TL;DR: Cold email domain infrastructure means dedicated sending subdomains plus four DNS records: SPF, DKIM, DMARC, and BIMI. For sales, growth, and RevOps teams running cold outbound, skipping this step is the most common cause of mail landing in spam. Get it right and bounce rates typically fall 3-6x versus unmanaged sending, per Unify deliverability data.

Proper cold email domain infrastructure means four things: sending only from dedicated subdomains, never your primary domain; publishing correct SPF, DKIM, DMARC, and optionally BIMI records on each subdomain; warming every new mailbox for 3-4 weeks before full-volume sends; and monitoring reputation continuously with Google Postmaster Tools and Microsoft SNDS.

Most sales teams treat domain setup as an afterthought. They pick a sequencing tool, connect a company inbox, and wonder why reply rates are flat. The problem usually is not the copy.

Inbox providers evaluate a sending domain's authentication and reputation before a single word of the message gets read. Misconfigured DNS gets messages silently filtered, no matter how well-targeted the outreach is.

This guide covers every layer of cold email domain infrastructure: copy-paste DNS records for Google Workspace and Microsoft 365, a current warm-up schedule, and a monitoring stack, all current as of July 2026. If you are also working on sequence strategy, see our guide on cold email best practices and the SDR research-to-send workflow. The domain foundation covered here is what makes that work actually reach inboxes.

Key Facts: Cold Email Domain Infrastructure at a Glance

The table below centralizes every quantitative claim in this guide, with its exact source and date, so you do not have to hunt through the article for numbers.

Methodology and Limitations

Data sources and window: Official sender documentation from Google, Microsoft, and Yahoo, all verified live in July 2026. The EasyDMARC 2026 DMARC Adoption Report (published March 30, 2026, based on roughly 1.8 million domains). Named Unify customer case studies and Unify's own Deliverability product page (customer data window 2025-2026).

What this guide does not cover: ISP-specific spam filter internals beyond Google, Microsoft, and Yahoo; dedicated IP warm-up for high-volume marketing sends (this guide is about mailbox-level warm-up for cold outbound); and ESP-specific transactional mail rules, which follow different rules than bulk cold outreach.

Where to dial this down: Regulated industries and EU/GDPR markets have consent requirements on top of the authentication rules here; a clean SPF/DKIM/DMARC setup does not make an unsolicited list legal to email in an opt-in jurisdiction. Brand-new domains under 30 days old should warm more conservatively than the schedule below.

Why Should You Never Send Cold Outbound From Your Primary Domain?

Cold email from your primary company domain puts your entire organization's email reputation at risk. Cold outbound by design generates higher bounce rates, occasional spam complaints, and unsubscribe signals. Those signals are normal for cold outreach.

But when they accumulate against yourcompany.com, they degrade deliverability for every other email that domain sends: product notifications, invoices, customer support responses, and executive correspondence. Microsoft's own DKIM documentation makes this explicit, recommending a subdomain for any email service not under your direct control specifically to prevent issues from affecting the reputation of mail sent by users in your main email domain.

A dedicated sending subdomain like outreach.yourcompany.com or send.yourcompany.com keeps those reputation signals isolated. If a subdomain gets flagged or blacklisted, you retire it and spin up a replacement. The primary domain stays clean.

The practical rule: register 3-5 sending subdomains per active outbound program. Run 2-3 mailboxes per subdomain, capping sends at 25-40 emails per mailbox daily once fully warmed.

This structure gives you sustainable daily volume while keeping any single subdomain's risk exposure small.

How Do You Configure SPF for a Cold Email Sending Subdomain?

SPF (Sender Policy Framework) is a DNS TXT record that tells inbox providers which mail servers are authorized to send email for your domain. Without it, receiving servers cannot verify your email actually came from you, and many will reject or downgrade it.

Each subdomain needs exactly one SPF record. Multiple SPF records on the same hostname cause authentication failures. The record goes on the subdomain itself, not the root domain.

