Cold Email Warm-Up Kit

Everything needed to go from “no sending domain” to a first real cold send, so buying the domain is a same-day job instead of another project.

Updated 2026-07-31 · Staged only — nothing bought, nothing live, no DNS touched

1 The decision

Buy akashstpierre.com on Cloudflare Registrar today — about $11 for the year — and add one Google Workspace mailbox on it. First real cold email goes out Monday 24 August 2026.

What you're approvingCost
Domain, 1 year, Cloudflare Registrar at cost (WHOIS privacy included free)~$10.62
One new Google Workspace mailbox on that domain (Business Starter)$8.40/mo, or $7/mo on annual
Total to startUnder $20

Why 24 August and not sooner

  • A brand-new domain that starts emailing strangers on day two gets filtered. Age is itself a trust signal.
  • Buy today (Fri 31 Jul) → DNS and DKIM settle over the weekend → warm-up runs Mon 3 Aug through Fri 21 Aug → go/no-go Fri 21 Aug → first real send Mon 24 Aug.
  • That's 24 days of domain age and 15 sending days of warm-up. Three weeks is the honest minimum for a cold domain on Google Workspace.
  • Every day the domain isn't bought pushes 24 August back by one day. That is the entire cost of waiting.
Why we're not warming up stpierre.ai. The main domain runs your real mail — clients, Stripe, GHL, everything. Cold email generates spam complaints no matter how good the copy is. Once a domain's reputation drops, your ordinary business mail starts landing in junk too, and it takes months to recover. A separate $11 domain means the worst case is that you throw it away and buy another one.
Separate issue, worth knowing. Today's audit confirmed stpierre.ai publishes SPF only — no DKIM and no DMARC. That doesn't block this plan, but it does mean anyone can spoof your real address right now. Fixing it is a small, separate job that touches the live zone, so it needs its own go-ahead. It is not part of this kit and nothing here changes stpierre.ai.

2 Domain shortlist

All of these were checked by WHOIS on 2026-07-31. “Free” means the registry returned no match — strong, but the registrar checkout screen is the final word, and a few names carry premium pricing.

DomainStatusVerdict
akashstpierre.comFreeRecommended. Reads as a person, not a marketing shell. No hyphen, no bulk-mail keyword, .com.
getstpierre.comFreeBackup. Clean, short, easy to say on a call. Slightly “SaaS-y” prefix.
trystpierre.comFreeFine. Same shape as the backup; “try” is the more common cold-email prefix, so marginally more pattern-matched.
hellostpierre.comFreeFine but longer to type and to say aloud.
joinstpierre.comFreeWorks, but “join” implies a community/product you don't have.
stpierrehq.comFreeWorks. “HQ” reads a bit corporate for a one-man outbound motion.
stpierreleads.comFreeAvoid. “leads” in the sending domain is the single loudest bulk-mail signal, to filters and to contractors.
stpierre-ai.comFreeAvoid. A hyphenated near-clone of your real domain is the exact shape of a phishing domain.
stpierredigital.comFreeBanned by house rule — the company is stpierre.ai, never “St. Pierre Digital.”
stpierreai.comTakenRegistered elsewhere, expires 2027-07-11.
stpierre.co · stpierregroup.com · stpierre.email · trystpierre.co · stpierre.worksTakenAll registered. Listed so nobody re-checks them.

Why akashstpierre.com wins

  • It reads as a human. The emails are signed Akash St. Pierre. A contractor seeing that name in the address believes a person wrote it. Every other candidate reads as a company sending bulk.
  • No hyphen, no keyword. Hyphens and the words leads, mail, ads, offers all carry weight in spam scoring and in a contractor's gut read.
  • .com. Outlook and Hotmail are measurably harsher on new .co / .email / .io domains, and a lot of this list is on Outlook.
  • It isn't a spoof of stpierre.ai. A near-clone like stpierre-ai.com trips phishing heuristics precisely because it mimics a real domain. A personal-name domain doesn't.
  • It stays disposable. Reputation is tracked per domain. If this one gets burned, stpierre.ai never feels it, and you buy another for $11.

