Outbound Infrastructure Checklist: Domains to Attribution

Most teams treat outbound like a tool problem. It is not.

Outbound is infrastructure. If the foundation is wrong, the failure mode is predictable: volume goes up, deliverability decays, replies dry up, and the team starts cycling domains and blaming the market.

This checklist is the practical version of what we build at GTM Vector: an operating system for outbound that protects deliverability, keeps routing clean, and makes attribution real. It covers the build, the rules that keep it healthy, and the operating rhythm once it is live.

TL;DR: the five layers, in order

Domains and authentication (separate sending domains, SPF, DKIM, DMARC)
Inboxes and sending rules (ramp, daily caps, rotation, auto-pause)
Data, routing and suppression (verification, dedupe, routing rules, suppression)
Messaging and automation (sequencing without spam signals)
Tracking and attribution (UTMs, CRM sync, replies and meetings by campaign)

If layer 1 or 2 is broken, nothing above it matters.

Layer 1: Domains and authentication

Use separate sending domains

Never send cold email from your primary company domain.
Never send cold email from subdomains of it either (for example mail.yourcompany.com). Subdomains share reputation with the root domain, so problems there can reach your everyday business mail.
Buy a small set of separate sending domains that are clearly related to your brand (for example getyourcompany.com or yourcompany-hq.com).
Point each sending domain’s website to your main site, so a curious prospect lands somewhere real.

Rule: your sending identity is your reputation. Protect it like production.

Why separate domains work:

Sending reputation stays isolated from your brand domain
Your main domain keeps delivering sales, support and billing mail, whatever happens to a cold campaign
A domain that runs into trouble can be rested or retired without touching the business

Background: SPF (who is allowed to send), DKIM (proof the message was not altered), DMARC (policy and reporting so you can see failures).

SPF

SPF record exists and is valid.
SPF includes only the services that actually send mail for that domain.
You stay under SPF’s limit of 10 DNS lookups.

DKIM

DKIM is enabled for each mailbox provider.
DKIM aligns with your From domain.

DMARC

DMARC record exists on every sending domain.
Start with p=none for monitoring, then move to quarantine or reject once reports look clean.
Aggregate reports (rua) go to an address someone actually reads, or to a DMARC reporting tool.

Layer 2: Inboxes and sending rules

Inbox inventory

You have enough inboxes for your daily volume without pushing any one mailbox hard.

Rule of thumb: in our experience, keeping cold volume to roughly 30 to 50 emails per mailbox per day, with a few mailboxes per domain, is what stays stable on Google Workspace and Microsoft 365. Need more volume? Add mailboxes and domains; do not raise the per-mailbox cap.

Ramp schedules

New inboxes ramp gradually, typically over two to three weeks before they carry campaign volume.
Volume increases weekly, not daily.
No sudden spikes. Abrupt jumps in volume are one of the fastest ways to trigger filtering.

Warm-up is not velocity control. Warm-up is a ramp step for new mailboxes. Email throttling is the ongoing operating rule: cap sends per mailbox per day, ramp weekly, and pause automatically when negative signals appear.

Rotation

Send volume is distributed across domains and inboxes on purpose.
Each campaign knows which mailboxes it may use, so one bad list cannot drag down every inbox.
A small reserve of ramped mailboxes is ready to replace any that need rest.

Guardrails (non-negotiable)

Auto-pause when bounce rate on a domain or campaign rises. As a rule of thumb, investigate anything above 2% and pause well before it reaches 5%.
Auto-pause on spam complaint signals. Google’s sender guidelines ask senders to keep the spam rate reported in Postmaster Tools below 0.1% and never reach 0.3%.
Suppression lists are enforced globally, across every tool that sends.
If a domain fails a health check, pause it, fix the cause, and ramp again before it returns to production.

Layer 3: Data, routing and suppression

Verification

Every list is verified before sending, and re-verified if it is more than a few weeks old.
Role accounts (info@, sales@, support@) are filtered out unless you are deliberately testing them.
Catch-all and “unknown” results are treated as higher risk and sent in small batches, if at all.

Dedupe

Dedupe by email address across every active campaign.
Dedupe by account: if a conversation is already open at a company, do not start a new thread with their colleague.
Check the CRM before sending: no cold outreach to open deals, customers or partners.

Routing rules

Scale comes from rules, not volume. Write these down and enforce them in tooling:

Segment routing: which segment gets which play, from which mailboxes.
Title filters: exclude roles that cannot buy or influence the purchase.
Engagement history: anyone who said “not interested” or asked to stop is excluded, for every campaign, permanently or for an agreed cooling-off period.
List velocity: cap how many new contacts enter each campaign per day, so quality checks keep up.
Reply routing: positive replies reach the owning rep quickly, with the context of what they replied to.

Suppression

Hard bounces are suppressed permanently.
Spam complaints are suppressed immediately.
Opt-outs and unsubscribes are honored at once and synced across tools.
Suppression covers domains as well as emails where it matters (customers, partners, competitors).