• What it does: Authorizes specific mail servers to send on behalf of your subdomain.
• Google Workspace record: Host outreach.yourcompany.com, Type TXT, Value v=spf1 include:_spf.google.com ~all, TTL 3600.
• Microsoft 365 record: Host outreach.yourcompany.com, Type TXT, Value v=spf1 include:spf.protection.outlook.com ~all, TTL 3600.
• Common mistake: Publishing a second SPF TXT record on the same host instead of merging vendors into one record's include statements. Two SPF records on one hostname is an automatic fail, not a merge.

The ~all at the end means softfail: mail from unlisted servers gets accepted but flagged. That is the right starting setting. Only move to -all (hardfail) after DMARC reports confirm all legitimate mail from the subdomain passes SPF alignment.

SPF also has a 10 DNS lookup limit. If your record nests many includes, use an SPF flattening tool to stay within bounds.

How Do You Configure DKIM for Cold Email?

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each outgoing message. Receiving servers use the public key published in your DNS to verify the message was not altered in transit and genuinely originated from your domain.

• What it does: Cryptographically signs outbound mail so receivers can verify it was not tampered with.
• Google Workspace record: Configured in Admin Console under Apps > Google Workspace > Gmail > Authenticate email. Google generates a 2048-bit key pair by default and gives you a TXT record in the form Host google._domainkey.outreach.yourcompany.com, Value v=DKIM1; k=rsa; p=[your public key].
• Microsoft 365 record: Two CNAME records, generated in the Microsoft Defender portal under Email & Collaboration > Policies & Rules > Email Authentication Settings > DKIM tab.
• Common mistake: Assuming a DKIM record on the root domain covers subdomains. Each subdomain you send from needs its own DKIM configuration.

Important update for Microsoft 365 as of mid-2026: the DKIM CNAME format changed for any custom domain added after May 2025. New domains use a dynamic-partition format:

Hostname: selector1._domainkey
Value: selector1-<yourdomain-with-dashes>._domainkey.<your-initial-domain-prefix>.<partition-char>-v1.dkim.mail.microsoft

Hostname: selector2._domainkey
Value: selector2-<yourdomain-with-dashes>._domainkey.<your-initial-domain-prefix>.<partition-char>-v1.dkim.mail.microsoft

Domains configured before May 2025 keep the older format (selector1-yourdomain-com._domainkey.yourtenant.onmicrosoft.com), and the old and new formats cannot coexist for the same selector. Do not hand-guess these values.

Pull the exact CNAME targets, including the dynamically assigned partition character, from the Defender portal or by running Get-DkimSigningConfig in Exchange Online PowerShell. Microsoft's own documentation states the values shown in any article, including this one, are for illustration only.

Allow up to 48 hours after publishing DNS records before enabling DMARC enforcement so authentication has time to propagate.

How Do You Configure DMARC for Cold Email?

DMARC (Domain-based Message Authentication, Reporting, and Conformance) tells inbox providers what to do when SPF or DKIM fails, and it delivers aggregate reports showing exactly which servers send mail for your domain. That reporting is what catches misconfigured infrastructure before it damages reputation.

Google has required DMARC since February 1, 2024 for senders of 5,000 or more daily messages to Gmail addresses, alongside SPF and DKIM authentication and a spam rate that Google recommends keeping under 0.10% (the hard ceiling is 0.3%). Yahoo enforces the same threshold on spam complaints. Both also require one-click list-unsubscribe on marketing and subscribed messages.

• What it does: Sets an enforcement policy for failed authentication and generates aggregate reports on your sending sources.
• Starting record (monitoring mode): Host _dmarc.outreach.yourcompany.com, Value v=DMARC1; p=none; rua=mailto:dmarc-reports@yourcompany.com; sp=none; adkim=r; aspf=r.
• Production record (after 2-4 weeks of clean reports): Value v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourcompany.com; pct=100; adkim=r; aspf=r.
• Common mistake: Jumping straight to p=reject before confirming every legitimate sending source passes alignment, which blocks real outreach along with the bad traffic.

