Cold Email Infrastructure: Google Workspace, Microsoft 365 or an SMTP Provider

Before the copy, before the list, there is a decision most people make by accident: what you send from. Get it wrong and no amount of good writing helps, because the messages are either rejected, filtered, or the account is closed under a policy you never read.

There are three viable setups and one very common mistake. This is how they differ and which to pick.

The mistake first: transactional providers are not for this#

SendGrid, Mailgun, Postmark, Amazon SES and their equivalents are excellent at what they are built for — password resets, receipts, notifications. Their acceptable use policies almost universally prohibit unsolicited commercial email, and several prohibit cold outreach explicitly regardless of legality.

That is not a formality. These providers police it, because their entire business rests on shared reputation: your cold campaign degrades the deliverability of every other customer on that infrastructure. The typical enforcement path is a warning, then suspension, then a permanent ban on the account and the domain.

There is also a technical reason it fails even when it is allowed. Bulk platforms send from shared pools with headers that mark the mail as bulk. Cold outreach is supposed to look like one person writing to another. A message with bulk-platform tracking headers, a shared IP and a link-wrapping domain does not.

Rule: transactional and marketing platforms for mail people asked for. Real mailboxes for mail they did not.

The three setups that work#

1. Google Workspace mailboxes#

The default, and for good reason. You send from a genuine Gmail-backed mailbox on your own domain, through a provider with excellent reputation infrastructure.

Good: best-in-class deliverability to Gmail recipients, straightforward DKIM setup, and a real inbox for the replies — which matters more than people expect, because a campaign generating replies into a black hole is worthless.

Watch: Workspace has generous published daily limits, but those limits are irrelevant to cold email. The binding constraint is reputation, and the safe operating figure for cold outreach is far lower — 30 to 50 a day per mailbox once warmed, and less at the start. Google also suspends accounts for spam complaints, and appeals are slow and impersonal.

2. Microsoft 365 mailboxes#

Comparable setup, different strengths.

Good: if your recipients are corporate — professional services, manufacturing, anything that runs on Outlook — sending from Microsoft infrastructure to Microsoft infrastructure has a measurable placement advantage. Its per-day recipient allowance is high.

Watch: Microsoft's filtering of inbound mail is stricter than Google's, which is a different problem and a big one — a large share of "no replies at all" campaigns to corporate recipients are landing in an Outlook quarantine nobody checks. Microsoft is also more aggressive about throttling unfamiliar senders, so warm-up matters more.

3. A dedicated cold-outreach platform on top of your own mailboxes#

Instantly, Smartlead, Lemlist and similar tools do not send for you in the bulk sense. They connect to mailboxes you own — Google, Microsoft, or any SMTP/IMAP account — and orchestrate sequencing, rotation between inboxes, warm-up traffic and reply detection.

Good: inbox rotation, automatic pausing when a mailbox misbehaves, warm-up built in, and unified reply handling across many mailboxes. Above roughly two hundred sends a day this stops being a luxury.

Watch: it multiplies whatever you feed it. A tool sending an unverified list across eight mailboxes burns eight domains instead of one.

Domains: the decision that saves your business#

Three rules, and the first is not negotiable.

Never send cold outreach from your primary domain. If yourcompany.com carries your invoices, your support and your customer conversations, a reputation problem there is not a marketing setback — it is your business email going down. Buy a separate domain for outreach: yourcompanyhq.com, getyourcompany.com, yourcompany.co.

Set the outreach domain up as a real website. Redirect it to your main site or put a genuine one-page site on it. A domain whose only observable behaviour is sending mail to strangers looks exactly like what it is.

Subdomain or separate domain? A subdomain (mail.yourcompany.com) inherits some of the parent's history, which cuts both ways: a reputation problem on the subdomain can bleed upward. For cold outreach specifically, a separate registrable domain is the safer choice, because isolation is the entire point.

Age matters too. A domain registered yesterday is a suspicious sender for weeks whatever you do. Buying the outreach domain a month or two before you need it is the cheapest deliverability improvement available.

Mailboxes: aliases are not inboxes#

A recurring error: creating five aliases on one mailbox and treating them as five senders.

Aliases share the underlying mailbox and, for reputation purposes, are largely one sender. They do not multiply your safe volume; they multiply the number of addresses one reputation problem attaches to. Real, separately-licensed mailboxes do give you separate capacity — at the cost of a licence each.

