THE VAULT / RUN IT LIKE A BUSINESS / BLUEPRINT + TEMPLATES
The Outbound Engine, Anonymized
This is the real architecture of the cold outbound system I run to sell newsletter sponsorships, anonymized down to the last placeholder. Lookalike domains, DNS that passes, a 2-week warmup gate, a scout-then-judge targeting pattern that spends credits only on chosen contacts, a 3-touch sequence with a 2-day escalation, and reply handling through one API-fed inbox. You walk away with the whole blueprint plus the exact templates and DNS records as downloads, ready to point at any B2B offer.
LAST VERIFIED 2026-07-08 · FOUNDING MEMBER RESOURCE
NOTE
Use this page as a prompt reference. Every file below is built to be handed straight to an AI. Download it, drop it into Claude, ChatGPT, Cursor, or Lovable, and say "use this as my playbook." The prompts on this page are copy-paste ready.
Never send cold email from your main domain
Everything else in this system exists to serve one rule: cold email never touches the domain your business lives on. Not once, not "just this batch of 15". Cold email gets spam-flagged sometimes even when it's good and wanted. Those flags damage domain reputation, and domain reputation is shared by every email the domain sends: your newsletter, your receipts, your password resets. One bad cold campaign from yournewsletter.com can tank the deliverability of the exact product you're selling sponsorships for.
WATCH OUT
The math on this is brutal and one-directional. A burned lookalike domain costs you ~$10 and 2 weeks of warmup to replace. A burned main domain costs you your newsletter's inbox placement, which is the asset. There is no volume of outbound worth risking the send reputation of the thing you monetize. So the shape is: buy 3 to 5 lookalike domains (yournewsletter-hq.com, tryyournewsletter.com), send cold only from those, redirect them to the real site so prospects who check land somewhere credible, and let the lookalikes absorb all reputational risk. I run this exact setup: domains bought, DNS verified, warmup running, and live sends gated behind the warmup date in code (as of July 2026).
Architecture: five components, two human gates
| Component | What it does | Category examples |
|---|---|---|
| Sending platform | Hosts lookalike mailboxes, runs warmup, exposes a send API and a unified inbox | Instantly, Smartlead, and similar cold-email platforms |
| Contact database | Free broad searches to scout, paid credit reveals for verified emails | Apollo and similar B2B databases |
| Prospect state file | Per-company send history, mailbox ownership, reply flags, CRM stage. One JSON file is enough to start | state.json, later a real CRM |
| Sequencer | Renders every email to a draft for review, sends on schedule, enforces caps and reply-stops | A ~300-line script, or the platform's built-in sequencer |
| Reply pipeline | Pulls the unified inbox via API, allowlist-filters, notifies you, stops sequences on reply | Cron script + webhook notification |
Five components, none of them exotic; the value is in how they're wired. The design principle: everything cheap and reversible happens early (searching, judging, drafting), everything expensive and irreversible happens late (credit spends, live sends). Human judgment sits at exactly two gates: picking the contact, and approving the drafts. Everything else is automatable and should be.
The flow, end to end
- 1
Scout (free)
For every target company, pull ALL plausible candidates via the contact database's free search: marketing, partnerships, demand gen, community. No credits spent. Dump everything to a candidates file.
- 2
Judge
A human (or an LLM with a tight rubric, spot-checked) reads each company's candidate list and picks one primary and one alternate. This is where the buyer-vs-marketer call gets made.
- 3
Reveal (paid)
Spend credits revealing verified emails for the chosen two per company only. Never reveal whole rosters. Verified-only by default; bounces are poison on young domains.
- 4
Draft
The sequencer renders every email to a file. You read them. You will catch broken merge fields and stale fit lines every single batch; this gate has never once been useless for me.
- 5
Send
Initial, then follow-up 1 at +3 days, follow-up 2 at +8 days. 10 to 15 cold sends per mailbox per day, hard cap in code.
