How to start cold emailing in 2026: the first 30 days, in order

To start cold emailing you need, in this order: a domain that is not your main one, mailboxes on it, SPF, DKIM and DMARC published and verified, two weeks of warm-up, a verified list of people with a specific reason to hear from you, a short message, and a sequencer to send it. The order matters because each step is what the next one depends on. Skip one and the campaign fails quietly at that step, usually while you are busy rewriting the subject line.

What do you need before sending your first cold email?

Seven things, and the first four are infrastructure. They are the part nobody enjoys and the part that decides whether the message arrives at all.

1. A separate domain. Cold mail carries risk, and the risk should never touch the domain your invoices and your customers live on.
2. Mailboxes on that domain. Volume comes from mailbox count, not from pushing one mailbox hard: 3 cold emails per Microsoft 365 mailbox per day is the safe rate.
3. SPF, DKIM and DMARC, published and then verified with a lookup rather than assumed from a green tick in an admin panel.
4. Warm-up, 14 days minimum before the first cold send, and running for as long as the domain sends.
5. A list you built against a definition of who you want, with every address verified before it is sent to.
6. A message with one reason for writing and one small ask, under 100 words.
7. A sequencer to send it, track replies and stop the sequence when someone answers.

The rest of this post takes those in order and says how long each takes. The honest total from nothing to first cold send is about three weeks, and most of that is the domain warming while you build the list.

Should you send cold email from your main domain?

No. A domain builds a reputation with every receiving provider, and cold email spends that reputation: unknown recipients, low engagement, the occasional complaint. When a cold email domain gets junked or blocklisted, the fix is to retire it and start another. That is survivable for a domain that exists to send outbound and a disaster for the one your company runs on.

Register a domain that reads as yours, close to the brand, on a common TLD. Not the .info bargain, not five variants bought in one sitting from one account, which look like a batch because they are one. How many domains you need and how to choose them is its own decision; for a first campaign, one is enough.

How many inboxes do you need to start?

Work backwards from sends per day. On Microsoft 365 a cold email mailbox is safe at about 3 messages a day, so a hundred mailboxes on one domain gives 300 sends a day. Five mailboxes gives 15, which is enough to learn the tooling and too little to learn anything about the market: at 15 a day a 2% reply rate is one reply every three days, and you cannot tell signal from noise.

Setting the mailboxes up is the step that scales worst by hand: a hundred mailboxes means a hundred accounts, a tenant, licences, and three DNS records that have to be right before the first message. It is also what we provide. One order is 100 Microsoft 365 inboxes on one domain for $30 a month, authenticated and verified before handover, live in 24-48 hours, on your own domain or one we register for $12. Whether you buy or build, the number to plan around on Microsoft is 3 per mailbox per day, volume from count.

How do you set up SPF, DKIM and DMARC?

Three DNS records. SPF names the servers allowed to send for the domain. DKIM is a signature on each message, checked against a public key in DNS. DMARC tells receivers what to do when the other two fail, and where to send reports. The exact records and the mistakes that break them silently are covered in full; the short version is that all three must exist, SPF must stay under ten DNS lookups, and DMARC starts at p=none with a reporting address.

Then verify. Publishing a record and having it resolve are different events, and a record with a typo returns nothing rather than an error. Run the domain through the free DNS records checker, or dig it by hand, and do not send until all three pass.

How long do you warm up before the first send?

At least 14 days, and warm-up stays on after the campaign starts. A new domain has no history, and no history reads as spam to every receiving system. Warm-up manufactures the history: a pool of mailboxes at other domains, run by your sequencer, exchanges mail with yours and opens, replies to and rescues it from junk. Start at 1 warm-up message per mailbox per day, rise to 5, hold there, and send no cold mail until day 15. The full schedule and what warm-up cannot fix has the day-by-day table and a week of our own bounce data.

Two weeks feels like waste when the domain is doing nothing visible. It is the difference between a domain that lasts months and one in junk by the end of week three. Use the fortnight to build the list.

Where does the list come from?

