Set up your sending domain

If you plan to email your whole client list (newsletters, seasonal announcements, a “let’s review this” blast), this step decides whether those emails land in the inbox or the spam folder. A sending domain is the biggest lever you have on deliverability, and it’s the one most people skip.

Budget 20 minutes of hands-on work, plus a wait. It isn’t hard. It’s just unfamiliar.

What a sending domain actually is

Two different email jobs get confused constantly:

• Your mailbox is where you read and reply — your Gmail or Outlook account, connected so one-to-one conversations flow in and out. That’s a different article: Connect your email.
• Your sending domain is the identity your CRM uses when it sends on your behalf: automated reminders, workflow follow-ups, and above all bulk sends.

Here’s the mechanic. When your CRM sends a thousand emails “from” jane@youragency.com, the receiving mail servers have never met your CRM. They have no reason to believe it’s allowed to speak for your domain — that’s exactly what a spammer forging your address would look like. So they check DNS.

DNS is the public phone book for your domain name. It’s where you publish records that answer questions about youragency.com — where its website lives, where its mail goes, and who is allowed to send email as you. Setting up a sending domain means publishing those answers so every mailbox provider on earth can look them up and confirm: yes, this sender is authorized.

What happens if you skip it

Your CRM falls back to shared sending infrastructure used by everyone. Which means:

• Your address gets rewritten behind the scenes so the mail passes basic checks — that’s why some recipients see a “via” or “sent on behalf of” line next to your name in Gmail.
• You have no reputation of your own. You inherit a shared one, so another sender’s bad list becomes your spam-folder problem — and the good sending you do builds nothing you get to keep.
• You stay off-side of where the industry is heading. Google’s strictest rules — full SPF, DKIM and DMARC authentication — formally bite once you send more than 5,000 messages a day to personal Gmail addresses, which most businesses will never do. Yahoo expects the same authentication from bulk senders but deliberately publishes no volume threshold at all, so there’s no number to hide under. And authentication is expected of everyone now — unauthenticated mail is filtered harder every year regardless of volume.

This is an argument about trust, not about volume. The point of your own domain isn’t a bigger allowance — it’s that your reputation becomes yours, earned by your own sending and nobody else’s.

Do you need this?

Your situation	What to do
You send bulk/marketing email to your client list	Set this up. This is the whole point.
You have your own domain (youragency.com)	Set this up, even if your volume is low today.
You only ever send one-to-one replies from your connected mailbox	You can skip it for now — but automations still send as your CRM.
Your “from” address is a free Gmail/Yahoo/Outlook.com address	You cannot authenticate this — you don’t control those domains’ DNS. Get your own domain first.
You don’t own a domain at all	Buy one first (any registrar, ~$15/year). Then come back.

No domain, no authentication

Authentication works by publishing records in a domain’s DNS — and you don’t control the DNS for gmail.com, yahoo.com, or outlook.com. You can’t add an SPF or DKIM record to someone else’s domain, so you can never prove you’re authorized to send as @gmail.com. On top of that, Google’s and Yahoo’s bulk-sender rules require you to authenticate a domain you actually own. Your own domain is the price of entry.

Before you start

• Your own domain (e.g. youragency.com).
• Access to that domain’s DNS settings. This lives at your registrar — wherever you bought the domain (GoDaddy, Namecheap, Cloudflare, your web host). Look for Manage DNS, DNS Records, or Edit DNS. If your web guy owns that login, get him on the phone now; you can’t do this without it.
• 20 minutes, plus a wait. DNS changes have to propagate — spread out across the internet’s servers — which can take up to 24 hours. Often it’s minutes. Don’t start this the night before a campaign.

The records, in plain English

Your CRM generates most of these for you and shows you exactly what to publish. DMARC is the exception — you write that one yourself (there’s a section on it below).

Record	What it does
SPF	A public list of who’s allowed to send email for your domain. One SPF record per domain — never two.
DKIM	A tamper-proof digital signature on every message, proving it came from you and wasn’t altered in transit. Your DKIM value is a long key unique to your domain.
DMARC	Your instructions for what the world should do when a message fails SPF and DKIM: ignore it, spam-folder it, or reject it.
MX	Tells the internet which server receives mail for that name, so bounces and replies route correctly.
CNAME	A pointer — “this name is an alias for that one.” Used for tracking links and delivery.