- 6
Escalate
No reply from the primary after 2 days: the alternate contact gets a fresh intro from a different mailbox. One escalation per company, ever.
- 7
Reply kills everything
Any reply from either contact, including "no", immediately stops every scheduled message to that company. The conversation continues by hand from the mailbox that owns the thread.
- 8
CRM stage advances
queued, contacted, replied, interested, negotiating, booked, live or passed. Update it on every touch, even if the CRM is a JSON file.
Domains and DNS: the records that make you deliverable
Buying the lookalikes
Buy 3 to 5 lookalikes of your real brand. Patterns that work: get<brand>.com, try<brand>.com, <brand>hq.com, <brand>-media.com, read<brand>.com. Stick to .com; bargain TLDs like .xyz carry spam baggage from every spammer who saved $9 before you.
- [ ]3 to 5 domains, 1 to 2 mailboxes each (more domains distributes risk, more mailboxes per domain concentrates it)
- [ ]Buy them the day you decide to do outbound: warmup takes 2+ weeks and older domains warm better
- [ ].com only, ~$10 each, this is not the line item to save on
- [ ]Mailbox names should look human: firstname@, not sales@ or hello@
SPF: one record, hard fail
Use -all (hard fail), not ~all. On a domain whose only job is outbound there is no legitimate "other" sender, so fail them hard; softfail invites spoofing on a domain you're trying to build reputation on. And exactly ONE SPF record per domain: two TXT records starting with v=spf1 is a permerror, which means SPF is effectively broken.
DKIM: your ESP gives you the record
The selector name (s1, selector1) is dictated by the ESP, don't invent one. Take 2048-bit keys where offered, and verify green in the ESP dashboard after adding; propagation is usually minutes, occasionally hours.
DMARC: p=reject, and why that is correct here
p=reject scares people, but on a single-purpose outbound domain it's the obvious call: every legitimate email from this domain is yours and authenticated, so anything failing alignment is spoofing. Reject it. Gmail and Yahoo require at least p=none from bulk senders (5,000+/day); you'll be far under that volume, but reject exceeds the bar and signals a serious sender. Strict alignment (adkim=s; aspf=s) is fine because the From domain and the SPF/DKIM domains are identical here.
MX and the redirect
No MX means replies bounce and the entire system is pointless. And the redirect is not optional cosmetics: prospects check the domain before replying. A parked page or an error screams throwaway spam infrastructure; a 301 to a real site with a real audience page closes the credibility gap in one click.
PAYOFF
The 5-minute verification that saves 2 weeks: send a test from each mailbox to a Gmail account, open it, hit "Show original", and confirm SPF: PASS, DKIM: PASS, DMARC: PASS. Warming a misconfigured domain for two weeks accomplishes nothing, and you won't know until your first real sends hit spam.
The domain math
| Setup | Daily capacity | Blast radius if one domain burns |
|---|---|---|
| 1 domain, 2 mailboxes | 20 to 30 emails | 100% of the operation |
| 3 domains, 2 mailboxes each | 60 to 90 emails | ~33% of capacity |
| 4 domains, 2 mailboxes each | 80 to 120 emails | ~25% of capacity |
| 5 domains, 2 mailboxes each | 100 to 150 emails | 20% of capacity |
At 10 to 15 sends per mailbox per day, 4 domains x 2 mailboxes is roughly 96 emails/day of capacity. That's more pipeline than a solo operator can handle replies for anyway, no single domain carries filter-tripping volume, and none of them is your real one. The full copy-paste record set is in dns-records-example.md at the bottom of this page.
Warmup: the mandatory 2 weeks you cannot skip
New domains and new mailboxes have zero reputation. A zero-reputation sender that suddenly blasts 50 emails a day looks exactly like a spammer, because that is what spammers look like. Mail providers act accordingly. What a warmup network actually does: your sending platform enrolls your mailboxes in a pool of real inboxes that email each other automated but human-looking messages. Those messages get opened, replied to, rescued from spam folders, and marked important. To Gmail and Outlook, your mailbox looks like a normal human account building normal relationships. That's the whole trick.
