You could have the most compelling cold email offer on the planet, the sharpest subject line, and the most targeted prospect list money can buy, and it still means absolutely nothing if your emails are rotting in a spam folder that nobody reads.
That is the brutal reality most people hitting “send” on their cold outreach never want to face. Getting your cold email deliverability setup right is the single most important thing you can do before launching any outreach campaign, and in this guide we are going to walk you through the exact process we use, step by step, so your messages land in the primary inbox, your domain stays clean, and your outreach actually drives revenue.
Whether you are running campaigns for your own business, managing outreach for clients, or just getting started with AI-powered lead generation, this is the foundational infrastructure you need to have in place before you ever send a single cold email.
We cover everything: buying a fresh domain, connecting it to Cloudflare, configuring your Google Workspace inboxes, adding the four non-negotiable DNS records (MX, SPF, DKIM, and DMARC), verifying your setup with MXToolbox, warming up your inbox correctly, and monitoring your sender reputation over time with Google Postmaster Tools.
Do the work once, and you protect yourself from constant domain bans, wasted leads, and the frustration of campaigns that die for no obvious reason.
Why Cold Email Deliverability Fails (Even With Great Copy)
Here is the thing most people get wrong. They assume that spam problems are a copy problem or a targeting problem. They rewrite the subject line a dozen times. They swap out the call to action. Nothing changes.
The real issue is almost always infrastructure.
When you buy a domain from GoDaddy or Namecheap and try to start sending cold emails without setting up proper authentication records or connecting your domain to a trusted DNS provider, you are essentially asking mail servers to trust a stranger with no ID.
Google, Microsoft, and other inbox providers use SPF, DKIM, and DMARC to verify that you are who you say you are. Without those records configured correctly, your emails get treated as suspicious, and suspicious emails go to spam or get blocked entirely.
The fix is not glamorous, but it is completely within your control. A proper cold email deliverability setup using Google Workspace inboxes routed through Cloudflare, with all four DNS authentication records in place, genuinely outperforms cheap SMTP setups or default registrar configurations.
This is not optional in 2026. It is the bare minimum if you want cold email to work for you.
Step 1: Move Your Domain to Cloudflare DNS
The first thing we do with every new domain is connect it to Cloudflare, regardless of where we bought it. You can purchase your domain from GoDaddy or Namecheap as usual, but you should be managing it from Cloudflare going forward.
In simple terms, Cloudflare acts as a highly trusted intermediary for your domain. It makes your domain faster, safer, and more reliable in the eyes of inbox providers and the broader internet infrastructure.
Registrars like GoDaddy and Namecheap are fine for buying domains, but their native DNS management does not carry the same trust signals that Cloudflare does. When your sending infrastructure is rooted in a reputable platform, that credibility passes through to your cold email campaigns.
Here is how to do it:
Create a free account at cloudflare.com if you do not already have one. You only need one Cloudflare account regardless of how many domains you are managing.
Inside your Cloudflare dashboard, click on Add a Domain and enter your newly purchased domain.
Cloudflare will provide you with two custom nameservers, typically in a format like elsa.ns.cloudflare.com and miles.ns.cloudflare.com.
Go back to your domain registrar, navigate to DNS settings, find the nameserver section, and replace the default nameservers with the two Cloudflare provides.
Click save. Cloudflare will confirm the change, though it can take anywhere from a few minutes to 24 hours to fully propagate.
Once this is complete, you manage all your DNS records inside Cloudflare going forward. Not inside GoDaddy. Not inside Namecheap. All your MX, SPF, DKIM, and DMARC records get added in the Cloudflare DNS panel.
Step 2: Set Up Google Workspace Inboxes (Not GoDaddy Email)
The second decision that separates a professional cold email deliverability setup from an amateur one is where you get your inboxes.
We buy the domain from GoDaddy or a similar registrar, but we never use their bundled email product.
Instead, we sign up for Google Workspace and get our inboxes through Google. Google inboxes simply outperform custom SMTP providers and generic hosting email when it comes to deliverability. Google has spent years building trust with inbox providers around the world.
A Google Workspace inbox, connected to a properly configured domain and warmed up correctly, will achieve deliverability rates that cheaper alternatives rarely match.