Each record has a Type (TXT, MX, CNAME), a Host (sometimes called Name — the label the record hangs on), and a Value (what it says).

Copy the values from your CRM, not from a guide

Your DKIM key is generated for your domain alone. Copy every value from the screen your CRM shows you — never from a tutorial, including this one. A single wrong character means the record fails.

Set it up

1. Open Settings from the left menu, then Email Services. The page opens on the SMTP Service tab, and Dedicated Domain and IP is right there on it.

2. Choose Add Domain.

3. Enter a subdomain, not your root domain — something like mail.youragency.com.

   Why a subdomain

   It firewalls your reputation: if a campaign ever goes badly, the damage stays on mail.youragency.com and your main domain — the one your personal email runs on — stays clean. It also avoids colliding with the mail routing you already have if Google Workspace or Microsoft 365 runs on your root domain. Your clients still see your normal “from” name either way.

4. Your CRM now shows the exact records to publish. Leave this screen open.

5. In a second tab, open your registrar and go to that domain’s DNS records.

6. Add each record exactly as shown — matching Type, Host, and Value. Three traps:

   • Many registrars auto-append your domain to the Host field. If your CRM says the host is mail.youragency.com and the registrar already shows .youragency.com after the box, type only mail — otherwise you get mail.youragency.com.youragency.com. Save, then read back what the registrar displays.
   • Some registrars (GoDaddy among them) require you to save each record individually.
   • On Cloudflare, set every one of these records to DNS only — the gray cloud, not the orange “Proxied” cloud. Proxying a record used for email authentication breaks verification.

7. Back in your CRM, verify the domain from the Dedicated Domain and IP screen. Depending on where you are in the flow, that’s either a Verify button or a three-dot menu on the domain’s row with a verify option inside it. If your records are live, it will confirm them and mark the domain verified.

8. On success, an SSL certificate is issued automatically. The domain isn’t fully active until that finishes.

A word on your DMARC policy

Your DMARC record is a TXT record on the host _dmarc, and its value ends in a policy: p=none, p=quarantine, or p=reject.

Start at p=none — “watch and report, but don’t block anything.” It lets you confirm that all your real mail (CRM, mailbox, quoting tools) passes authentication before you start blocking anything. Run it a few weeks, then tighten to quarantine and eventually reject.

Jumping straight to p=reject before your domain is authenticated is the classic self-inflicted wound: you order the world to throw away mail that fails, then discover your own campaigns were the mail failing.

What “done” looks like

1. Send a test from your CRM to a personal Gmail address on a different domain — never to an address at the domain you’re authenticating. A mailbox that receives a message “from itself” that it didn’t send reads it as spoofing, and you’ll get a false failure.
2. In Gmail, open the message, click the three dots, choose Show original.
3. You want SPF: PASS, DKIM: PASS, and DMARC: PASS, and the “via” line gone from the sender name.

Three PASSes and a clean sender line means you’re authenticated. Now send a small real batch — 50 or 100 engaged clients — before you touch your whole list.

Troubleshooting

The domain won’t verify. Usually the record is wrong or isn’t visible yet. Check the Host field first — extra @ symbols, a missing subdomain, or a double-appended domain are the usual culprits. Check the Type (DKIM is TXT, not CNAME). Check for a trailing space in a pasted value. Then check the clock: propagation can take up to 24 hours, and if your record’s TTL (how long other servers are told to cache it) is set to hours, that’s your delay. Set TTL to 300 seconds if your registrar allows it, and re-verify.

SPF fails, or reports a “permerror.” Either duplicate SPF records — you may already have one from an older mail setup, and two SPF records is the same as none, so merge them into one — or too many lookups. SPF is limited to 10 DNS lookups, and every service you’ve ever authorized (mail host, e-signature tool, quoting platform) burns one. Remove includes for tools you no longer use.

It verified, but emails still land in spam. Almost always alignment. SPF and DKIM can pass while DMARC still fails, because DMARC also requires the authenticated domain to match the domain in your visible “From” address. If you authenticated mail.youragency.com but your campaign sends from jane@oldagency.net, that’s a mismatch and it fails. Point your from address at the authenticated domain and re-test with Show original.