The progression is p=none (observe for 2-4 weeks) to p=quarantine (route failing mail to spam) to p=reject (block failing mail outright). Relaxed alignment (adkim=r; aspf=r) is correct for most setups, since it allows subdomain matches where the authenticated domain is a parent of the From address domain.

DMARC adoption is still uneven industry-wide. The EasyDMARC 2026 DMARC Adoption Report, published March 30, 2026 and based on roughly 1.8 million domains, found 52.1% of domains now publish a DMARC record, up from 47.7% in 2025. Only 411,935 of those domains have moved to actual enforcement at p=quarantine or p=reject.

Fortune 500 companies lead with over 80% enforcement, while Inc. 5000 companies sit closer to 50% still in monitoring-only mode. Publishing p=none and never revisiting it means you get the reporting with none of the protection.

Should You Configure BIMI for Cold Email Subdomains?

BIMI (Brand Indicators for Message Identification) is an optional DNS record that displays your company logo in the inbox avatar for Gmail, Yahoo Mail, Apple Mail, and other BIMI-enabled clients. It is a trust and open-rate signal, not a deliverability requirement.

• What it does: Displays a verified brand logo next to your sender name in supported inboxes.
• Prerequisite: DMARC policy must already be at p=quarantine or p=reject with pct=100. Google Workspace's own setup guide is explicit that BIMI does not support a p=none policy.
• Logo requirements: Square SVG file in Tiny PS format, hosted at a public HTTPS URL.
• Common mistake: Assuming you need a registered trademark to show a logo at all.

That last point changed in a way the original playbook for BIMI does not reflect anymore. There are now two certificate paths:

• Verified Mark Certificate (VMC): Requires an active registered trademark, issued by a qualified certificate authority. This is the only path to Gmail's blue verified checkmark next to your sender name.
• Common Mark Certificate (CMC): Google began accepting CMCs for Gmail BIMI display in late 2024. No trademark required. The certificate authority instead verifies your logo has been publicly displayed on a domain you control for at least 12 months. A CMC shows your logo in the sender column but does not add the checkmark.

BIMI DNS record: Host default._bimi.outreach.yourcompany.com, Type TXT, Value v=BIMI1; l=https://yourcompany.com/logo-bimi.svg; a=https://yourcompany.com/vmc.pem. If you do not yet have a certificate, you can publish BIMI without the a= field, and it will work in Apple Mail and Yahoo, though Gmail requires the certificate for logo display.

BIMI is worth setting up on your highest-volume sending subdomains once DMARC enforcement is in place, since it adds no sending complexity and improves visibility.

What Is the Right Warm-Up Schedule for New Cold Email Domains?

A new mailbox with no sending history has no reputation, and inbox providers treat unknown senders with suspicion. Warm-up builds reputation by starting at low volume, generating positive engagement, and gradually increasing sends over 3-4 weeks before any cold outreach begins.

Recommended warm-up ramp per mailbox:

• Week 1: 5 emails per day, internal or known contacts only.
• Week 2: 10-12 emails per day, warm prospects and newsletter subscribers.
• Week 3: 15-20 emails per day, begin limited cold sends.
• Week 4 and beyond: 25 emails per day, full cold campaign.

Never send bulk cold outreach in week one. Inbox providers weigh the ratio of sent volume to engagement, and low engagement at high volume on a brand-new mailbox triggers spam filters. Tools like Warmup Inbox or the warm-up automation built into your sequencing platform handle this by exchanging warm-up emails with a network of other inboxes and marking them as not spam.

For a deeper look at how domain health compounds at scale, see Cold Email Domain Health: How to Scale Without Burning Your Reputation.