Enrichment and signals

Match rates are measured on the segment you actually care about.
Enrichment runs through a repeatable pipeline, not one-off exports (see waterfall enrichment and lead enrichment).
You have a written definition of “signal” for each segment (see intent data).

Bad targeting and bad data create the same symptoms as deliverability problems. You cannot sequence your way out of bad data.

List decay policy

Lists are refreshed on a schedule.
Older lists are treated as higher risk and re-verified before use.

Layer 4: Messaging and automation

Messaging is not only about conversion. It is also a deliverability signal: irrelevant email gets ignored, deleted and reported.

Sequences avoid repetitive, identical copy across large volumes.
CTAs are specific (not a vague “let’s chat”).
Personalization comes from real signals, not decorative tokens.
A human approves copy before a new campaign sends.
Negative signals (complaints, bounces, negative replies) feed back into targeting and copy.

Layer 5: Tracking, attribution and measurement

Measure what matters

The primary metrics are positive replies, meetings booked and pipeline created.
Open rates are not used as a health metric. Apple Mail Privacy Protection and corporate security scanners make opens unreliable.
If you use click tracking, it runs on a custom tracking domain and is tested before you scale.

UTM standards

Every link in outbound uses UTMs.
Naming conventions are consistent and documented.

Example:

utm_source=outbound
utm_medium=email
utm_campaign=2026q1-icp1-signal1

Outcome tracking

Replies are logged in the CRM against the contact, the campaign and the date.
Meetings booked are attributed to campaign and lead.
Pipeline and revenue are attributed by source.

The goal is to answer these questions in minutes, not days:

How many people from last month’s campaign booked a call?
What did a meeting from that list cost?
Which message angle produced the most positive replies?
Which segments reply but never book, and why?

Where this lives depends on size: custom fields and reports in HubSpot, Salesforce or Attio work for most teams; a warehouse and dashboard make sense once you have several motions to compare.

Daily, weekly and monthly operating rhythm

Monitoring with a seed list

Do not wait for “reply rate feels low”. That is a lagging indicator. Set up seed-based monitoring (see seed list):

Seeds across Google, Microsoft and other providers your buyers use.
Multiple geographies if you sell internationally.
Consistent test sends, so results are comparable over time.

Negative signals to watch: a rising bounce rate, worse inbox placement, more spam complaints, and reply rate dropping across segments (not just one weak list).

Daily (5 minutes)

Check bounce rate per sending domain.
Check for auto-paused mailboxes or campaigns.
Confirm positive replies were routed and answered.

Weekly (30 minutes)

Verify SPF, DKIM and DMARC still pass on every sending domain.
Review spam rate in Google Postmaster Tools.
Review positive replies and meetings by campaign.
Pause or adjust campaigns that generate negative signals.

Monthly (60 minutes)

Run inbox placement tests across providers.
Ramp fresh domains and inboxes ahead of planned volume increases.
Audit routing rules, dedupe logic and suppression sync.

A first-week plan for an existing setup

If you already send outbound, start with an audit before building anything new.

Days 1 to 2: audit current state

List every domain and mailbox that sends outbound, and the tools they are connected to.
Check SPF, DKIM and DMARC on each.
Flag anything sending from the main domain or a subdomain of it.
Pull bounce rate, spam complaints and reply rate by domain and campaign.

Days 3 to 4: fix the foundation

Move cold sending to separate domains and start ramping new mailboxes.
Set daily caps and auto-pause rules.
Merge suppression lists across tools.

Days 5 to 7: wire up tracking

Add UTMs to every outbound link.
Make sure replies and meetings land in the CRM against the right campaign.
Write down routing rules and who owns the system.

New mailboxes still need their ramp, so plan for campaign volume to build over the following weeks.

Common failure modes (and the fix)

Sending from the brand domain or its subdomains: move cold email to separate sending domains.
Scaling volume before infrastructure: fixed by per-mailbox caps, ramp schedules and rotation.
No dedupe: the same person gets three emails from three campaigns in a week. Fixed by email and account-level dedupe, checked against the CRM.
Bad data: fixed by verification, list refreshes and suppression.
Fire and forget: fixed by auto-pause rules and the weekly checks above.
Optimizing the wrong metric: fixed by measuring positive replies, meetings and pipeline instead of opens.

Useful tools

Authentication and blocklists: MXToolbox, Google Admin Toolbox (Check MX)
Gmail reputation: Google Postmaster Tools
Inbox placement: seed tests from tools like GlockApps, or the placement tests built into senders such as Instantly and Smartlead
Dedupe and routing: native features in your sender and CRM, plus n8n or a small database when rules span several tools
Attribution: CRM reports in HubSpot, Salesforce or Attio; a warehouse once you outgrow them

Next steps

Start with cold email deliverability
See how we build the foundation in outbound infrastructure
For orchestration on top (data, routing, monitoring), see outbound automation
Choosing between doing it yourself and bringing in help? Read GTM Vector vs a DIY stack

Or book a free 30-minute strategy call and we will map the shortest route from your current stack to a clean operating model.

Outbound Infrastructure Checklist: Domains, Routing, Tracking, and Guardrails