Cold email deliverability: protect your domain

Every outbound team hits the same wall eventually. The first campaign works, so you send more. Then a little more. A few weeks later, replies dry up, open rates slide, and a quick test shows your emails landing in spam. Nothing in the copy changed. What changed is how mailbox providers see your domain.

Domain reputation is slow to build and fast to lose. The good news is that protecting it is not mysterious. It comes down to a handful of technical settings and a set of sending habits you apply every single day, without exceptions. This post walks through both, then shows how Norixia’s EmailGuard turns those habits into rules your AI agents cannot skip.

Start with authentication: SPF, DKIM and DMARC

Before you think about volume, make sure receiving servers can verify that your emails really come from you. Three DNS records do this work.

• SPF lists the servers allowed to send mail for your domain. If you send through Google Workspace and a transactional provider, both need to be in the record.
• DKIM adds a cryptographic signature to every message, so the receiver can confirm it was not altered and was authorized by your domain.
• DMARC tells receivers what to do when SPF or DKIM fail, and where to send reports about it.

A minimal setup for a domain sending through Google Workspace looks like this:

example.com.          TXT  "v=spf1 include:_spf.google.com ~all"
_dmarc.example.com.   TXT  "v=DMARC1; p=none; rua=mailto:[email protected]"

DKIM is generated in your mail provider’s admin console and published as a TXT record under a selector, such as google._domainkey.example.com.

Tip: start DMARC at p=none so you can read the reports without blocking anything. Once you are confident every legitimate sender is aligned, move to p=quarantine, then p=reject.

Many teams also send cold email from a dedicated subdomain or a separate domain, rather than from the one that carries invoices and customer support. If something goes wrong with outbound, your core business email stays clean.

Warm up new mailboxes slowly

A brand new mailbox that sends a hundred emails on day one looks exactly like a spammer. Providers build trust from history, so you need to create some.

The rule is simple: start low and raise the daily cap a little every day. A gentle ramp gives providers time to see real people opening, replying and not complaining. Rushing it is the single most common way teams damage a fresh domain.

Warmup is not a one-time event either. If a mailbox sits idle for weeks, treat it with some care when you start sending again.

Set daily caps and respect them

Even a well-warmed mailbox has limits. Cold outreach is judged more strictly than newsletters or transactional mail, because recipients did not ask for it. Sending a moderate, steady volume per mailbox is far safer than sending big bursts.

A few principles hold up well:

• Cap volume per mailbox, not just per team. Ten mailboxes at a modest volume beat one mailbox doing all the work.
• Cap volume per sender too, so one enthusiastic campaign cannot eat the whole budget.
• If you need more volume, add mailboxes and warm them up. Do not just raise the cap.

Send like a person: windows and spacing

Humans do not send 40 emails in the same minute at 3 a.m. on a Sunday. Your outbound should not either.

Habit	Why it matters
Send during business hours, in the recipient’s working week	Emails arrive when people read them, and traffic patterns look natural
Space sends randomly, minutes apart	Bursts of identical-looking mail are a classic spam signal
Use the right timezone for your audience	A 9 a.m. send in Paris is a 3 a.m. send in New York

Spacing and windows also have a quiet benefit: they spread replies through the day, which makes it easier to answer them quickly.

Never email people who said no

Suppression lists are where good intentions often break down. Someone unsubscribes from one campaign, then gets imported again from a fresh lead list three weeks later. Each repeat contact is a chance for a spam complaint, and complaints hurt far more than unopened emails.

A solid suppression practice includes:

• Unsubscribes, honored immediately and permanently.
• Hard bounces, so you never retry an address that does not exist.
• Complaints, which should end all contact with that person.
• Manual entries, for competitors, existing customers or anyone who asked by reply.
• Domain-level blocks, when a whole company has asked you to stop.

The list has to be checked before every send, by every sender, including when someone replies by hand.

Make unsubscribing easy with List-Unsubscribe

It feels counterintuitive, but making it easy to opt out protects your reputation. A person who cannot find an unsubscribe link reaches for the “Report spam” button instead.

The List-Unsubscribe header lets mail clients show a native unsubscribe option, and its one-click variant lets recipients leave without visiting a page. Gmail and Yahoo now expect bulk senders to support one-click unsubscribe and to keep spam complaint rates low, below 0.3% in their published guidance. Even at modest cold email volumes, it is good practice to follow the same standard.

List-Unsubscribe: <https://example.com/unsubscribe/abc123>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

Handle bounces before they pile up

A high bounce rate tells providers your list is stale or scraped. Keep it low with a few habits:

• Verify or enrich contacts before the first email, especially from older lists.
• Suppress hard bounces automatically after the first failure.
• Watch the bounce rate per mailbox, not just across the team, so one bad list does not hide inside the average.
• When the rate climbs, pause and clean the list before sending more.

Tip: stop follow-ups as soon as a lead replies, even if the reply is an out-of-office. Sending a “just bumping this” to someone who already answered is a fast route to a complaint.

How Norixia’s EmailGuard enforces all of this

Knowing the rules is the easy part. Applying them on every send, across several agents working day and night, is where things slip. That is why Norixia puts a gatekeeper called EmailGuard in front of every email. Before anything leaves a mailbox, EmailGuard checks:

• The suppression list, by email or by domain.
• The lead’s status, so nobody who unsubscribed or already replied gets another message.
• Quotas and warmup, for the mailbox and the agent.
• The send window and spacing, so sends stay inside working hours and never come in bursts.
• Cross-agent dedup, so two agents never contact the same lead.
• Autonomy, so an agent in Validation mode cannot send without your approval.

Manual replies you send from a discussion go through the same checks. There is no side door.

Sensible defaults out of the box

You do not have to configure anything to be protected. Every workspace starts with guardrails that match the habits above:

Guardrail	Default
Emails per mailbox per day	50
Emails per agent per day	30
Spacing between sends	Random, 90 to 300 seconds
Send window	Monday to Friday, 09:00 to 18:00, in your workspace or project timezone
Warmup	Starts at 10 per day, then +5 per day
Workspace daily cap	Optional

Mailboxes connect through Gmail (OAuth) or SMTP/IMAP, and each one has a health panel showing emails sent over 14 days, replies over 30 days, today’s remaining capacity and its bounce rate.

Suppressions and unsubscribes, handled for you

Every email includes a one-click unsubscribe with the List-Unsubscribe header and a public unsubscribe page. Unsubscribes and bounces are added to your suppressions automatically, alongside complaints and any manual entries you add. Suppressions live at the workspace level, so they apply to every project and every agent.

Norixia syncs your inbox every 5 minutes and classifies replies as Interested, Not now, Not interested, Unsubscribe or Out of office. Default follow-ups (bump, value, breakup) stop automatically as soon as a lead replies.

Build your own safety nets

For teams that want more, routines can react to deliverability events. A routine can trigger when an email bounces, for example to create a task to review the list or update the lead’s status. And any routine step can force “Always ask for approval”, even when the agent is on Autopilot, which is a good fit for a new campaign or a new mailbox still in warmup.

Scale steadily, sleep well

Protecting your domain is not about sending less. It is about sending in a way providers trust: authenticated, warmed up, capped, spread out and respectful of every “no”. Do that consistently and volume becomes something you can grow, not something you have to fear.

Norixia’s agents source leads, write personal emails and follow up for you, and EmailGuard makes sure they do it within the rules. You approve. They execute, day and night.

Ready to try it? Create your free account, bring your own API keys, and see how outbound with Norixia works. For the full checklist, from authentication to a 14-day launch plan, read the free Deliverability Playbook for AI Outbound, and pair it with cold email that gets replies.