3 Setup runbook

Roughly 40 minutes end to end, most of it waiting for DNS. Steps 1–3 are the only ones that need a card or a password.

Step 1 — Buy the domain

  • 1Go to dash.cloudflare.com → Domain Registration → Register Domains.
  • 2Search akashstpierre.com. Confirm the price is the normal ~$10.44 plus the $0.18 ICANN fee — if it shows a premium price, take getstpierre.com instead.
  • 3Register it. Cloudflare creates the DNS zone and points its own nameservers automatically — there is nothing to configure afterwards.
  • 4Open the domain → Overview → right-hand column. Copy the Zone ID. The script in section 5 needs it.
  • 5Leave WHOIS privacy on. Cloudflare includes it free.

Step 2 — Give the domain something to show

A domain that resolves to nothing is a spam signal, and curious prospects do type it in. Cheapest fix is a redirect to the real site.

  • 1In the new domain → DNS → add an A record: name @, value 192.0.2.1, proxied (orange cloud). It's a placeholder IP; the proxy is what makes the redirect work.
  • 2Add the same as www, also proxied.
  • 3Rules → Redirect Rules → Create. If hostname is akashstpierre.com or www.akashstpierre.com → static redirect to https://stpierre.ai, status 301.

Step 3 — Add it to Google Workspace

Secondary domain, not a domain alias. The alias is free and it is the wrong choice here. An alias routes mail through the primary account, so the bounce address and often the signing domain stay on stpierre.ai — which means complaints and bounces land on the main domain's reputation. That is the exact thing we're spending $11 to prevent. Pay the seat.
  • 1admin.google.com → Account → Domains → Manage domains → Add a domain.
  • 2Choose Secondary domain. Not “Domain alias.”
  • 3Google gives a verification TXT (google-site-verification=…). Add it on the new zone in Cloudflare. Never on stpierre.ai.
  • 4Directory → Users → Add new user: akash@akashstpierre.com. Business Starter, $8.40/mo flexible or $7/mo on an annual commitment.
  • 5Sign in once. Set a real profile photo and a full signature: name, phone, company, and a physical mailing address — the address is legally required on commercial email.

Volume math: one mailbox safely carries about 30–40 cold emails a day at steady state. If you want more than that later, add a second mailbox and warm it separately — volume comes from more mailboxes, never from pushing one harder. A cheaper route exists (Zoho Mail is about $1/user/month) but it means a second admin console and no shared Workspace tooling; not worth the friction at one mailbox.

Step 4 — Generate the DKIM key

  • 1admin.google.com → Apps → Google Workspace → Gmail → Authenticate email.
  • 2Pick the new domain from the dropdown. It won't appear until step 3's verification has gone through.
  • 3Set DKIM key length to 2048. Leave the prefix selector as google.
  • 4Generate new record, then copy the entire TXT value (it starts v=DKIM1; k=rsa; p= and is very long).
  • 5Do not click “Start authentication” yet. Add the DNS record first, confirm it resolves, then come back and click it.

Step 5 — Add the DNS records

Either run the staged script in section 5, or paste the five records from section 4 into Cloudflare by hand. Both produce identical results.

Step 6 — Verify, then finish DKIM

Wait 15 minutes, then run these four checks. All four must return something.

Terminal — verification
dig +short MX  akashstpierre.com
dig +short TXT akashstpierre.com
dig +short TXT google._domainkey.akashstpierre.com
dig +short TXT _dmarc.akashstpierre.com

Once the DKIM line comes back, go back to Google Admin → Authenticate email → Start authentication. It can take up to 48 hours to flip to “Authenticating email.”

Step 7 — Turn on Postmaster Tools

postmaster.google.com → add akashstpierre.com → verify with the TXT it gives you (again, on the new zone). This is the only place you'll ever see your real Gmail spam-complaint rate. Do it on day one — it needs traffic history before the graphs mean anything.