Google Workspace inbox target: 100% deliverability rate during warmup
Custom SMTP minimum threshold: 98% before sending any live campaigns
Once your Google Workspace account is set up and you have created your sending email address, you connect those inboxes to your cold email sending tool. We use Smartlead, though tools like Instantly work in exactly the same way. Both have built-in warmup features that we will cover shortly.
Step 3: The Four DNS Records Every Cold Email Deliverability Setup Needs
This is the technical heart of your cold email deliverability setup, and it is where most people either cut corners or get confused.
There are four DNS records you must configure inside your Cloudflare DNS panel before you send a single email. All of them can be added by going to your domain in Cloudflare, clicking DNS, and then Add Record.
MX Records
MX records tell the internet where to deliver email sent to your domain. When you connect your domain to Google Workspace, Google gives you a specific set of MX records to add.
Set the record type to MX
Set the name to @ (which represents the root of your domain)
The primary record (ASPMX.L.GOOGLE.COM) gets priority 1
Secondary records follow at priority 5 and priority 10
When you connect Google Workspace properly, some of these records may be auto-populated, but you should verify all of them manually.
SPF Record
SPF (Sender Policy Framework) tells receiving mail servers which servers are authorised to send email on behalf of your domain. Without it, any server could theoretically send email pretending to be you, and spam filters know this.
Type: TXT
Name: @
Content: v=spf1 include:_spf.google.com ~all
Only add one SPF record. Multiple SPF records will cause authentication failures and damage your deliverability.
DKIM Record
DKIM works like a digital signature on every email you send. It proves the email genuinely came from your domain and was not altered in transit.
To generate your DKIM record:
Go to admin.google.com
Click Apps > Google Workspace > Gmail > Authenticate email (DKIM)
Click Generate New Record
Copy the long TXT value Google provides
Go back to Cloudflare and add a new TXT record with the name Google specifies (typically google._domainkey.yourdomain.com)
Paste the TXT value into the content field, leave TTL on auto, and save
Return to Google Admin and click Start Authentication
This record alone can have a significant impact on whether your emails pass Gmail’s filters.
DMARC Record
DMARC ties SPF and DKIM together and tells receiving servers what to do if an email fails authentication. It also gives you reporting visibility on emails sent using your domain.
Type: TXT
Name: _dmarc*
Content: v=DMARC1; p=none; rua=mailto:[email protected]
Important: Start with p=none during your warmup period. After 14 to 21 days, once your inbox is warmed up, update the policy to quarantine. This is a significantly better long-term setup than leaving it on none permanently.
One common mistake to avoid: when you onboard a domain previously registered with GoDaddy, you may find a default DMARC record already sitting there. If you add a second one without deleting the first, you will end up with duplicate DMARC records, which causes authentication failures. Delete any pre-existing DMARC records before adding your own.
Step 4: Verify Everything With MXToolbox Before You Send
Once all four records are in place, do not just assume they are working.
DNS propagation can take anywhere from a few minutes to several hours. In some cases, we have had to wait up to six hours for an SPF record to fully propagate. Give things time to settle, then come back and verify.
The tool we use for this is MXToolbox, available at mxtoolbox.com. It is free and gives you a comprehensive health check on your domain’s email configuration.
Here is what to check:
MX Lookup: Confirm all your MX records are present and pointing to Google’s mail servers with the correct priority values
SPF Check: Confirm your record is valid and returning a proper result for Google
DMARC Lookup: Confirm your DMARC record is present and correctly formatted. A “DMARC policy not enabled” warning is expected while your policy is still p=none and will clear once you update to quarantine
Blacklist Check: Run a blacklist check on your new domain. You may see a single flag from a provider that flags AWS, Cloudflare, or GoDaddy infrastructure. This is normal and you can safely ignore it. These warnings apply to shared infrastructure, not your specific domain. What you do want to confirm is that there are no other blacklist flags beyond those
If your domain is properly blacklisted, it is almost always faster to buy a new domain than to fight to get off a list. Do not try to fix a blacklisted domain. Move on and move fast.
Fix any issues MXToolbox surfaces before you move on. This step is non-negotiable and takes less than five minutes.
