Secondary domains for cold email: what they protect, and what they don't

In short

• A secondary domain keeps cold email complaints on its own reputation. Gmail and Yahoo both document that they track reputation per sending domain.
• The separation is partial. Gmail also rate limits by the domains you link to, and your provider's terms apply to every domain you send from.
• No provider publishes a maximum number of inboxes per domain. The usual two to five comes from outreach vendors and serves to limit the loss when one domain is blocked.
• A new domain needs its own SPF, DKIM and DMARC records, a day or more of waiting, and a slow start.
• For a few researched emails a day from an established domain, your main domain can carry it.

A secondary domain is a second domain you own, close in name to your main one and used only for cold email. The idea is that spam complaints and blocks attach to that domain, and not to the one your invoices, support replies and password resets depend on. The separation is real: Gmail and Yahoo both document that they keep reputation per sending domain. It is also partial, because your links, your content and your provider's terms follow you from one domain to the next. If cold email is a steady channel for you, a secondary domain is worth having. If you write a handful of researched emails a day from a domain with years of normal mail behind it, you may not need one.

What a secondary domain is

Say your company lives at harborpost.example. A secondary domain would be something like getharborpost.example: registered by you, with its own mailboxes, its own DNS records and, in time, its own reputation. People also call it a cold email domain or an outreach domain.

Two neighbours are easy to confuse with it:

• A subdomain, such as mail.harborpost.example, is part of your main domain. Why that matters comes further down.
• An alias domain in Google Workspace gives each existing mailbox a second address at another domain. It adds no mailbox and no capacity: Google counts messages sent from an alias toward the same user's daily limit.

Google uses the term "secondary domain" for a further domain inside one Workspace account, with its own paid users. You can add up to 599. A cold email domain can be set up that way or in an account of its own.

What it protects

Mailbox providers attach reputation to the domain a message is signed with. That part is documented. Google's sender guidelines say:

Gmail tracks volume, feedback, and limits per domain and IP address

The same passage notes that "DKIM and SPF quotas are specific to your domain". DKIM is the signature that ties a message to a domain, SPF the list of servers allowed to send for it. Yahoo's sender best practices put it the same way:

Each IP and DKIM domain has a reputation, which can impact the delivery of your email. Sending unsolicited commercial email can negatively affect your reputation.

So when recipients report mail signed by getharborpost.example, the reports are booked against getharborpost.example. If you send through Google Workspace or Microsoft 365, the IP addresses belong to the provider and are shared with its other customers. The domain is the part of the reputation that is yours.

That is the whole case for a secondary domain, and it is a sound one. When a campaign goes wrong, the domain that suffers is not the one your customers write to.

What it does not protect

Your links

Gmail also tracks the domains that appear inside a message. Its list of SMTP errors has an entry for exactly that:

421 4.7.28 Gmail has detected an unusual rate of unsolicited email
containing one of your URL domains. To protect our users from spam,
email with the URL has been temporarily rate limited.

If every cold email from getharborpost.example links to harborpost.example, your main domain travels in every message. A first email rarely needs a link. A reply is what you are after.

Everything else a filter can see

Yahoo's sender FAQ says a sender is viewed at the domain level, and continues: "However, we will use all of the information available (content, IP, etc.) to review sender compliance." The same text, the same signature and the same links, sent from a sister domain, are information too.

A subdomain protects less

Google's sender FAQ gives an example: 2,500 messages a day from solarmora.com and 2,500 from promotions.solarmora.com make a bulk sender, "because all 5,000 messages were sent from the same primary domain". For that purpose, at least, a subdomain is not separate. Postmaster Tools lets you view a subdomain on its own, but Google does not publish how a subdomain's reputation relates to its parent's. That gap is why the usual advice for cold email is a separately registered domain. For a newsletter to people who subscribed, a subdomain is the usual separation.

Your provider's terms

Google's acceptable use policy for Workspace (last modified October 13, 2025) forbids using the service to "generate, distribute, publish or facilitate unsolicited mass email". It binds the customer, whichever domain the mail carries. Microsoft's tenant limit on external recipients counts every domain in the tenant together.

Gmail's program policies (last updated November 13, 2025) name as circumvention "creating or using multiple accounts or other methods intended to engage in a behavior that was previously prohibited". Opening fresh accounts to carry on after one was blocked is the pattern that sentence describes. A new domain name does not change that.

The law, and the reader

A second domain changes nothing about the rules for unsolicited email where you and your recipients live. In the United States, the FTC's CAN-SPAM guide requires that the "originating domain name and email address" be accurate and identify who sent the message. And the same list and the same copy that would have hurt your main domain will hurt this one. The damage only lands somewhere else.

Do you need one?

How many inboxes per domain, and how many domains?

No provider publishes a number. Google's sending limits are per user, and a Workspace account can hold hundreds of users and domains. The figures in circulation come from outreach vendors:

The same Hunter page is frank about where such numbers come from:

Some people say you should only have two accounts per domain; others say it's five. But it's hard to justify a specific number.

What a low number does is cap the loss. Every mailbox on a domain shares that domain's reputation, so a blocked domain takes all its mailboxes down together. Three lost mailboxes are a bad week. Fifteen are your whole pipeline.

With that understood, the sizing is plain arithmetic:

sends per day = new prospects per day × emails per prospect
mailboxes     = sends per day ÷ sends per mailbox
domains       = mailboxes ÷ mailboxes per domain

Here it is for a three-email sequence that is already running, once with cautious assumptions and once with generous ones. Both pairs come from the published advice; how many cold emails per day per inbox shows where the per-mailbox numbers come from.