4 The exact DNS records

Add all of these to the new domain's Cloudflare zone. Anything in amber is a placeholder you replace. TTL is Auto on everything; none of these are proxied.

TypeNamePurpose
MX@Where inbound mail goes (Google)
TXT@SPF — who may send as you
TXTgoogle._domainkeyDKIM — the cryptographic signature
TXT_dmarcDMARC — the policy and the reports
TXT@Google ownership check (keep it, don't delete after verifying)
1. MX — name @, priority 1
smtp.google.com

This is Google's current single-record setup. If your Admin console shows the five legacy ASPMX records instead, either set works — use the single one, it's fewer moving parts.

2. SPF — TXT at @
v=spf1 include:_spf.google.com ~all

Exactly one SPF record per domain, ever. Two SPF records is a hard fail, not a warning. If you later send through a tool, you add its include: to this record — you never add a second one.

3. DKIM — TXT at google._domainkey
v=DKIM1; k=rsa; p=<<PASTE THE WHOLE VALUE FROM GOOGLE ADMIN>>

Google gives you this in step 4 of the runbook. It's about 400 characters — copy all of it, no line breaks, no spaces added.

4. DMARC — TXT at _dmarc
v=DMARC1; p=none; rua=mailto:dmarc@akashstpierre.com; fo=1; adkim=r; aspf=r; pct=100

In plain English: p=none means “don't block anything yet, just mail me a daily report of who's sending as me.” That's what you want for the first two weeks — you're watching, not enforcing. rua is where the reports land. Create dmarc@akashstpierre.com as a free alias on the new mailbox so the reports arrive somewhere.

Don't point the reports at stpierre.ai. Sending DMARC reports to an address on a different domain requires that domain to publish an authorisation record — in this case akashstpierre.com._report._dmarc.stpierre.ai. That is a change to the live main zone, and it is out of scope here. Keeping rua on the new domain needs nothing extra. If you'd rather have readable weekly summaries than raw XML, Postmark's free DMARC digest service publishes the authorisation on their side, so it also needs no change to stpierre.ai.
5. Google ownership — TXT at @
google-site-verification=<<VALUE GOOGLE GIVES YOU>>

Tightening DMARC later

  • Day 1–14: p=none. Read the reports. You're looking for 100% pass and no sender you don't recognise.
  • After 14 clean days: change to p=quarantine; pct=100.
  • After ~30 days: p=reject. Do this before you scale volume — Google and Yahoo now expect bulk senders to have it.

5 The staged script

Written, syntax-checked, and not run. It adds all five records above through the Cloudflare API so the DNS step is one command instead of five forms.

Location
/Users/akash/Documents/Claude/_scratch/deliverables/2026-07-31/cold-email-kit/add_sending_dns.py

What keeps it safe

  • No secrets in the file. The Cloudflare token is pulled from the brain vault at run time (cloudflare / stpierre / full-account) — the same row the docs deployer uses.
  • Dry run by default. It prints the plan and changes nothing unless you add --apply.
  • Live zones are hard-blocked. Pass stpierre.ai or any of its subdomains and it refuses and exits, even with --apply. Verified.
  • Re-running is safe. Existing records are skipped unless you explicitly pass --replace.
  • It sanity-checks the DKIM value and warns you if the DMARC report address sits on another domain.
Dry run (safe, shows exactly what it would create)
python3 /Users/akash/Documents/Claude/_scratch/deliverables/2026-07-31/cold-email-kit/add_sending_dns.py \
  --domain akashstpierre.com \
  --zone-id <<ZONE ID FROM THE CLOUDFLARE OVERVIEW PAGE>> \
  --dkim-value "<<THE FULL v=DKIM1 VALUE FROM GOOGLE ADMIN>>"
For real — same command, plus --apply
python3 .../add_sending_dns.py \
  --domain akashstpierre.com \
  --zone-id <<ZONE ID>> \
  --dkim-value "<<v=DKIM1; k=rsa; p=...>>" \
  --apply

Optional flags: --site-verification "google-site-verification=..." adds Google's ownership TXT in the same pass. --dmarc-rua overrides the report address (defaults to dmarc@<your domain>).