- 1
Start warmup the day DNS verifies
Every day of delay is a day added to your go-live date. I bought domains and started warmup on day one; my live-send date was gated 12 days out and enforced in code.
- 2
Wait a minimum of 2 weeks
3 to 4 weeks is better. Make the date a literal interlock: my send script refuses to run with the live flag before the warmup-ready date. Willpower is not an interlock; an if-statement is.
- 3
Watch health scores per mailbox
You're ready when: 2+ weeks elapsed, the platform's health score is sustained in its green zone (typically 90%+), and warmup mail is landing in inbox rather than spam across providers.
- 4
Ramp, don't jump
Start at ~5 cold sends per mailbox per day, add ~2/day every few days up to your 10 to 15 cap. Full volume on day one of live sends undoes the warmup story you just spent 2 weeks telling.
- 5
Keep warmup running after go-live
At reduced volume. Warmup traffic keeps the positive-signal ratio healthy alongside real cold sends, which get fewer opens and replies by nature.
WATCH OUT
If a mailbox's health score drops after going live: pause cold sends from it immediately, keep warmup on, resume at half volume when it recovers. If it hasn't recovered in 2 weeks, retire the mailbox. Domains are $10; arguing with a burned reputation is a losing trade.
The sequence: 3 touches, 1 escalation, reply kills all
| Day | Message | To | From | Condition |
|---|---|---|---|---|
| 0 | Initial | Primary contact | Mailbox A | Always |
| 2 | Escalation intro | Alternate contact | Mailbox B (different) | Only if primary silent |
| 3 | Follow-up 1 | Primary, same thread | Mailbox A | Skip if anyone replied |
| 8 | Follow-up 2 (breakup) | Primary, same thread | Mailbox A | Skip if anyone replied |
Four mechanics carry this whole table, and none of them is optional. 1. A reply kills everything. Any reply, from either contact, including "not interested", stops every scheduled message to that company the moment it's detected. An automated follow-up landing after a human reply is how you get spam-flagged and embarrassed in the same afternoon. 2. Escalation is one-shot and from a different mailbox. If the primary is silent after 2 days, the alternate gets a fresh initial with a different fit angle. Not a forward, no "my colleague didn't answer" (that reads as surveillance). One escalation per company, ever. Two people ignoring you is an answer; take it.
3. Daily caps of 10 to 15 per mailbox. This is the load-bearing deliverability number, enforced in code, not vibes. Across 4 domains x 2 mailboxes you still get 80 to 120 sends/day, which will out-produce your ability to handle replies. 4. Follow-ups reply to your own thread. Same subject, In-Reply-To header set. Threading raises reply rates and lowers spam signals versus a fresh subject line every touch.
NOTE
Dry-run by default. My sequencer renders every email to a draft file, and sending live is a separate explicit flag. Every batch I've run, the draft review caught something: a broken merge field, a fit line written for the wrong company, a name spelled from the domain instead of the person. Budget 10 minutes per batch for this; it's the cheapest QA you will ever buy.
Targeting: scout free, judge hard, spend last
The expensive mistake in B2B prospecting is paying to reveal contact data for someone you later realize is the wrong buyer. The fix is to invert the order: on the major contact databases, searching is free and reveals cost credits, so search everyone and reveal almost no one.
- 1
Stage 1: scout everyone (free)
Per target company, pull all plausible candidates via free search endpoints: every title in marketing, partnerships, demand generation, community. You're building a complete menu per company before spending a cent.
- 2
Stage 2: judge (the human gate)
Read each company's candidate list and pick one primary and one alternate, using the title tiers below. An LLM with a tight rubric can do the first pass; spot-check it, because titles lie and one bad pick wastes both a reveal credit and a company.