You build it, one contact at a time, against a definition of who you want: title, company size, industry, a trigger that makes now the right time. Addresses come from B2B data platforms, from LinkedIn Sales Navigator searches enriched into emails, and from company websites, and every one of them goes through an email verifier before it is sent to. Where to get emails for cold emailing covers each source and the verification step in detail.

Do not buy a list. A bought file has been sent to by everyone who bought it, bounces at rates providers treat as a list-quality problem, and is prohibited under our acceptable use policy for the same reason it is a bad idea everywhere else: the reputation it burns is the domain's, and the domain is yours.

What should the first cold email say?

One reason you are writing to this person, one sentence on what you do for people like them, one small ask. Under 100 words, plain text, no images, no tracking pixels, at most one link and preferably none in the first message. The subject line is a few plain words that would not look out of place from a colleague. Templates that still work, subject lines that get opened and personalization that is worth the time each go deeper; for a first campaign, short and specific beats clever.

Write two or three follow-ups before you start, spaced three to five days apart, each adding something rather than repeating the first. How many follow-ups and how far apart has the spacing. The sequence stops the moment someone replies, which is the sequencer's job.

Which sequencer should you use?

Almost any of them. A sequencer connects to your mailboxes over OAuth or an app password, sends the sequence at the pace you set, runs the warm-up pool, and stops on reply. Instantly, PlusVibe, Smartlead, EmailBison, Lemlist and Saleshandy all do this; what the software does and does not do is the fuller picture. The mailboxes and the sequencer are separate decisions, and you can change the sequencer later without touching the inboxes.

What do the first 30 days look like?

The first campaign is deliberately small. Two or three hundred contacts is enough to read bounce rate and to see whether replies arrive at all, and small enough that a bad list or a bad message costs a week rather than a domain.

What numbers tell you it is working?

Bounce rate first, because it is the one the infrastructure is accountable for and the one that arrives fastest. Under 2% means the list was verified and the domain is being accepted. Above 5% is where providers start treating the sender as a list-quality problem, and the campaign should stop while you look at the list. Our own outbound on this infrastructure runs at 1.73% bounce, 461 of 26,698 contacted, and that number comes from verified lists as much as from the DNS.

Reply rate second, and with its qualifier. Across our 11 campaigns it averaged 1.9%, 501 replies from 26,698 contacted, and ranged from 0% to 4.1% campaign by campaign, because reply rate depends on the list and the copy far more than on the sending. About 19% of those replies were positive, which is a share of replies, not of contacted. The full spread is published, including the campaigns that got nothing, because the range is the honest number.

If bounces are fine and replies are zero after 300 sends, the problem is the list or the message, not the domain. If bounces are high, stop and look at the list before you look at anything else. How to tell those apart is the diagnosis method.

What are the legal obligations?

They sit with you, the sender, and they differ by where the recipient is. In the United States CAN-SPAM permits unsolicited commercial email to businesses provided the sender is identified, the subject is not misleading, a working opt-out is offered and honoured, and a postal address is included. In the EU and UK, GDPR and PECR allow business-to-business outreach under legitimate interest when the message is relevant to the recipient's role, you can show why, and objection is easy and respected. Canada's CASL is stricter: implied consent for a conspicuously published business address, relevant to the role, with no statement refusing unsolicited mail. Configuring authentication is not a substitute for a lawful basis to write to someone.

The mistakes that end a first campaign

• Sending from the main domain, and finding out why that was a mistake when the invoices start bouncing.
• Starting cold on day 3 because the domain "looks fine". Reputation is built by accumulation; a fortnight is the floor.
• Trusting the admin panel's green tick for DNS instead of a lookup. A record that resolves to nothing shows no error anywhere.
• Buying a list. High bounces, shared with everyone else who bought it, and prohibited on the inboxes we provide.
• Pushing each mailbox to 20 or 30 a day because the platform cap allows it. Platform caps are not deliverability guidance.
• Rewriting the copy after 40 sends. Judge nothing under 200 contacts.
• Switching warm-up off once the campaign starts. Cold mail is negative pressure; warm-up is what offsets it.