Cold Email Setup (2026): dig + nslookup Verification

Most cold email setup guides stop at “configure SPF, DKIM, and DMARC, then warm up your domain.” That’s where the work begins, not where it ends. The reason 60%+ of cold email lands in spam isn’t that the records aren’t present. It’s that nobody verified them.

This piece walks through cold email setup as an end-to-end verification checklist. Every stage has a pass criterion you can run yourself with two terminal commands: dig and nslookup. No vendor dashboards. No ESP control-panel screenshots. Just the actual output that Gmail, Outlook, and Yahoo read when they decide whether your email belongs in the inbox or the spam folder.

If you can’t run dig +short TXT _dmarc.yourdomain.com and read what comes back, your setup is fragile. That’s the standard this guide holds to. Configuration takes two to three hours. Verification takes a few minutes per gate. The warmup window adds two to four weeks of patience. Skip any of those phases and your reply rates collapse the moment volume scales.

Why Cold Email Setup Usually Fails: The Verification Gap

Most setup failures aren’t configuration failures. They’re verification failures. A team configures SPF, DKIM, and DMARC in their ESP’s control panel. The panel shows green checkmarks. The team moves on. Six weeks later, reply rates have collapsed, and nobody can explain why.

The gap is that ESP control panels report what the panel thinks happened, not what propagated to public DNS. Misconfigured include: directives in SPF, DKIM keys that didn’t propagate because the parent zone’s TTL hadn’t expired, DMARC records pointing to a reporting address with a typo. These are silent failures. The panel reports success. The records are broken.

Verification with terminal commands closes the gap. Whatever public DNS returns when Google or Microsoft queries your records is what those providers see. If dig shows it, the inbox provider sees it. If dig doesn’t, the panel lied — even if your warmup tool reports 100% inbox placement to its own dashboard. Cold email is the demand side of the outbound stack, and every reply is a self-qualified prospect raising their hand before retargeting picks them up. That demand only converts if the email lands in front of the prospect. Verification is what determines that.

The 7-Stage Cold Email Setup Checklist

Cold email setup is seven sequential verification gates. Each gate has a single pass criterion. Skip a gate and the downstream gates can’t be trusted, because each stage assumes the previous one passed. The seven gates verify what ESP panels can’t: public DNS state, sender reputation at the receiving providers, and inbox-provider trust earned during warmup.

1. Buy a separate sending domain. Cost: $10-15/year.
2. Configure SPF and verify with dig. Pass: record returns, no permerror, ≤10 DNS lookups per RFC 7208.
3. Configure DKIM and verify with dig. Pass: public key present at selector subdomain.
4. Configure DMARC and verify with dig. Pass: record returns starting at p=none, aggregate reports flowing to the rua= address.
5. Sanity-check MX records with nslookup. Pass: records point to the ESP you actually configured.
6. Run the domain warmup window. Duration: 14-30 days. Pass: Google Postmaster Tools shows Domain Reputation at Medium or High.
7. Run an end-to-end deliverability test. Pass: Mail-Tester score 8.5+, primary-inbox placement above 80%.

Stage 1: Buy a Separate Sending Domain

A dedicated sending domain is a lookalike of your primary domain that exists exclusively for outbound email. The standard patterns: company.com becomes companygroup.com, joincompany.com, or hireatcompany.com. The cost is $10-15 per year at Cloudflare Registrar or Porkbun.

The reason for separation is reputation insurance. A deliverability incident on the dedicated domain only hurts the dedicated domain. The transactional domain that carries your invoices, recovery letters, and customer notifications stays clean. The cost of skipping this step is that one bad cold campaign can silently route every invoice you send for the next six months into spam folders across your customer base. That same clean primary domain is where the marketing email that stays on your primary domain lives, the opt-in newsletters and nurture sends, so protecting it is as much about your marketing program as your invoices.

Beyond the registrar, the only Stage 1 verification is that the WHOIS record propagates and the domain resolves. Run dig +short A yourdomain.com after pointing nameservers. If anything returns, you have a live domain to build the next stages on. Whether you’re sending through Instantly, Lemlist, or Smartlead, the tool you send through inherits this trust. None of them can compensate for a domain Google has flagged for low reputation. Pick the tool after the domain is live, not before.

If you’re evaluating cold email vendors who promise to handle setup for you, ask for proof of the deliverability work that agencies often quietly skip. Postmaster Tools dashboard exports and DMARC aggregate reports from the last 30 days are the only honest evidence a vendor can show. Anything less and you’re paying for a black box.

