# DNS Records for a Cold Outreach Domain (Example Set) Copy this per lookalike domain. Placeholders: replace `yournewsletter-hq.com` with your lookalike sending domain, `yournewsletter.com` with your real site, and the DKIM value with what your sending platform gives you. Rule zero: these records go on the LOOKALIKE domain only. Your main domain never sends cold email and never appears in a cold email's From header. ## 1. SPF (TXT on root) Authorizes your sending platform's servers and hard-fails everything else. ``` Type: TXT Host: @ Value: v=spf1 include:_spf.yoursendingplatform.com -all ``` Notes: - Use `-all` (hard fail), not `~all`. On a domain whose only job is outbound, there is no legitimate "other" sender, so fail them hard. Softfail invites spoofing on a domain you are trying to build reputation on. - Exactly ONE SPF record per domain. Two TXT records starting with `v=spf1` = permerror = SPF effectively broken. - The `include:` value comes from your sending platform's docs (every ESP publishes one). ## 2. DKIM (TXT or CNAME on a selector subdomain) Your ESP generates the key pair and gives you the record. It looks like one of these: ``` Type: CNAME Host: s1._domainkey Value: s1.dkim.yoursendingplatform.com ``` or a raw public key: ``` Type: TXT Host: selector1._domainkey Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...KEY_HERE...IDAQAB ``` Notes: - The selector name (`s1`, `selector1`, etc.) is dictated by the ESP. Do not invent one. - 2048-bit keys where the ESP offers them. - Verify inside the ESP dashboard after adding; propagation is usually minutes, can be hours. ## 3. DMARC (TXT on _dmarc) ``` Type: TXT Host: _dmarc Value: v=DMARC1; p=reject; rua=mailto:dmarc@yournewsletter-hq.com; adkim=s; aspf=s; pct=100 ``` Notes: - `p=reject` is correct for a dedicated cold-outbound domain: all legitimate mail is yours and authenticated, so anything failing alignment is spoofing. Reject it. - Gmail and Yahoo require at least `p=none` from bulk senders (5,000+/day). Cold volume stays far under that, but `p=reject` satisfies them anyway and signals a serious sender. - `rua` reports are optional but cheap. Point them at a mailbox you can ignore until you need to debug. - `adkim=s; aspf=s` (strict alignment) is fine here because the From domain and the DKIM/SPF domains are identical on a single-purpose domain. ## 4. MX (so you can receive replies) Your sending platform hosts the mailboxes, so use the MX they specify: ``` Type: MX Host: @ Priority: 10 Value: mx.yoursendingplatform.com ``` No MX = replies bounce = the entire system is pointless. Verify by sending yourself a test email and replying to it. ## 5. Root redirect (301 to the real site) Not a DNS record type per se, but part of the same setup pass. Anyone who types the lookalike domain into a browser should land on your real site: ``` yournewsletter-hq.com/* -> 301 -> https://yournewsletter.com ``` Do it with your registrar's forwarding feature or a one-line redirect on any host. Prospects DO check the domain. A dead page reads as spam; a redirect to a real site with a real product reads as a company. ## 6. Verification checklist - [ ] Exactly one SPF record, ends in `-all`, includes only your ESP - [ ] DKIM selector verifies green in the ESP dashboard - [ ] `_dmarc` TXT present with `p=reject` - [ ] MX records present, test reply round-trips - [ ] Root domain 301s to the real site over HTTPS - [ ] Check all of it in one shot: send a test to a Gmail account, open the message, "Show original", confirm SPF=PASS, DKIM=PASS, DMARC=PASS - [ ] Repeat for every lookalike domain (3 to 5 of them) ## 7. The domain math - 3 to 5 lookalike domains, 1 to 2 mailboxes each. - Each mailbox caps at 10 to 15 cold sends per day after warmup. - 4 domains x 2 mailboxes x 12/day = ~96 cold emails/day of capacity, with no single domain carrying enough volume to trip filters, and no domain being your real one. - If one domain gets burned, you lose 20 to 25% of capacity, not the operation, and never the brand.