Step 5: Warm Up Your Inbox for at Least 14 Days
Once your DNS records are verified, your Google Workspace inbox is connected, and you have linked everything to your cold email tool, you do not start sending live campaigns. Not yet. You warm up first.
Inbox warmup is the process of gradually building sender reputation before you unleash full outreach volume on a brand new domain. Both Smartlead and Instantly have built-in warmup features that handle this automatically, sending low-volume emails to a network of real inboxes that reply positively.
Think of it as building a credit score before applying for a mortgage.
The specifics to get right:
Minimum warmup period: 14 days. Do not send live campaigns before this is complete, even if your stats look good
Deliverability threshold: Your rate should be at or above 98% during warmup. If you are running Google Workspace inboxes specifically, you should be hitting 100%. If your rate drops below 98%, pause and investigate
Keep warmup running: Even after you start sending live campaigns, keep the warmup feature active. This maintains your sender reputation rather than letting it decay
Volume scaling: Start with around 10 to 20 emails per day per inbox in the first week. Jumping straight to 50 or 100 emails per day on a fresh domain is one of the most reliable ways to trigger spam filters and ruin a domain before it gets started
Step 6: Connect and Monitor With Google Postmaster Tools
After warmup is complete and you start sending campaigns, the job is not finished. You need to monitor what happens to your emails in the wild, and the best free tool for this is Google Postmaster Tools.
Google Postmaster gives you a live dashboard showing exactly how Gmail is treating your sending domain. You can monitor:
Domain Reputation: High (green) = your emails are being treated as legitimate. Low (red) = you are heading toward the spam folder
IP Reputation: Shows how the IP addresses your emails are sent from are performing
Spam Rate: The percentage of your emails that Gmail recipients are marking as spam. Keep this well below 0.1%. Google’s own guidelines suggest that crossing 0.3% will start impacting deliverability seriously
Delivery Errors: Any authentication or routing failures preventing emails from being delivered
To set it up:
Go to postmaster.google.com and click Get Started
Add your domain
Google will ask you to verify it by adding a TXT record to your DNS
Go to Cloudflare, add the TXT record Google provides (type: TXT, name: @, content: the string Google gives you), then save
Return to Postmaster and click Verify. It usually confirms within a few minutes
One important note: if you check Postmaster immediately after setup, you will likely see no data. Google needs to receive a meaningful volume of emails from your domain before the graphs populate. Give it a few days after your first campaigns go out, then check back.
You can use a single Postmaster account for all the domains you manage, which keeps monitoring centralised and manageable.
Cold Email Deliverability Checklist: Verify Your Setup Before You Send
Before you ever send a live campaign, run through this checklist every time you onboard a new domain:
Domain nameservers pointing to Cloudflare (not GoDaddy or Namecheap defaults)
Google Workspace inboxes created and connected to your domain
MX records added in Cloudflare DNS with correct Google mail server values and priority levels
SPF TXT record added (v=spf1 include:_spf.google.com ~all), only one record present
DKIM TXT record generated in Google Admin and added to Cloudflare DNS
DMARC TXT record added (_dmarc), policy set to p=none during warmup
MXToolbox MX Lookup passing
MXToolbox SPF check passing
MXToolbox DMARC check confirming one record present (not two)
Blacklist check clean (ignoring shared infrastructure flags from AWS/GoDaddy/Cloudflare)
Inbox connected to Smartlead or Instantly with warmup enabled
Warmup running for a minimum of 14 days before live campaigns start
Deliverability rate above 98% (100% for Google inboxes) before sending
Google Postmaster domain added and TXT verification record in place
This process takes time the first time. Once you have done it across two or three domains, it becomes quick, repeatable work. And if you set this up correctly from the beginning, you will avoid the painful cycle of burning domains, buying replacements, and starting over every few weeks — which is exactly what happens to people who skip these steps.
Common Cold Email Deliverability Mistakes (And How to Avoid Them)
Even with a solid setup, there are a handful of mistakes we see people make repeatedly that tank deliverability weeks or months into campaigns.
Not updating DMARC policy after warmup. Leaving your DMARC policy at p=none indefinitely is better than having no DMARC record, but it is far from optimal. After 14 to 21 days, update to p=quarantine. This tells mail servers you are serious about protecting your domain’s identity.