Stage 2: Configure SPF and Verify with dig

SPF (Sender Policy Framework, defined in RFC 7208) is the DNS record that tells receiving mail servers which IP addresses are authorized to send email from your domain. It lives at the root of your domain as a TXT record.

The record format your ESP gives you looks roughly like:

v=spf1 include:_spf.google.com include:sendgrid.net ~all

Publish that TXT record at the root. Wait for TTL to expire (5-15 minutes for most providers). Then verify:

dig +short TXT yourdomain.com | grep spf

The output should be the string you published, quoted. If nothing returns, the record didn’t propagate or your DNS provider rejected the syntax. If multiple SPF records return, you have a serious problem. RFC 7208 allows exactly one SPF record per domain; multiple records cause a permerror and most receivers will fail-soft on all of them.

The Common Failures section below covers the most frequent SPF mistakes (too many lookups, missing include: directive, wrong ~all versus -all policy choice). For now: if the record returns and contains the expected include: directives, the gate passes.

Stage 3: Configure DKIM and Verify with dig

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every outgoing email. The receiver fetches your public key from DNS, decodes the signature, and confirms the message wasn’t modified in transit. DKIM is the strongest signal you can send that the email genuinely originated from your domain.

Generate the DKIM key in your ESP’s deliverability settings. You’ll get two values: a selector name (something like s1, google, k1, or mta1) and a long public key string starting with v=DKIM1;. Publish the public key as a TXT record at the selector subdomain.

So if your selector is s1 and your domain is yourdomain.com, the record lives at s1._domainkey.yourdomain.com.

Verify:

dig +short TXT s1._domainkey.yourdomain.com

The output should be the public key, quoted and possibly broken into multiple strings concatenated. If dig returns nothing, the key didn’t propagate (wait another 15 minutes) or you published it at the wrong selector subdomain. The most common Stage 3 mistake is publishing the key at _domainkey.yourdomain.com instead of [selector]._domainkey.yourdomain.com.

Stage 4: Configure DMARC and Verify with dig

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is the policy layer that sits on top of SPF and DKIM. It tells receiving mail servers what to do when a message fails authentication, and it gives you aggregate reports on which senders are passing or failing checks on your behalf.

The DMARC record lives at _dmarc.yourdomain.com and looks like:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com; pct=100; aspf=r; adkim=r

Verify with:

dig +short TXT _dmarc.yourdomain.com

Pass criterion: the record returns, starts with v=DMARC1, has a valid p= policy, and has a rua= aggregate-reporting address that actually exists. If rua= points to an inbox no one monitors, you’re flying blind. Set up a dedicated mailbox or use a DMARC parser like Postmark’s free DMARC Digests or dmarcian’s free tier.

DMARC Policy Progression: p=none → p=quarantine → p=reject

The DMARC policy field has three values. Each one tells receivers to take a more aggressive action on messages that fail SPF and DKIM. Most senders publish p=reject on day one because a tutorial told them to. That breaks legitimate email and nobody finds out until customers stop replying. The right approach is a measured five-step escalation:

1. Start at p=none. Receivers don’t act on failures, but they do send you aggregate reports. Your traffic flows normally while you learn who’s authenticating on your behalf and who isn’t.
2. Watch aggregate reports for 4-6 weeks. Confirm that 95%+ of legitimate traffic passes both SPF and DKIM alignment. Identify any third-party senders (your CRM, your transactional service, your booking tool) that need to be added to SPF or have DKIM signing enabled.
3. Escalate to p=quarantine. Failing messages now route to spam instead of the primary inbox. Watch Postmaster Tools for any drop in legitimate domain reputation.
4. Verify legitimate traffic survives quarantine. Internal email, partner email, automated notifications: confirm each one still lands. If reputation drops, roll back to p=none and find the gap.
5. Escalate to p=reject. Failing messages now bounce. This is the final state. You’re protected against spoofing of your domain, and your authenticated mail enjoys the strongest deliverability signal available.

Each step has a measurable pass criterion. Don’t escalate without it. The five-step path takes 2-3 months of patience and is the verification step no other setup guide includes. If you would rather watch enforcement progress on a dashboard than track it by hand, the SaaS platforms that automate the DNS verification this guide does by hand monitor exactly this escalation for you.

Stage 5: Sanity-Check MX Records with nslookup

MX (Mail Exchanger) records tell other mail servers where to deliver email to your domain. Even for an outbound-only cold email domain, MX matters because bounces, replies, and out-of-office messages route through your MX. Misconfigured MX means you never see the reply that would have closed the deal. That domain is outbound-only on purpose, and the reasoning behind keeping cold outreach on a dedicated domain rather than your primary is what stops one misfired campaign from taking your real mailflow down with it.