How Do You Monitor Cold Email Domain Reputation?

Configuring DNS correctly is the foundation. Monitoring reputation on an ongoing basis is what keeps the infrastructure working after launch. Google Postmaster Tools and Microsoft SNDS cover the two largest inbox ecosystems.

Google Postmaster Tools (postmaster.google.com) gives Gmail-specific signals for your sending domains: spam rate tracking, authentication compliance, and a Compliance Status dashboard that shows pass or needs-work against Google's bulk sender requirements, alongside its existing domain reputation, IP reputation, and spam rate dashboards. Keep spam rates below 0.10% as recommended, and never let them reach the 0.3% ceiling.

Microsoft SNDS (Sender Network Data Service) gives visibility into Outlook.com and Hotmail deliverability, covering consumer Outlook inboxes rather than Microsoft 365 enterprise accounts. It color-codes your sending IP: green for low complaints and good deliverability, yellow for moderate issues, red for high complaints or blacklisting. Microsoft has been shifting SNDS toward API-based reporting rather than one-off CSV exports, so treat the web portal as one input among several rather than your only monitoring source, and re-verify your access method periodically.

A complete monitoring stack also includes MXToolbox for blacklist lookups across major RBLs, and a seed-list testing tool for periodic checks of actual inbox versus spam-folder placement. Check MXToolbox weekly per sending domain. Run seed tests monthly during steady state, or immediately whenever reply rates drop unexpectedly.

Does Domain Infrastructure Connect to Signal-Based Outbound?

Proper domain infrastructure solves the floor problem: it stops deliverability from being the reason campaigns fail. But infrastructure alone does not drive pipeline. What accelerates results is combining clean infrastructure with intent-driven targeting, so the volume you are protecting is actually worth sending.

When you send only to accounts showing active buying signals, tracked through a library like Unify's Signals (25+ intent signals including job postings, technology changes, funding events, and website visits), your contact-to-meeting rate climbs. Per Unify's Deliverability product page, customers see a 48% average open rate, and a 2.5x reply-rate lift attributed to Quo's own case study, driven by combining authenticated sending infrastructure with targeted, signal-triggered lists rather than static ones.

Signal-based outreach also naturally caps daily send volume to the addressable in-market audience at any given time. That alignment between targeting precision and sending volume is exactly what inbox providers reward: high engagement relative to volume, low complaint rates, and consistent patterns over time. For the mechanics of building that targeting layer, see How to Build a Signal-Based Outbound Playbook, and for a broader view of how domain setup, deliverability, and sequencing fit together, see Cold Email in 2026: Domains, Deliverability, Replies.

30-Second Chooser: What Should You Prioritize First?

• If you are sending under 5,000 emails/day and staying there, prioritize SPF plus DKIM now, since DMARC only becomes mandatory at that Gmail threshold, but configure it anyway before you scale.
• If you are a PLG motion triggering outbound off product signals, prioritize domain capacity and rotation, since signal-triggered sequences spike volume unpredictably.
• If you are sales-led with named-account outbound, prioritize fewer, more carefully warmed subdomains over raw volume. You will re-contact these accounts for years.
• If you are in the EU or another consent-based market, prioritize list hygiene and opt-in basis before touching DNS. Authentication does not fix a consent problem.
• If you inherited a stack with existing deliverability issues, prioritize a DMARC and Postmaster Tools audit before adding new subdomains on top of an already-damaged setup.
• If you are consolidating point tools, prioritize a platform with managed deliverability built in, so provisioning, warm-up, and rotation stop being manual work.

What Should You Evaluate in a Deliverability and Warm-Up Stack?

Whether you build this in-house or buy a managed platform, use the same vendor-neutral criteria to evaluate it. These apply to any tool, not just Unify.