Sending too many emails too fast. New domains and new inboxes need to be eased in gently. Even after warmup, start conservatively. A sensible ceiling is 30 to 50 cold emails per inbox per day for the first few weeks of live sending. Scale from there based on what your Postmaster stats tell you.
Ignoring spam rate creep. If your Google Postmaster spam rate starts climbing, something is wrong. Do not wait until you are blacklisted to act. Investigate as soon as you see the rate moving above 0.08%.
Using one domain for everything. Never use your primary business domain to send cold email. Buy dedicated sending domains specifically for outreach. If one gets damaged, your main brand is untouched. For help thinking through profitable niches and client targeting strategies for your AI agency, take a look at our guide on how to find your vertical and identify profitable niches.
Skipping the blacklist check on new domains. Some domains arrive pre-blacklisted, particularly those previously owned by someone who abused them. Always run a blacklist check via MXToolbox before you invest time warming up a domain. If you find meaningful blacklist entries beyond the shared infrastructure flags, discard the domain and buy a new one.
How This Technical Setup Connects Directly to Revenue
It is easy to treat this as a boring technical exercise that exists separately from making money. It is not.
The reason we built this process out so carefully is because our core offer, database reactivation with AI and SMS, only works at scale if the cold email that opens the door actually gets seen.
The offer itself is what Dan calls the “offer of the century” for a reason. Businesses sit on enormous databases of old leads they never had time to follow up. We take their CSV or Excel file, load it into our system, send a simple two-line SMS, and let AI handle the conversation, booking appointments and making sales on autopilot. Clients love it because it performs on a results basis and requires almost nothing from them.
But to land those clients in the first place, we need our cold email to reach their primary inbox, not disappear into spam.
When you combine this kind of performance-based AI offer with properly configured cold email infrastructure, AI-enriched personalisation, and a tool like Smartlead running the sequences, you have a system that genuinely compounds. Great offer plus great deliverability equals a pipeline that grows every week.
If you want to see exactly how we package and sell this kind of AI agency service, The Instant AI Agency walks you through the full model.
For more on how database reactivation works in practice and why it is one of the most compelling offers you can take to any business right now, you can read our post on transforming old leads into sales with the any-niche AI bot and our breakdown on AI-powered database reactivation for re-engaging life insurance leads, both of which show this model working across different verticals.
Building an AI Agency That Scales With Cold Email
If you are reading this because you want to build a business around AI, not just learn email configurations, the infrastructure in this guide is the enabler, not the end goal.
The people making serious money right now are the ones combining great outreach infrastructure with irresistible offers and AI tools that do the heavy lifting. Cold email gets you in the room. What you offer once you are there determines whether you build a real business or just stay busy.
The database reactivation model sits at the intersection of everything that is working in 2026. Businesses have dormant lead lists. AI can work those lists at scale, day and night, without you being in the loop. You charge on performance. Everyone wins.
If you want to see that model fully assembled and ready to launch, The Instant AI Agency is the fastest path from understanding it to actually running it.
For a broader view of what makes lead generation genuinely effective beyond deliverability alone, it is also worth revisiting our post on what’s really important in lead generation and our guide on effective cold prospecting tips that work, which cover the messaging and targeting side of the equation in depth.
Conclusion
Cold email deliverability is not a mystery and it is not out of your control. It is a set of specific, repeatable steps.
Move your domain to Cloudflare. Set up Google Workspace inboxes. Configure your MX, SPF, DKIM, and DMARC records correctly. Verify everything with MXToolbox. Warm up for at least 14 days with a 98% or better deliverability rate. Monitor your sender reputation continuously with Google Postmaster Tools.
Do all of that, and your cold emails will land where they need to land, in front of real people who can say yes to your offer.
The technical setup we have walked through in this post is the same process our team uses every time we onboard a new sending domain. It takes more effort upfront than simply hitting send from a GoDaddy email account, but it completely eliminates the frustrating cycle of domain burns, blacklists, and mysteriously dying campaigns that most cold emailers face within their first few months.
Once this infrastructure is in place, it works quietly in the background while you focus on building offers, writing copy, and closing clients.
Now we want to hear from you.
Where are you in your AI journey right now?
