Sending from a new domain: the checklist

A new sending domain has no reputation and no margin for a configuration mistake. Getting the setup right before the first message is cheaper than diagnosing it afterwards, when every failed send also costs you reputation.

This is the order that minimises waiting.

1. Decide the domain

Use a subdomain, not your root domain. send.yourcompany.com keeps bulk sending separate from the mail your colleagues write by hand, and gives the stream its own reputation and its own SPF budget. See why.

Register it long before you need it if you can. Domain age is a small positive signal and a brand-new registration is a small negative one.

2. Publish the forward records first

If you are sending from your own IP, publish the A record for the mail hostname before requesting reverse DNS. Providers validate the forward record before setting a PTR, and a failed request often caches a negative answer that makes the retry fail too.

3. Reverse DNS

A PTR on every sending IP, resolving to a hostname that resolves back to the same IP. Confirm both directions. Then make sure the HELO name your server announces is that same hostname.

If you are sending through a platform, this is theirs to get right — but worth confirming rather than assuming.

4. SPF

One record, under ten DNS lookups, ending in ~all while you confirm every legitimate sender is listed. Move to -all once you are sure.

Count the lookups with the SPF checker rather than by eye — includes nest, and the total is usually higher than it looks.

5. DKIM

2048-bit, published under a selector you can retire later. If your provider offers a CNAME instead of a TXT value, take it: it lets them rotate the key without you touching DNS again.

Verify the published key with the DKIM checker. The common failure is a value split across TXT strings with a space or newline inserted, which looks fine in a DNS panel and does not parse at a receiver.

6. DMARC

v=DMARC1; p=none; sp=reject; rua=mailto:dmarc@yourdomain

Start at p=none so nothing is enforced while you watch, but set sp=reject immediately — an unused subdomain has no legitimate mail to break and it closes the most common spoofing route from day one.

Point rua at something that parses XML. See the staged rollout for what comes next.

7. Confirm alignment, not just passing

Send one real message and check that SPF or DKIM authenticated against your domain, not your provider's. This is the step that gets skipped, and it is the one that fails silently for years.

The inbox tester reports what a receiver computed, which is the only authority on this.

8. Unsubscribe handling

For anything bulk: List-Unsubscribe and List-Unsubscribe-Post, working without a login, honoured within two days. A preference centre behind a sign-in does not satisfy the requirement.

9. Then warm up

Everything above is configuration and can be finished in a day. Reputation cannot. Start at tens of messages a day to your most engaged recipients and increase gradually — the warmup guide has the shape of the ramp.

A new domain that sends correctly configured mail at full volume on day one still lands in spam. Nothing is broken. It is new.