How Unify Covers Domain Setup and Monitoring

The criteria above (dedicated subdomains, per-subdomain SPF/DKIM/DMARC, staged warm-up, ongoing monitoring) apply no matter what platform or in-house process you use to run outbound. Here is specifically how Unify's Managed Deliverability handles it, so you can compare against whatever you are running today.

Per Unify's own domain configuration documentation, Unify only supports secondary sending domains, not your primary domain or a domain already installed on another ESP, and it enforces naming conventions to avoid domains that read as spam or phishing attempts. Unify then enforces and monitors SPF, DKIM, and DMARC on every domain it provisions, and automatically generates branded tracking links on your domain rather than a shared redirect domain.

On outcomes: per Unify's Deliverability product page, Unify customers see a 3-6x lower bounce rate than industry standard, benchmarked against Instantly, Smartlead, and Woodpecker on 2025-2026 customer data, while managing 100,000+ monthly sends for its highest-volume customers.

Two named customers show what that looks like in practice. Per the Justworks customer story, Unify Managed Deliverability prevented over 10% of bounces in outbound enrollments, contributing to Justworks' 6.8X return on investment in its first five months.

Per the CandorIQ customer story, consolidating a fragmented stack (Apollo for sequencing, Factors.ai for web intent, Claude for email drafts) onto Unify cut CandorIQ's bounce rate by 87% while attributing $1.8M in pipeline to the platform.

If you want to see the setup mechanics directly, Unify's Deliverability product page and its domain configuration docs lay out the same subdomain-first approach described in this guide, just automated: Unify provisions the mailbox, configures DNS, and runs the warm-up schedule for you.

Sign up for Unify if you would rather have domain provisioning, DNS configuration, and warm-up scheduling handled for you instead of tracked in a spreadsheet.

Worked Example: A Five-Week Domain Setup, Start to Finish

Illustrative walkthrough, not a specific customer's reported figures.

Symptom: A 12-person sales team has been sending cold outreach from its primary domain through a sequencing tool for six months. Reply rates have dropped by half, and roughly 1 in 20 emails is bouncing.

Diagnosis: No DMARC record exists on the primary domain at all. SPF is set to hardfail (-all) with only one vendor included, so every other tool sending on the team's behalf fails authentication. There is no subdomain isolating cold volume from the primary domain that also sends invoices and support replies.

Fix, week by week:

• Week 0: Register 3 sending subdomains. Publish SPF and DKIM on each. Publish DMARC at p=none with an aggregate report address.
• Weeks 1-3: Run the warm-up ramp (5 to 20 emails/day per mailbox) on each new subdomain while continuing light sends from the old setup.
• Week 4: Review DMARC aggregate reports. All legitimate sources align. Move DMARC to p=quarantine. Retire cold sending from the primary domain entirely.
• Week 5: Register all subdomains in Google Postmaster Tools and Microsoft SNDS. Run a seed-list test.

Measurable impact: Spam complaint rate on the new subdomains settles under Google's 0.10% recommended ceiling within the first two weeks of real cold sending. Hard bounces drop from roughly 5% to under 2% once pre-send validation is in place, consistent with the bounce-rate improvements Justworks and CandorIQ report after moving to a managed deliverability setup (over 10% of bounces prevented and an 87% bounce rate reduction, respectively, per their published customer stories).

Role and Segment Variants

By team size:

• Solo founder or first GTM hire: Start with 2 subdomains, not 5. You do not have the volume to justify more, and fewer domains are easier to monitor by hand.
• Growth team of 2-5: This is where the standard 3-5 subdomain, 2-3 mailbox structure fits cleanly. Assign one person to own DMARC report review weekly.
• Scaled RevOps-owned infrastructure (10+ reps): Manual domain rotation breaks down here. This is the point where automated provisioning and rotation stop being a nice-to-have, per the multi-domain rotation criterion above.