You see a daily sending limit on your new domain and assume you’re throttled. Read that number correctly, because it’s widely misunderstood. A brand-new domain has no reputation, so it enters a staged warm-up: Stage 1 carries a 1,000 emails/day figure, Stage 2 2,500/day, and the stages climb from there. There are no hourly limits.

That daily number is a graduation threshold, not a wall. At present it doesn’t stop anything — exceed it and your mail is still delivered. What it actually governs is promotion: you only advance to the next stage by hitting your current stage’s full daily limit. Fall short, and you stay put.

With a small book, you’ll stay in Stage 1 — and that’s fine

A business with 500 clients will never send 1,000 emails in a day, so that domain never leaves Stage 1. That is not a problem to solve: Stage 1’s figure is already double your entire list, every day. Do not pad a send or blast a stale list to climb stages — buying a promotion with a bad send damages the exact reputation this whole process exists to protect. One caveat worth knowing: the platform has said it intends to enforce these limits in a future update, so treat the stage figure as a real ceiling to grow into rather than one to ignore.

Everything’s configured and deliverability is still bad. Your domain reputation is already damaged — from a bad list, a big blast, or complaints. This is recoverable, and there’s a documented order of operations. Don’t skip to the end.

1. Confirm authentication is genuinely passing (SPF, DKIM, DMARC), not just verified in the app.
2. Turn on monitoring. Connect Google Postmaster Tools from Settings → Email Services so you can actually see your domain reputation and spam-complaint rate instead of guessing.
3. Check whether you’ve been blacklisted, and file removal requests where you have — daily for the first week, then weekly. Listings come right back if the underlying problem is still there.
4. Clean the list aggressively. Hard bounces, role addresses (info@, office@), and anyone who hasn’t opened anything in months — all out. This is the step people skip, and it’s the step that matters most.
5. Cut volume to a minimum and rebuild. Mail only your most engaged clients, then increase slowly as engagement holds up.
6. Keep watching. Reputation recovery runs about 30–90 days of consistent good behavior. It is not a weekend fix.

You may stand up a fresh subdomain to keep critical mail moving while the original recovers — but understand what that does and doesn’t buy you. A subdomain builds its own reputation only partly; it does not hand you a clean slate, and continued bad sending on it bleeds back onto your root domain. And speaking plainly, outside anyone’s documentation: a domain that has been badly burned may never fully return to where it was. That’s the deliverability reality, and it’s the reason the warm-up and list-hygiene discipline above is worth the tedium.

Adding MX records broke your normal email. You added them to your root domain, which already routes mail to Google Workspace or Microsoft 365. Remove them and set the sending domain up on a subdomain instead — exactly the collision the subdomain recommendation prevents.

Staying out of spam long-term

Authentication earns you a fair hearing, not a pass. After that it’s behavior:

• Keep your list clean. Remove hard bounces immediately, and suppress contacts who’ve ignored you for 90+ days. Better to stop emailing someone than to have them mark you as spam.
• Never buy or import a list you didn’t earn. Purchased lists are the fastest way to torch a domain — they’re full of spam traps, dead addresses whose only job is to catch senders like that.
• Watch your complaint rate. Google wants spam complaints under 0.3%, and under 0.10% is the number to actually aim for. Above 0.3% and you get filtered or blocked.
• Write like a person. Skip link shorteners (heavily abused, heavily filtered), ALL-CAPS subject lines, “FREE” and “GUARANTEED,” and emails that are one giant image with no text. Fake “Re:” subjects destroy trust and get reported.
• Leave the unsubscribe link on. Your CRM adds an unsubscribe link to your emails by default — your job is simply not to disable it. (If you do turn the default footer off, you must place the {{unsubscribe}} tag in every email yourself.) Google requires bulk senders to offer both a one-click unsubscribe and a visible link in the message body. When someone opts out, they’re out — honor it immediately.

Consent and client data

Only email clients and prospects who gave you permission to contact them. Keep protected health information out of bulk email and out of subject lines entirely: no health conditions, no policy numbers, no plan details tied to a name. Bulk marketing carries its own consent and disclosure rules, and they are yours to know. Confirm what you’re sending meets them before it goes to a thousand people at once. Keep broadcasts generic; keep anything client-specific in the platform’s secure channels.

Next step

Your sending identity is set. Now get the people you’re going to email into the system → Import your clients.