6 Warm-up, weeks 1–3

Warm-up is one thing: teaching Gmail, Outlook and Yahoo that mail from this domain gets opened and replied to. Volume is the least important part. Replies are the whole game.

Before you start, line up 8–10 friendly addresses. Your own personal Gmail, an Outlook or Hotmail account, a Yahoo account, an iCloud account, Collins, and a few clients or friends who will actually reply. Ask them once, up front: “For the next three weeks I'll send you short real emails. Reply with a sentence, and if anything lands in Promotions or Spam, drag it to the main inbox.” That single favour is worth more than any paid tool.
DaysSends/dayWho toWhat matters
Sat 1 – Sun 2 Aug0—DNS and DKIM settling. Sign in to the mailbox, set the photo and signature. Send 2–3 ordinary emails to yourself and to one friendly address. Nothing else.
Mon 3 – Tue 45100% friendlyPlain text only. Real subjects, real sentences, no links, no images, no signature logo. Every one must get a reply.
Wed 5 – Thu 68–10100% friendlyReply to their replies. A back-and-forth thread is a stronger signal than two separate emails.
Fri 7 Aug12100% friendlyEnd of week 1. Check nothing has landed in Spam for anyone. If it has, stop and diagnose before week 2.
Sat 8 – Sun 92–3friendlyWeekends: a couple of casual sends keeps the pattern human. Never prospects on a weekend.
Mon 10 – Tue 1115~80% friendlyIntroduce a handful of real, verified prospects. Plain text, no links at all, one short paragraph plus a question.
Wed 12 – Thu 1320–25~60% friendlyWatch bounces obsessively. Any hard bounce means the list wasn't verified — fix the list, don't push through it.
Fri 14 Aug25~50% friendlyEnd of week 2. Postmaster Tools should now be showing data. Domain reputation must read Medium or High.
Sat 15 – Sun 162–3friendlySame as last weekend.
Mon 17 – Tue 1830~40% friendlyNow add one link — the demo bot or the dashboard — to no more than a third of the sends.
Wed 19 – Thu 2035–40~30% friendlyThis is roughly your steady-state ceiling for one mailbox. Don't test past it.
Fri 21 Aug40~25% friendlyLast warm-up day. Run the full go/no-go in section 7.
Mon 24 Aug30–40real prospectsFirst real cold send, assuming every box in section 7 is ticked.

Rules that hold for all three weeks

  • Never increase by more than ~30% over the previous day. A jump is the clearest bot signature there is.
  • Plain text. No HTML template, no tracking pixel, no image signature, no unsubscribe button. The sequence's plain “reply STOP and I'll never email you again” line is exactly right — keep it as text.
  • Spread the sends across business hours with uneven gaps. Thirty emails at 9:00:00 is a machine; thirty across 8am–4pm is a person.
  • Reply rate above 30% through weeks 1 and 2. If it drops, cut volume and get more friendlies replying — don't push on.
  • Any spam-folder landing stops the schedule. Diagnose before adding volume. Adding volume on top of a deliverability problem is how domains die.
  • Verify the prospect list before a single real address goes in (NeverBounce, ZeroBounce or MillionVerifier, roughly $10–20 for a few thousand). Bounces do more damage than bad copy.
Open question for Akash: automated warm-up tools. Warmbox, Mailreach and the warm-up built into Instantly or Smartlead (roughly $25–50/month) send to a private peer network and auto-reply, which does the above without you touching it. They also automate sending — and the standing rule is that automated sends stay off. Warming to a peer network isn't prospect outbound, so it arguably falls outside that rule, but it's your call, not mine. Default assumption is the manual path above, which costs nothing and works. Say the word if you'd rather buy the tool.

7 Go / no-go checklist

Run this on Friday 21 August. Every line has to pass. One failure moves the first send — it doesn't get waived.