By region:

• US: CAN-SPAM governs commercial email; the authentication requirements in this guide (SPF, DKIM, DMARC) are the technical layer, and cold outreach to a business email is broadly permitted with a working opt-out.
• EU and other GDPR-sensitive markets: Consent requirements sit on top of authentication. A perfectly configured SPF/DKIM/DMARC setup does not make an unsolicited list legal to email under GDPR. Confirm your legal basis before scaling volume.

Edge Cases and Disambiguation

• Subdomain vs. sub-subdomain: A new hostname like outreach.yourcompany.com needs its own SPF and DKIM records. DMARC is the exception: undefined subdomains inherit the parent domain's DMARC policy unless you override it per subdomain.
• New domain vs. aged, reused domain: An old parked domain with no prior sending history does not have built-in reputation just because it is old. Treat it identically to a brand-new domain and run the full warm-up ramp.
• Softfail vs. hardfail on SPF: ~all (softfail) risks nothing during setup; -all (hardfail) risks rejecting legitimate mail from a vendor you forgot to include. Only move to hardfail after DMARC reports confirm full alignment.
• DMARC aggregate reports vs. Postmaster Tools: The rua reports are raw XML data on every server sending as your domain, useful for catching shadow IT or forgotten vendors. Postmaster Tools is Gmail-specific and shows spam rate and compliance status. Use both; they answer different questions.
• The 5,000/day bulk sender threshold: Google's language addresses senders who cross this volume to Gmail addresses. If your total sending across all subdomains approaches this line, authenticate everything as if you are already a bulk sender rather than waiting to cross the threshold and scrambling.

Stop Rules and Red Flags

Common Mistakes to Avoid

• Sending cold outreach from the primary company domain instead of a dedicated subdomain.
• Escalating DMARC straight to p=reject without reviewing aggregate reports first.
• Treating an old, aged domain as pre-warmed just because it has sending history.
• Assuming root-domain DKIM covers subdomains, when each one needs its own configuration.
• Publishing two SPF records on one host instead of merging vendors into a single record.

Cold Email Domain Infrastructure Checklist

• Register 3-5 dedicated sending subdomains (e.g., outreach.yourcompany.com, send.yourcompany.com)
• Configure one SPF TXT record per subdomain, staying within the 10 DNS lookup limit
• Configure DKIM per subdomain: 2048-bit key for Google Workspace, current CNAME format for Microsoft 365
• Configure DMARC starting at p=none with an aggregate reporting address
• Escalate DMARC to p=quarantine after 2-4 weeks of clean reports, then p=reject once fully aligned
• Optionally publish BIMI once at p=quarantine or p=reject, using either a VMC or a CMC
• Warm each new mailbox over 3-4 weeks before full cold-send volume
• Cap cold sends at 25-40 emails per mailbox per day, 2-3 mailboxes per domain
• Register every sending domain in Google Postmaster Tools
• Monitor Microsoft SNDS for Outlook and Hotmail signals
• Check MXToolbox blacklist status weekly per domain
• Run seed-list placement tests monthly
• Keep spam complaint rate under 0.10%, never at or above 0.3%

Frequently Asked Questions

How do I set up proper domain infrastructure for cold email sending?

Register 3-5 dedicated sending subdomains and never use your primary company domain for cold outbound. Configure four DNS records on each subdomain: SPF, DKIM, DMARC, and optionally BIMI. Warm each new mailbox for 3-4 weeks before sending at full volume, capping daily sends at 25-40 emails per inbox. Register every sending domain in Google Postmaster Tools and monitor Microsoft SNDS for Outlook and Hotmail signals.

What is the correct SPF record format for cold email?

For Google Workspace: v=spf1 include:_spf.google.com ~all. For Microsoft 365: v=spf1 include:spf.protection.outlook.com ~all. Each subdomain needs exactly one SPF record. Start with ~all (softfail) and only move to -all (hardfail) after confirming all legitimate sources pass authentication in DMARC reports.

Why should I use subdomains instead of my main domain for cold email?