A workable shape for a small team:

Domain	Mailboxes	Daily send target
outreachdomain.com	you@, firstname@	40 each after warm-up
seconddomain.com	you@, firstname@	40 each after warm-up

That is about 160 a day from four licences — roughly 3,000 well-targeted contacts a month, which is more than most small businesses can follow up on properly anyway.

Use real names. sales@ and noreply@ are recognisably not a person, and role addresses attract filtering.

The DNS that has to be right before anything else#

Non-negotiable, on every sending domain:

• SPF — a TXT record listing who may send as your domain. Must include your sending provider. Note the ten-lookup limit: chaining several include: statements silently breaks SPF entirely, and nothing tells you.
• DKIM — the cryptographic signature. Your provider gives you the record.
• DMARC — the policy that tells receivers what to do on failure, and where to send reports. Start at p=none to observe, then tighten.

Then two more that people skip:

• Reverse DNS / PTR, if you send from your own server. Providers check it and mail from an IP with no reverse record is deeply suspect.
• MX records on the sending domain. A domain that sends but cannot receive is a strong bulk signal — and it also means you never see the replies.

The step-by-step is in the deliverability guide. Nothing else in this article matters if these are wrong.

The bulk-sender rules everyone is now subject to#

Google and Yahoo tightened their requirements for bulk senders, and while the strictest tier applies at roughly 5,000 messages a day to their users, the substance is now effectively the baseline for everyone:

• Authenticate properly — SPF and DKIM aligned, with DMARC published.
• Offer one-click unsubscribe and process it within a couple of days.
• Keep spam complaints below about 0.3%, which is three complaints per thousand — a genuinely low bar that a badly targeted list clears easily in the wrong direction.

That last figure is the one to internalise. It is a targeting constraint, not a copy constraint. Complaints come from people who cannot see why they were contacted, which is a list problem, and the fix is upstream in the profile.

Tracking pixels and link wrapping#

Open tracking works by embedding a one-pixel image on a tracking domain. Click tracking rewrites your links through the same domain. Both have costs:

• The tracking domain is shared with other customers on most platforms, and its reputation is not yours to control.
• Rewritten links are a classic phishing pattern; some corporate filters treat them as such.
• Open tracking has been unreliable since mail providers began pre-fetching images, so a good part of what you measure is a proxy, not a human.

For cold outreach, the trade is usually not worth it. Turn off open tracking, turn off link wrapping, and measure replies — which is the only number that was ever going to tell you anything.

A setup checklist#

1. Register an outreach domain, separate from your main one, ideally a few weeks early.
2. Point it at a real page.
3. Create two real mailboxes on it with human names.
4. Publish SPF, DKIM and DMARC. Confirm SPF stays under ten lookups. Add MX.
5. Warm up for three to four weeks — a handful of messages a day, rising gradually, with genuine replies.
6. Turn off open and click tracking.
7. Verify the list before the first send; check what "verified" means in whatever tool you use — the verification guide sets out what a real check involves.
8. Send the first hundred, stop, read the bounces. Hard bounces above 5% mean stop, not slow down.
9. Hold at 30–50 per mailbox per day. Add mailboxes for volume, not sends per mailbox.
10. Watch the DMARC reports for the first month. They are the only place several failure modes surface at all.

FAQ#

Can I use SendGrid or Mailgun for cold email?#

Their acceptable use policies prohibit unsolicited commercial email, and they enforce it with suspension. They are built for mail recipients asked for. Cold outreach should go from real mailboxes on a domain you control.

Should I send cold email from my main domain?#

No. A reputation problem on the domain that carries your invoices and support takes your operating email down with it. Use a separate domain that redirects to your main site, and keep the two entirely apart.

How many cold emails can I send per day per mailbox?#

Regardless of the provider's published limit, treat 30–50 a day per mailbox as the working ceiling for cold outreach after a three to four week warm-up, and start far lower. For more volume, add mailboxes and domains rather than raising the per-mailbox figure.

Is Google Workspace or Microsoft 365 better for cold email?#

Google generally has the edge for reaching Gmail recipients and is simpler to configure. Microsoft has an advantage when your recipients are corporate Outlook users. If your list is mostly small businesses, Google; mostly corporate, Microsoft. Many senders run both and split the list.

Do aliases count as separate mailboxes?#

Not for reputation. Aliases share the underlying mailbox and do not increase your safe sending volume — they only spread one reputation across more addresses. Separately licensed mailboxes give real additional capacity.

Should I use open tracking?#

For cold outreach, generally no. The tracking domain's reputation is usually shared, rewritten links resemble phishing to some filters, and image pre-fetching has made open data unreliable. Measure replies instead.