail uses cryptographic signatures to help receivers authenticate that a message has not been altered. Enable DKIM in the selected provider and publish the provider's exact DNS selector records. Confirm a real sent message passes authentication.
DMARC: alignment and policy
DMARC defines how messages that fail alignment should be handled and can provide reporting. Start with a policy appropriate for your actual environment, monitor the reports and move to stronger enforcement only after legitimate senders are accounted for. Google’s sender guidelines require SPF or DKIM from all senders to personal Gmail accounts and additional authentication for bulk senders. Follow the latest provider rules, not a copied record.
Step 3: provision legitimate mailboxes
Choose mailbox providers based on permitted usage, support, security, authentication and costs. Assign clear sender identities and enforce multifactor authentication where possible. Track recovery methods and lifecycle dates. Avoid buying a large quantity of mailboxes before proving that prospect relevance, recipient choice and service-provider policies are sound.
Do not estimate required domains by multiplying an arbitrary daily email target. Use the capacity-envelope worksheet to account for follow-up messages, provider policies, and permitted mailbox status before paying for more accounts.
Do not treat a platform's “unlimited accounts” allowance as unlimited permission to send. A connected account still has mailbox-provider and reputation constraints. Budget the mailbox subscriptions and annual domain renewals separately from campaign software in the agency calculator.
Step 4: clean data, suppression and opt-outs
Keep provenance for lead data, minimize collection and avoid harvesting addresses or guessing large lists. Validate contact information, honor opt-outs and stop sending to recipients who request no further contact. The FTC requires clear sender identity, non-deceptive subject lines, a physical postal address and a working opt-out mechanism for applicable US commercial email. Some states, countries, industries and inbox providers impose additional duties.
Build a suppression workflow that crosses campaigns and persists through migrations. A person who opted out should not reappear because an agency changed sequencers.
Step 5: sequencing, warm-up and cautious rollout
Warm-up tools automate interactions among inboxes, but simulated engagement can be noisy and should never be represented as proof of genuine interest. Follow provider policies, use authentic accounts and monitor actual delivery errors, complaint feedback and human replies. Begin with a small authorized audience and increase only when metrics and policy allow. For comparison, read best email warm-up tools.
Step 6: monitoring and incident response
- Authentication: regularly inspect SPF/DKIM/DMARC status and reports.
- Deliverability: investigate sustained bounce spikes, blocks, spam complaints and reputation changes.
- Operations: watch unanswered replies, duplicate sends, broken suppression and incorrect workspace assignment.
- Security: review member access, rotate exposed credentials, audit integrations and offboard promptly.
- Recovery: pause the affected workflow, identify root cause, correct it and only then resume compliant sending.
When an incident is provider-specific, use the diagnostic-tools comparison to match the failure to a suitable DNS, transport, postmaster, seed or DMARC test.
Launch-readiness checklist for one client
- Client approves sender identity, messaging and lawful outreach basis.
- Domain ownership and renewal responsibility are recorded.
- SPF, DKIM and DMARC are published and validated with real headers.
- Mailbox-provider terms and permitted sending methods are checked.
- Prospect source and suppression handling are documented.
- Every campaign has an opt-out pathway and genuine contact information.
- Replies route to a named owner; errors trigger a pause process.
- All platform permissions, workspace isolation and exports are tested.
- Budget includes domains, inboxes, software and variable data expenses.
- A review date and escalation owner are assigned.
Where sending software fits
A sequencer can coordinate campaigns, inbox rotation and replies, but it cannot replace domain governance, lawful messaging or list quality. PlusVibe and Instantly each document warm-up, account and campaign capabilities. Use the software decision guide to select the software layer after the operational requirements are clear.
Already have the infrastructure plan? Compare how a supported outreach platform could organize campaigns and client work.
See PlusVibe's current plans ↗FAQs
How many domains and inboxes should an agency buy?
There is no universal safe number. Start with legitimate sending needs, provider rules and a manageable monitoring footprint. Add accounts for documented business reasons rather than for artificial volume escalation.
Does configuring SPF, DKIM and DMARC mean a campaign is compliant?
No. Authentication helps establish sender legitimacy, but messaging content, data rights, unsubscribe handling and provider policies have separate requirements.
Does warm-up guarantee inbox placement?
No. Google and Yahoo prioritize authentication, sender behavior and wanted mail. No warm-up software can guarantee a particular recipient's inbox placement.
Continue your research
Best Email Warmup Tools: What Agency Operators Should Check ↗Cold Email Agency Tech Stack & Monthly Cost Calculator ↗Best Cold Email Software for Agencies: Two Platforms Compared ↗PlusVibe vs Instantly: Agency Workflow and Cost Comparison ↗Sources & verification
Primary vendor documentation and sender-policy references supporting the claims above. These links are citations, not affiliate sign-up CTAs. Plans and regulations may change.