Cold outbound generates higher bounce rates and occasional spam complaints by design. Sending from your primary domain lets those signals degrade deliverability for every other email type that domain sends. A dedicated subdomain isolates that risk, and if it gets flagged, you retire it without touching your primary domain's reputation.

What DMARC policy should I start with for cold email?

Start with p=none to observe authentication results without rejecting any mail. After 2-4 weeks of clean aggregate reports confirming all legitimate mail passes SPF or DKIM alignment, escalate to p=quarantine, then eventually p=reject. Moving straight to p=reject before verifying alignment will block legitimate email.

How many domains and mailboxes do I need for cold email at scale?

The standard structure is 3-5 sending domains with 2-3 mailboxes per domain, each capped at 25-40 emails per day once fully warmed. Divide your daily send target by mailboxes per domain multiplied by your per-mailbox limit to estimate how many domains you need.

What is the difference between a VMC and a CMC for BIMI?

A Verified Mark Certificate requires a registered trademark and is the only path to Gmail's blue verified checkmark. A Common Mark Certificate, which Google started accepting for Gmail BIMI display in late 2024, needs no trademark, only 12 months of public logo use on your domain. Both display your logo; only the VMC adds the checkmark.

How long does it take for SPF, DKIM, and DMARC DNS changes to take effect?

Most DNS providers propagate changes within minutes to a few hours depending on the record's TTL. Give it up to 48 hours before troubleshooting or before enabling DMARC enforcement, since some resolvers cache records longer than others.

Glossary

• SPF (Sender Policy Framework): A DNS TXT record listing which mail servers are authorized to send email for a domain.
• DKIM (DomainKeys Identified Mail): A cryptographic signature added to outbound mail that lets receivers verify it was not altered in transit.
• DMARC (Domain-based Message Authentication, Reporting, and Conformance): A policy layer that tells receivers what to do when SPF or DKIM fails, and generates reports on who is sending as your domain.
• BIMI (Brand Indicators for Message Identification): An optional DNS record that displays a verified logo next to your sender name in supported inboxes.
• Sending subdomain: A dedicated hostname (e.g., outreach.yourcompany.com) used only for outbound email, isolating its reputation from the primary domain.
• DMARC alignment: Whether the domain in a message's visible From address matches the domain validated by SPF or DKIM.
• Domain warm-up: Gradually increasing a new mailbox's daily send volume over several weeks to build sender reputation before full-volume sending.
• Bulk sender (Google/Yahoo definition): Any domain sending 5,000 or more messages per day to that provider's addresses, triggering mandatory SPF, DKIM, and DMARC.
• Inbox placement vs. deliverability: Deliverability means the message was accepted by the receiving server; inbox placement means it actually landed in the inbox rather than spam. A message can be "delivered" and still never placed in the inbox.
• VMC vs. CMC: Two certificate types that unlock BIMI logo display. A VMC requires a trademark and adds Gmail's checkmark; a CMC does not require a trademark and does not add the checkmark.

Sources

• Google: Email sender guidelines
• Google: Postmaster Tools dashboards
• Google Workspace: Set up BIMI
• Microsoft Learn: How to use DKIM for email in your custom domain (updated July 17, 2026)
• Yahoo: Sender Hub best practices
• EasyDMARC: 2026 DMARC Adoption Report (published March 30, 2026)
• Unify: Deliverability product page
• Unify: Domain configuration documentation
• Unify: Justworks customer story
• Unify: CandorIQ customer story
• Unify: Quo customer story

About the Author
Austin Hughes is Co-Founder and CEO of Unify, outbound AI for sellers where AI agents and reps work side by side, from finding the buyers already in market to reaching them with the right message. Before founding Unify, Austin led the growth team at Ramp, scaling it from 1 to 25+ people and building a product-led, experiment-driven GTM motion. Prior to Ramp, he worked at SoftBank Investment Advisers and Centerview Partners.