Verify:

nslookup -type=mx yourdomain.com

The output lists each MX record with a priority number and a server hostname. Confirm the hostnames point to the ESP you’re using. For Google Workspace, you’ll see aspmx.l.google.com, alt1.aspmx.l.google.com, and so on. For Microsoft 365, yourdomain-com.mail.protection.outlook.com. If you see hostnames from a provider you no longer use, your replies are routing to a defunct inbox. Update MX records and watch Stage 7’s inbox-placement test improve immediately.

Stage 6: Run the Domain Warmup Window

A new sending domain has no reputation history. Gmail, Outlook, and Yahoo treat new domains with suspicion by default. Warmup is the process of building reputation gradually by sending a small volume of high-engagement email until providers learn your domain is legitimate. That warmup engine usually lives inside the sending platform itself, so the cold email software that runs on top of this setup determines how fast the reputation actually builds and how well it holds once you scale.

The warmup volume schedule that consistently survives the major inbox providers’ rate-shaping:

• Days 1-3: 20-30 emails per day, sent to engaged contacts who will open and reply.
• Days 4-7: Ramp to 50 emails per day.
• Days 8-14: Ramp to 100 emails per day.
• Days 15-21: Ramp to 200 emails per day.
• Day 22+: Match your target sending volume, but no more than 2× the previous week’s peak.

Postmark’s research on domain warmup recommends 3-6 weeks for managed warmup to reach dependable full-volume deliverability, with engagement signals (open rates above 20%, bounce rates under 2%) used as the gate for ramping volume rather than calendar time alone. The Postmark warmup guide goes into the engagement-weighted ramp logic in detail. Warmup follows the same discipline of slow, signal-respecting outreach that works for cold outreach in any channel. Ramp the volume the recipient’s inbox provider expects, not the volume your campaign target demands.

Most cold email tools (Instantly, Smartlead, Lemwarm, Mailwarm) automate warmup by sending and replying to fake-but-coordinated email between participating accounts. This is better than nothing, but the engagement signals are synthetic. Real warmup mixes automated tool traffic with manually-sent emails to real contacts who actually reply.

Stage 7: Run an End-to-End Deliverability Test

Before launching the first real campaign, send a test email through your actual sending stack to a deliverability-test address. Mail-Tester is the standard free option: it grades your email on a 10-point scale based on authentication, content, formatting, blacklist presence, and DNS configuration. Passing that test only clears the infrastructure; the follow-up cadence and stop rules that run after the test passes decide whether the live campaign earns replies without turning healthy delivery into recipient complaints.

Pass criterion: score 8.5 or higher. Below 8.5 and something’s broken. The Mail-Tester report tells you exactly what.

Mail-Tester catches authentication issues but doesn’t show inbox placement. For that, run a separate test with a service like GlockApps, MailReach Inbox Tester, or a manual seed-list test: send the same email to fresh accounts at Gmail, Outlook, Yahoo, and AOL, then check which folder each one lands in. Primary inbox above 80% is the threshold for a healthy production sender.

How to Read Your dig Output Line-by-Line

The output of dig +short TXT _dmarc.yourdomain.com looks compact and unhelpful at first. Once you can parse it, you can debug almost any DNS-level deliverability issue in under a minute. Here’s a real example output and what every segment means.

For SPF, a typical dig +short TXT yourdomain.com | grep spf returns:

"v=spf1 include:_spf.google.com include:mail.zendesk.com ~all"

The v=spf1 declares the record version. Always 1; SPF has never had a v2. The include: mechanisms each delegate authorization to another domain’s SPF record (Google’s, Zendesk’s). Each one counts as a DNS lookup. The trailing ~all is the policy: soft-fail on unauthorized senders. -all would be hard-fail (more aggressive, more likely to break legitimate senders during the early warmup window).

For DKIM, dig +short TXT s1._domainkey.yourdomain.com returns:

"v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4G..."

The v=DKIM1 is the version. k=rsa is the key algorithm. p= is the public key, base64-encoded. If p= is empty or missing, the key has been revoked or never published correctly.

For DMARC, dig +short TXT _dmarc.yourdomain.com returns:

"v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; pct=100; aspf=r; adkim=r"

The p= is the policy (none, quarantine, or reject). The rua= is the aggregate-report address. The pct=100 applies the policy to 100% of failing messages (you can ramp this from 25% during quarantine escalation). The aspf=r and adkim=r are the alignment modes: r for relaxed, s for strict. Relaxed allows subdomain alignment; strict requires exact-match.

