When a campaign stalls, the cause isn't always in the DNS
Jacob Morgan, founder of Pinniqal, has seen cold email campaigns fail for reasons that don't show up in the usual diagnostics. One lead generation client's mail to companies on Microsoft 365 stalled, with many messages coming back deferred as "received as unauthenticated." That error typically points to a broken SPF or DKIM record, but Morgan said "We checked the records on every sending domain and they were all right."
The real issue was the sending IPs. Microsoft throttled them first, then banned them outright. Third-party blocklists like Spamhaus, Barracuda, and SpamCop showed the IPs as clean. Microsoft maintains its own internal list. Morgan's team found the problem by connecting to one of Microsoft's mail servers and reading the refusal directly. The IPs were new, and his best guess is they sent too much through them too soon. Microsoft doesn't disclose the reason.
His practical takeaway: "If mail to Microsoft stalls, read their refusal before you touch your DNS." Since a large share of B2B mail runs through Microsoft 365, a block there can hurt broadly.
Main domain versus side domains: the trade-off most articles skip
When companies weigh running cold email from their main domain versus new domains set up for them, Morgan points out a risk that often goes unmentioned. "Your main domain carries everything your company sends," he said. Invoices, support replies, and daily team mail all ride on it. Cold email draws spam complaints, and if Gmail or Microsoft starts filtering the main domain, everyday mail can land in spam too.
Side domains like yourcompany.co keep that risk away from the primary domain, but they start with no reputation. New inboxes warm up for about a month, then volume ramps up as long as mail keeps landing.
What gets left out, according to Morgan, is that prospects look at the side domain. Some will type it into a browser to see who you are. One client had side domains forwarding to their site over plain HTTP only, so anyone opening the HTTPS version got a browser error. Each side domain needs a working redirect to your site, plus its own SPF, DKIM, and DMARC records. These are standard email authentication protocols, but they are easy to overlook when setting up new domains.
What buyers decide too quickly when picking a managed service
The first quick call is about domain ownership. Morgan explained Pinniqal's approach: "We hold them for the first 3 months. That's our minimum term. After that they move to you free with their inboxes once the account is paid up. The servers and IPs stay with us." He advises getting a service's terms in the contract before signing. "If you can't take the domains with you, you start over. That means new domains and another month of warmup."
The second quick call is trusting the word "verified." An address listed on a company's own website is a good starting point, but people leave and pages don't get updated. Morgan shared a test: "We once re-checked 114 addresses we'd found on company websites and never tested. Only 33 passed a live check with the receiving server. Nearly half were mailboxes that no longer existed." Addresses in the same batch that had already been checked live held up, with all but 2 of 30 passing again.
His advice is to ask how a provider verifies addresses and how recently. For teams evaluating managed cold email, the details that matter most—IP reputation, domain ownership, and verification recency—are often the ones that don't make it into the sales pitch.