Cold Email Deliverability: Building B2B Outreach Infrastructure

Field notes · 12 min read

Most cold outreach fails at the network layer, not the copy. A well written pitch to a Fortune 500 buyer does nothing if the sending IP is on Spamhaus, the domain has no DMARC record, or the mail server is one of ten thousand tenants on a shared relay. This is a working guide to building cold email infrastructure that keeps landing in the inbox six months in — the same pattern used in the B2B agency case study on the home page.

Inbox placement is a systems problem. Volume, authentication, engagement, and reputation are all inputs. Treat one in isolation and the other three punish you.

Prerequisites

  • A domain you own outright, ideally 30+ days old.
  • At least one secondary domain for sending (never send cold from your primary corporate domain).
  • Control over DNS at the zone level (Cloudflare, Route 53, or self-hosted BIND).
  • A Linux host or Kubernetes cluster with outbound port 25 unblocked by the provider.

1. Domain and subdomain strategy

Register one or more sending domains that pattern-match your brand (getacme.io, try-acme.com). Send cold mail from a dedicated subdomain such as outreach.getacme.io. Keep transactional and marketing streams on separate subdomains so a cold-outreach incident cannot pull down password resets or invoices.

2. Authentication: SPF, DKIM, DMARC

Every sending domain needs three DNS records, published before the first send:

; SPF — authorize the sender
outreach.getacme.io.  TXT  "v=spf1 ip4:203.0.113.10 -all"

; DKIM — 2048-bit key, one selector per sending service
sel1._domainkey.outreach.getacme.io.  TXT  "v=DKIM1; k=rsa; p=MIIBIjA..."

; DMARC — start at monitor, move to quarantine, then reject
_dmarc.outreach.getacme.io.  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@getacme.io; adkim=s; aspf=s"

Enforce strict alignment (adkim=s; aspf=s) from day one. Ship p=none for two weeks while you read aggregate reports, then move to quarantine, then reject. Add MTA-STS and TLS-RPT once the basics are clean — Google and Yahoo now weigh them.

3. Dedicated IPs and PTR records

Shared IPs are the fastest way to inherit someone else’s reputation problem. For sustained cold outreach, lease dedicated IPs and lock the following:

  • Forward and reverse DNS must match: mta01.outreach.getacme.io ↔ 203.0.113.10.
  • HELO/EHLO identity matches the PTR, not the envelope domain.
  • One brand per IP. Never mix clients on the same IP.
  • Check the IP against Spamhaus ZEN, SORBS, and Barracuda BEFORE the first send.

4. Egress firewalls on the sender pods

A cold sender that can talk to arbitrary destinations is a liability. On Kubernetes, apply a NetworkPolicy that only allows egress to port 25, port 587, and your log sink. On bare metal, use nftables:

table inet egress {
  chain output {
    type filter hook output priority 0; policy drop;

    ct state established,related accept
    oifname "lo" accept

    # SMTP submission only
    tcp dport { 25, 587 } accept

    # DNS + NTP
    udp dport { 53, 123 } accept
    tcp dport 53 accept

    # Log sink (Loki)
    ip daddr 10.20.0.0/24 tcp dport 3100 accept
  }
}

This stops a compromised worker from beaconing, exfiltrating lists, or being turned into a proxy. It is table stakes for any sender that touches production reputation.

5. Warmup: the first 45 days

A new IP with no history looks identical to a spammer’s burner. Warm it the way a real business grows a list:

  1. Days 1–3: 20–50 messages/day to seed inboxes and known-good addresses.
  2. Days 4–10: double daily volume every other day, capping at ~500/day.
  3. Days 11–30: ramp to target volume in ~15% daily increments, gated on complaint rate below 0.1%.
  4. Days 31–45: hold volume, prune bounces daily, keep engagement above 20%.

If Google Postmaster shows domain reputation dropping from High to Medium, stop the ramp for 48 hours. Never ignore the signal.

6. List hygiene and validation

  • Verify every address with a syntactic check, MX lookup, and SMTP RCPT probe before it enters the send queue.
  • Drop role addresses (info@, sales@) from cold sequences.
  • Suppress on any 5xx bounce for 90 days minimum; permanent for hard bounces.
  • Honor unsubscribes at the SMTP layer, not just the app. RFC 8058 one-click headers are now required by Gmail bulk senders.

7. Observability

You cannot fix what you cannot see. At minimum, dashboard these metrics per IP and per domain:

  • Deferral rate by ISP (Gmail, Outlook, Yahoo, corporate).
  • Bounce class breakdown (hard, soft, policy, reputation).
  • Complaint rate from ARF feedback loops.
  • DMARC aggregate pass rate per source IP.
  • Google Postmaster domain and IP reputation, scraped daily.

8. What actually kills cold campaigns

The most common failure modes seen in audits:

  • Sending from the primary corporate domain without a dedicated cold subdomain.
  • DMARC published at p=none forever and never enforced.
  • Reusing a DKIM key across five sending tools with no rotation.
  • No egress firewall — the sender pod is also allowed to talk to Slack, S3, and the open internet.
  • Ramping past 1,000/day in week one because the campaign tool said it was fine.

Wrap

Cold email deliverability is not a growth hack. It is infrastructure work — the same discipline as running a payments gateway or an authentication service. Get the layers right in the order above and the inbox rate stops being a mystery.

Need this built or audited? Get in touch.