Authentication

  • Send one email to a Gmail address, open Show original, and confirm three words: SPF: PASS, DKIM: PASS, DMARC: PASS.
  • Google Admin → Authenticate email shows “Authenticating email with DKIM” for the new domain.
  • Exactly one SPF record on the domain. Not two.

Deliverability tests

  • mail-tester.com scores 9/10 or 10/10. Run it three times across three different days — one good score is luck.
  • Manual inbox placement test: send the real first-touch email to your own Gmail, Outlook/Hotmail, Yahoo, and iCloud accounts. All four land in the inbox — Promotions counts as a fail for Gmail.
  • Blacklist check clean on MXToolbox and Spamhaus for both the domain and the sending IP.

Reputation

  • Google Postmaster Tools shows domain reputation Medium or High. Low or Bad is an automatic stop.
  • Spam complaint rate under 0.1% in Postmaster.
  • Seven consecutive days of DMARC reports showing 100% pass and no sending source you don't recognise.
  • Warm-up bounce rate under 2%. Above 3% means stop and re-verify the list.

Domain and list

  • Domain is at least 21 days old (24 days on this schedule — passes).
  • The domain resolves — the redirect to stpierre.ai works in a browser.
  • Prospect list run through a verifier, under 2% unknown/risky, all catch-alls removed.
  • Signature carries name, phone, company and a physical mailing address; the plain-text opt-out line is in every email and STOP replies get honoured same day.
Day-one discipline on the real send. Even after a clean go, day one is 30–40, not 200. Watch replies and bounces for 48 hours before increasing anything. If Postmaster reputation drops a band at any point in the first fortnight, cut volume in half the same day rather than waiting to see if it recovers.

8 Akash's 5-minute list

Today, in this order. Everything after this is on the calendar above.

  • 1Buy akashstpierre.com on Cloudflare Registrar (~$11/yr). If it prices as premium, take getstpierre.com. ~2 min
  • 2Copy the Zone ID from the domain's Overview page and paste it to me. ~30 sec
  • 3Add it to Google Workspace as a Secondary domain (admin.google.com → Domains → Add a domain). Not a domain alias. ~1 min
  • 4Create the user akash@akashstpierre.com, Business Starter. ~1 min
  • 5Generate the DKIM key (Apps → Gmail → Authenticate email → 2048-bit → Generate) and paste me the value. Don't click Start authentication. ~1 min

With the Zone ID, the DKIM value and the Google verification string, I run the staged script and every DNS record is in place inside a minute. Then it's the weekend, and warm-up starts Monday 3 August.

The two things I can't do for you: the purchase and the Google account changes. Both need your card or your password, so both stay yours.

9 What this does not do

  • Nothing was bought. No domain registered, no Workspace seat added.
  • No DNS was changed anywhere. stpierre.ai was read only — today's check confirmed SPF present, DKIM absent, DMARC absent, Google MX in place. Not one record was touched.
  • No email was sent and no account was created.
  • Nothing here un-parks automated sending. The standing rule stands: automated sends stay off, outbound is hand-run. This kit only builds the runway.

Decisions still open

  • Automated warm-up tool, yes or no (section 6). Default is the free manual path.
  • How the real sends actually go out. Thirty a day by hand is real work. A mail-merge or a sending tool makes it trivial but is automated sending — which needs your explicit go-ahead, not my assumption.
  • Fixing DKIM and DMARC on stpierre.ai itself. Separate job, touches the live zone, protects your real mail from spoofing. Worth doing, needs its own go.
  • DMARC report readability. Raw XML to dmarc@ the new domain by default, or a free Postmark digest for plain-English weekly summaries.

Sources checked while building this: WHOIS on 14 candidate domains (2026-07-31), live DNS on stpierre.ai, the three-email proof sequence in _scratch/deliverables/2026-07-31/outbound-launch/, and Outbound Playbook v4. Nothing here contradicts v4 — it removes the blocker v4 names.