Neither column is a rule. The difference between them is what you pay and what you risk: every mailbox is a paid seat that needs its own warmup, and every domain needs its own registration and DNS records.

Setting one up

1. Choose a name that is plainly yours. Your brand with a short word before or after it. Not another company's name, and not a spelling trick.
2. Register it, then let a day pass. Spamhaus keeps newly registered domains on its Zero Reputation Domains list for their first 24 hours.
3. Create mailboxes for real people. A first name and a face the recipient can look up, not sales@.
4. Publish SPF, DKIM and DMARC for the new domain. Records on your main domain do not carry over. On Google Workspace the three look like the example below. Google makes you wait 24 to 72 hours after turning on Gmail before the DKIM key can be generated.
5. Put something at the web address. Recipients look the domain up before they answer, which is why Hunter recommends redirecting it to your main website. A redirect on the web is not a link in the email.
6. Warm up, then raise volume slowly. A new domain has no history. The other guide covers how a new mailbox starts.
7. Answer from the same mailbox. Replies arrive at the secondary domain. Read them there, or forward them, and keep the conversation on the address the recipient wrote to.

getharborpost.example.                    TXT  "v=spf1 include:_spf.google.com ~all"
google._domainkey.getharborpost.example.  TXT  "v=DKIM1; k=rsa; p=(key from the Admin console)"
_dmarc.getharborpost.example.             TXT  "v=DMARC1; p=none; rua=mailto:dmarc@getharborpost.example"

Where WarmupBay fits

A mailbox on a new domain starts with no sending history. WarmupBay gives it some before the first cold email goes out: the mailbox exchanges short emails with other mailboxes in a shared pool, starting at 3 a day and adding one a day, up to 10 a day, or up to 30 with a badge on your website. It is free, with no card and no subscription.

When you connect a mailbox, WarmupBay checks the domain's SPF, DKIM and DMARC and shows a ready-made DMARC record. If the records are still missing after 72 hours, warmup stops. On a domain you set up last week, that check finds a missing record before it costs you anything.

What it does not do: it does not send campaigns, register domains or rotate mailboxes. Each account holds one mailbox. Gmail and Google Workspace connect with an app password, other providers over IMAP and SMTP; Microsoft 365 and Outlook.com cannot be connected yet. If one mailbox on one new domain is where you are, you can start warming it up.

Questions people ask

How long should a new domain age before I send from it?

Two waits are documented. Spamhaus lists newly registered domains for their first 24 hours, and Google Workspace needs 24 to 72 hours after Gmail is turned on before a DKIM key can be generated. Beyond that, the common advice of two to four weeks is a warmup convention. No mailbox provider publishes a minimum domain age.

Do I need a separate Google Workspace account for the secondary domain?

Not technically. Google lets you add up to 599 secondary domains to one account, each with its own paid users, or you can open a separate account. Google does not document whether reputation is linked between domains in the same account, and its acceptable use policy applies either way.

Which ending should a secondary domain have?

No provider publishes a ranking of domain endings. Vendors such as Hunter advise .com where possible and endings that are not associated with spam. A better test is whether a recipient would recognise the name as your company.

What should I do with a secondary domain that got blocked?

Stop the campaign on it and find the cause first: the list, the copy or the volume. Then restart low and increase slowly, which is what Google's guidelines advise after bounces and deferrals. Registering a fresh domain and repeating the same campaign brings the same result, and opening new accounts to continue a blocked behaviour is what Gmail's policies call circumvention.

Can replies to the secondary domain arrive in my normal inbox?

Yes, if you set up forwarding or add the mailbox to your mail program. Answer from the secondary address all the same, so the recipient stays in one conversation with one sender. Google does not count auto-forwarded messages toward the daily sending limit.

Sources

1. Email sender guidelines – Google Workspace Admin Help
2. Email sender guidelines FAQ – Google Workspace Admin Help
3. Get started with Postmaster Tools – Gmail Help
4. Gmail SMTP errors and codes – Google Workspace Admin Help
5. Gmail sending limits in Google Workspace – Google Workspace Admin Help
6. Add a user alias domain or secondary domain – Google Workspace Admin Help
7. Set up SPF – Google Workspace Admin Help
8. Set up DKIM – Google Workspace Admin Help
9. Set up DMARC – Google Workspace Admin Help
10. Google Cloud Acceptable Use Policy for Google Workspace (last modified October 13, 2025)
11. Gmail Program Policies (last updated November 13, 2025)
12. Sender Best Practices – Yahoo Sender Hub
13. Sender FAQs – Yahoo Sender Hub
14. Exchange Online limits – Microsoft Learn
15. Introducing Exchange Online Tenant Outbound Email Limits – Microsoft Exchange Team Blog (updated August 2026)
16. CAN-SPAM Act: A Compliance Guide for Business – Federal Trade Commission
17. Recently registered domains: how to avoid the risks (Zero Reputation Domains) – Spamhaus
18. Set Up a Dedicated Cold Email Domain – Hunter (September 8, 2023)
19. Set Up Your Outreach Ops for Scale – Hunter (December 29, 2023)
20. How to Use Secondary Domains for Cold Email Safety – Instantly (September 29, 2025)
21. How Many Domains Do You Need for Cold Email Outreach? – LeadHaste (updated August 6, 2026)
22. All you need to know about secondary sending domains – Smartlead Help Center
23. How Many Inboxes Per Domain for Cold Email? – Puzzle Inbox (2026)
24. Cold email volume and mailbox calculator – SmartReach.io