- 3
Stage 3: reveal picks only (paid)
Spend credits on the chosen two per company. Verified emails only by default: one batch of guessed addresses bouncing can undo two weeks of warmup on a young domain.
Who actually buys sponsorships
Pick the sponsorship buyer, not the first marketer you find. Growth product and performance marketing people build funnels; they don't buy placements. My batch 1 run: 15 companies scouted, 13 came back with a verified primary who plausibly owns the budget, and the misses were companies with no marketing candidates surfaced at all (which is itself a signal to deprioritize).
| Tier | Titles | Why |
|---|---|---|
| 1 | Anything with "creator", "sponsorships", "newsletter", "media buying" | This is literally their job. Rare, but always the right pick when present |
| 2 | Demand generation | Owns paid channels and thinks in CAC; newsletter placements are in their toolbox |
| 3 | Partnerships / business development | Deal-shaped thinkers, often own co-marketing budgets |
| 4 | Brand marketing, field marketing | Buys placements for awareness; slower cycles |
| 5 | Developer relations (for dev-audience newsletters) | Understands your audience natively, budget varies wildly |
| 6 | Community | Last resort; usually influences rather than buys |
WATCH OUT
Avoid: talent acquisition (they buy job ads, not sponsorships), growth product, analyst and ops-only roles, and anyone titled "brand ambassador". These look adjacent and convert at approximately zero.
The fallback ladder: when your pick won't verify
- 1
Verified email revealed
Use as-is. This should be the default outcome for most picks at real companies.
- 2
Unverified but a real address is present
Usable. Tag it
guessin your state file and watch bounces on that domain. - 3
No email at all
Infer from the company's dominant pattern, learned from VERIFIED colleagues at the same domain. If jane.doe@acme.com verified, john.smith@acme.com probably follows. Tag it
pattern. - 4
Only a senior person findable
Use them, but switch the opener from a pitch to a routing ask: "are you the right person for this, or can you point me to whoever is?" Senior people forward; they rarely buy directly. Tag it
routing: seniorso the sequencer picks the right template.
The templates: short, specific, no stats you can't screenshot
The full anonymized template set is in the download below. The rules baked into every one of them:
- [ ]60 to 110 words for the initial, shorter for follow-ups. Nobody reads cold essays
- [ ]One specific fit sentence per email referencing something checkable (a launch, a feature, a category). Never "I love what you're doing"
- [ ]No stats claims in email 1 unless you can screenshot them on the first call. Offer the numbers instead of asserting them
- [ ]One CTA, phrased as a question. No calendar link in the first touch
- [ ]Minimal signature: name, one-line identity, link to the real site. No images or banners (they hurt deliverability on young domains)
- [ ]A one-line opt-out in every email, no exceptions
Reply handling: one inbox, allowlist-filtered, thread-consistent
Run 4 domains with 2 mailboxes each and you have 8 inboxes; checking 8 webmail tabs is not a system, it's a way to miss a reply and lose a deal to latency. The whole reply side runs through one unified inbox pulled via the sending platform's API.
- 1
Poll the unified inbox on a schedule
Every 15 minutes via cron works, with a daily hosted-cron backstop in case the local machine sleeps. Add a notification (Slack webhook, push, whatever you already run) on new replies.
- 2
Filter by allowlist, not by pattern
Only surface messages from contacts you have actually emailed, by matching the sender against your prospect state file. The non-obvious reason this matters: warmup traffic arrives from random third-party domains and looks like real email. Allowlist membership excludes all of it cleanly; content pattern-matching never will.
- 3
Reply from the mailbox that owns the thread
Always, via the platform's API, with In-Reply-To set. Never from your main-domain personal account and never from a different lookalike: it breaks threading, confuses the prospect, and leaks the architecture.
- 4
Let reply detection drive the sequencer
The same poll that surfaces replies flips the company's reply flag in the state file, which is exactly what stops scheduled follow-ups. One source of truth, two consumers.
