Cold email lives or dies on infrastructure. Copy and lists matter—but if DNS authentication is wrong, receivers treat you like spam before they read word one. Here are seven mistakes we see constantly on agency and in-house outreach domains.
1. No DMARC record at all
The mistake: SPF and DKIM are set up, but _dmarc.yourdomain.com does not exist.
Why it hurts: Large receivers increasingly expect DMARC. Without it, you have no policy for authentication failures and no aggregate reporting.
Fix: Publish v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com to start, then move toward quarantine or reject.
2. SPF with too many includes
The mistake: One SPF record references Google, Outlook, Instantly, a warm-up tool, and three other include: mechanisms—exceeding the 10 DNS lookup limit.
Why it hurts: SPF returns PermError. Authentication fails entirely.
Fix: Consolidate sends through fewer infrastructure paths or use SPF flattening services. Audit lookup count in the DNS checker.
3. DKIM never published after ESP migration
The mistake: You switched SMTP providers but only updated SPF.
Why it hurts: Messages leave without a valid signature. DMARC alignment breaks.
Fix: Copy the new DKIM TXT record from your ESP dashboard. Verify with your selector in the checker.
4. Sending from a domain with no MX
The mistake: A dedicated “cold” subdomain has SPF for the sequencer but no MX records.
Why it hurts: Looks incomplete to filters. Some tools cannot validate the domain as a real mail entity. Replies may break if routing is unclear.
Fix: Add MX (even if replies go elsewhere via rules) or use a primary domain with proper mail routing.
5. Ignoring blocklist status
The mistake: Scaling volume while the primary MX IP is on Spamhaus or SpamCop.
Why it hurts: Hard bounces and global throttling—not a copy problem.
Fix: Run blacklist scans on every sending domain weekly. Delist before scaling.
6. Letting disposable leads into the pipeline
The mistake: Webinar signups and “personal” trial emails on guerrillamail.com-style domains.
Why it hurts: Bounces, spam complaints from dead addresses, and polluted CRM data.
Fix: Filter signups with the disposable email checker. Block when disposable: true.
7. Never re-auditing after client onboarding
The mistake: Running DNS checks once at setup, then changing ESPs, adding inboxes, or rotating domains without re-scanning.
Why it hurts: Drift is silent. A single DNS edit by a client’s IT team can break authentication.
Fix: Re-run the full DNS audit after any infrastructure change. Export JSON reports for client files.
The 60-second pre-launch audit
Before you 10x volume on a domain, confirm:
- SPF passes with
-allor~all(not+all) - DKIM found for your active selector
- DMARC published with an appropriate policy
- MX records exist and look correct
- Mail IP clean on major DNSBLs
- Lead emails not disposable
FeedPipeline runs all of this free—paste a domain on the homepage or check individual emails on the disposable tool.
Infrastructure is not glamorous. It is the difference between “why did this campaign die?” and predictable inbox placement.