Common Cold Email Setup Failures (and How to Fix Them)

These six failures account for roughly 80% of all cold email deliverability problems we see flagged in deliverability audits. Each has a diagnostic command and a fix. Each diagnostic surfaces the broken record in under a minute and each fix takes 5-15 minutes. Run them in the order below to avoid cascade re-breakage.

1. SPF exceeds 10 DNS lookups (permerror). Diagnostic: paste your SPF record into MxToolbox’s SPF lookup tool and read the lookup count. Fix: consolidate ESP include: directives, drop unused services, or use an SPF flattening service that resolves all include: mechanisms into a single static record.

2. DKIM published at the wrong selector subdomain. Diagnostic: dig +short TXT [selector]._domainkey.yourdomain.com returns nothing, but dig +short TXT _domainkey.yourdomain.com returns the key. Fix: re-publish the TXT record at the correct selector subdomain. Some DNS providers strip the selector when you paste in a “TXT record” without specifying the subdomain prefix.

3. DMARC p=reject from day one. Diagnostic: aggregate reports show high failure rates on legitimate senders (your CRM, your booking tool, your invoicing platform). Fix: roll back to p=none, watch reports for 4-6 weeks, identify and fix the failing senders, then escalate progressively.

4. Sub-domain DMARC alignment broken. Diagnostic: aggregate reports show failures on email sent from mail.yourdomain.com when DMARC is published at the root with aspf=s (strict alignment). Fix: switch to aspf=r (relaxed) or publish a separate DMARC record at the subdomain.

5. Sending volume jumped too fast post-warmup. Diagnostic: Postmaster Tools shows Domain Reputation dropping from Medium/High to Low within a week of scaling. Fix: cut volume back to 50% of the previous week’s average and ramp more gradually. Domain reputation recovers in 2-3 weeks if engagement signals stay healthy.

6. MX records still pointing to a previous provider. Diagnostic: nslookup -type=mx yourdomain.com returns hostnames that don’t match your current ESP. Fix: update MX records in your DNS provider, wait for TTL to expire (often 1-24 hours), re-test. Stale MX records silently route replies and bounces away from you.

When to Escalate to Google Postmaster Tools and Microsoft SNDS

Google Postmaster Tools and Microsoft SNDS are the two free dashboards that show you what those providers think of your sending domain. Both are free. Most cold senders never register either one, which means most cold senders are flying blind.

Google Postmaster Tools shows Domain Reputation (High / Medium / Low / Bad), IP Reputation, Authentication results, Encryption rates, Spam Rate, and Delivery Errors. Register on day 1 of warmup. Verify domain ownership via TXT record. Reputation data starts accumulating within 24-48 hours. According to Google’s email sender guidelines, bulk senders must keep Spam Rate below 0.30% (warning threshold) and ideally under 0.10% (target threshold).

Microsoft SNDS (Smart Network Data Services) gives the same signal for Outlook, Hotmail, and Live.com inboxes. SNDS is IP-based rather than domain-based, so it’s most useful when you’re sending from a static IP (dedicated ESP plans, self-hosted mail server). Filter Result categories: Green (Good), Yellow (Warning), Red (Blocked). Yellow means something’s degrading. Red means delivery to Outlook addresses has stopped.

Escalation rule of thumb: if Postmaster Tools shows Spam Rate above 0.10% for three consecutive days, pause new campaigns, audit list quality, and check that warmup-tool engagement is real (not synthetic). If SNDS turns Yellow, stop sending to Outlook addresses until the filter result returns to Green.

What Comes After Setup

Setup is one-time work. The recurring leverage points after setup are list quality, subject lines, copy, and reply handling. Once the seven gates pass, you stop iterating on infrastructure and start iterating on the message. Deliverability is one-time verification you re-run quarterly; message work is the recurring craft that compounds reply rates over months.

Once the DNS chain validates and your warmup window closes clean, the next leverage is the subject line — the subject line is where deliverability buys you a click or wastes one. A perfectly-configured sender stack with a bad subject line still gets 1.5% open rates. A correctly-tuned subject line on top of verified DNS gets 35-50%.

Re-verify the entire 7-stage checklist every quarter. DNS records drift. ESP changes ripple through SPF. New transactional services creep in and break alignment. Quarterly verification keeps the stack honest.

Is cold email legal? B2B email rules by region (2026)

Cold B2B email is broadly permitted in the US, conditional in the UK and Australia, and consent-first (and riskier) in Canada and much of the EU. The rules below govern marketing email to business contacts. Confirm the current statute for the market you send into before you press send.

Bottom line: build your list and sending posture around the strictest market you actually email into. This is a summary for marketers, not legal advice, so verify the current statute before a campaign. Last reviewed: June 2026.

Frequently Asked Questions