- 5
Advance the CRM stage on every touch
queued, contacted, replied, interested, negotiating, booked, live or passed. When a sponsor asks "what did we agree in March", you'll have it.
PAYOFF
Response speed is a conversion lever you fully control. Cold-reply conversations reward same-hour answers over same-day ones; the prospect replied while you were top of mind, and that window closes fast. This is the entire justification for the 15-minute poll plus notifications instead of a daily inbox check.
Compliance: decide deliberately, not accidentally
Not legal advice; a map of the tradeoffs so you make each call on purpose instead of by omission. The practical minimum bar wherever you operate: a working opt-out in every email, every "no" honored permanently in your state file, verified emails only, no deceptive subjects, and a real website behind the sending domain.
CAN-SPAM (US): the postal address rule everyone wants to skip
Cold B2B email is legal under CAN-SPAM if you: (1) don't use deceptive headers or subject lines, (2) include a functioning opt-out and honor it within 10 business days, (3) include a valid physical postal address in every email. Statutory penalties run to five figures per email in theory.
The postal address is the requirement solo operators most want to skip, because it means printing your home address in every cold email or paying for a virtual mailbox (roughly $10 to 30/month). Skipping it is a real, quantifiable legal risk that some operators knowingly accept and others solve with the virtual address. Decide which you are; don't just forget the requirement exists. I made this call explicitly, in writing, with a date on it, and you should too.
The opt-out line is not negotiable under any reading. Every template in this system carries one, and a reply that says "stop" gets honored permanently, which is both the law and basic hygiene.
Germany (UWG) and the EU: there is no cold-email carve-out
Germany's UWG requires prior express consent for commercial email, including B2B. First contact by email without consent is already a violation, and it gets enforced through competitor and consumer-association cease-and-desist letters with real costs attached. Austria is similar.
If your prospect list includes German companies, the defensible move is to pull them out of email sequences entirely and use LinkedIn or warm intros instead. GDPR also applies to processing prospects' personal data across the EU: legitimate-interest balancing for B2B contact data, and a right to erasure you must honor on request.
The deliverability-compliance overlap (the free wins)
Several compliance behaviors are also pure deliverability wins, so there's no tradeoff to weigh: verified-only emails keep bounce rates down (a reputational signal filters watch), honest subject lines keep spam-report rates down, honoring opt-outs immediately prevents the angriest recipients from hitting the spam button instead, and the real website behind the sending domain helps both credibility and filter trust. Do all of these regardless of jurisdiction.
Build order and what it costs
- [ ]Buy 3 to 5 lookalike domains (~$10 each)
- [ ]Add SPF with
-all, DKIM, DMARCp=reject, and MX per domain; verify PASS/PASS/PASS via Gmail "Show original" - [ ]301-redirect every lookalike root to the real site over HTTPS
- [ ]Create 1 to 2 human-named mailboxes per domain on the sending platform; start warmup immediately
- [ ]While warming (2+ weeks): build the target list, run scout searches, judge picks, reveal verified emails for picks only
- [ ]Write the sequence, render every email to drafts, review by hand
- [ ]Wire the interlocks in code: live sends refuse before the warmup-ready date, daily cap 10 to 15 per mailbox, reply flag stops sequences
- [ ]Go live at ~5/day per mailbox, ramp by ~2/day to the cap
- [ ]Poll the unified inbox every 15 minutes, allowlist-filtered, with notifications
- [ ]Reply same-hour from the owning mailbox and advance the CRM stage
Total cost to stand this up: roughly $30 to 50 in domains, $30 to 100/month for the sending platform, plus the contact database's credit plan at your volume (as of July 2026). One booked placement pays for months of the whole stack, which is the correct way to size the decision.
NOTE
Timeline reality check: from "I should sell sponsorships" to first live send is about 3 weeks, and 2 of them are warmup you cannot compress. The move is to start the domains and warmup today and build everything else inside the wait.
The downloads
Get the next drop
Every new Vault system ships to the list first. Twice a week, free.