Your prospect thinks your sending domain is phishing: does cold email from a different domain look suspicious?

Sunny Ray · Feb 4, 2026 · 6 min read

Nobody checks your SPF record. They check whether the email sounds like you and asks for something reasonable. Get those two right and a secondary sending domain stops looking suspicious.

Every serious cold email setup sends from domains that are not your main one. You protect the company domain, you spread volume, you keep one bad week from burning the address your customers use. Deliverability people treat this as settled. Prospects never got the memo. Some of them see an unfamiliar domain and think one word: phishing.

"Is this really Sunny?"

On February 4 I joined Charles on a call with a founder who runs a Bitcoin business and is looking to sell it. He has been in Bitcoin almost as long as I have. My own outreach had reached him from one of our secondary domains, and he admitted that his first reaction was doubt. Was this really me? He told us why:

Because the domain's weird. Like, I always check domain.

He went on to say that people in his industry are hyper-aware of phishing and fraud, and most of what lands from strange domains is spam. Only his gut told him the email was real. Then he asked the question that mattered for his deal: if we ran outreach to potential buyers for him, how would they know it was him?

That is the right question. It is also the one most cold email advice skips, because it is about people rather than infrastructure.

What prospects check

A suspicious prospect runs a fast, informal test. It has two steps.

First, the domain. Does it look like a real company's name or a variant of it? Or does it look like a random string? FullEnrich makes the point in its guide to cold email domains: hyphens and numbers, something like acme-corp-1.com, look like a phishing domain. A close brand variant reads as legitimate.

Second, the voice. Does this sound like a person who would write to me? Does it know something true about me? Is the ask proportionate? Phishing emails have a tell: they rush you toward a link. A real person asks a question.

Notice what is missing from that list. Nobody opens the headers. Nobody looks up DMARC. Authentication matters enormously, but for the inbox provider, not for the human.

The setup underneath

For the record, the infrastructure we described on that call: five domains, twelve mailboxes per domain, each domain authenticated with SPF, DKIM and DMARC, and every reply filtered into one inbox. That is the part that gets you delivered. It has nothing to do with whether a reader trusts you once the email arrives.

Spam filters and suspicious humans are looking for many of the same signals. Links, images, urgency, generic copy. The technical rules and the psychological ones overlap, which is why fixing one usually helps the other.

Five things that make a secondary domain trustworthy

Here is what we walked him through.

• Name the domain like your brand. A close variant of the company name, no hyphens, no numbers, no random suffixes.
• Redirect it to the main site. Anyone who types the sending domain into a browser should land on your real company website. That single step answers "is this real?" for most people who bother to check.
• Write in the sender's own voice. If the founder writes short and blunt, the emails go out short and blunt. A generic marketing voice from an unfamiliar domain is the exact pattern people have learned to distrust.
• Make a relevant offer. An email that knows why it is writing to this specific person reads like correspondence, not a blast.
• Ask permission before you send a link.

"Can I send you the link?"

That last one carries most of the weight. Charles's rule for a first email is no links and no images at all. If there is something to share, a calendar, a deck, a video, you ask first. On the call it came out like this:

Can I send you the link? It's simple.

Phishing needs you to click. An email that offers to send a link only if you want it has removed the one thing a scammer cannot do without. It also lifts reply rates, because "yes, send it" is the easiest reply anyone can write, and a reply is worth more to your sending reputation than a click.

So the permission ask does three jobs at once. It keeps the first email clean for the filters, it signals to a suspicious reader that you are not trying to trick them, and it turns curiosity into a conversation.

When a separate domain hurts

To be fair to the other side: some people think separate cold email domains are a mistake. Interseller's help docs take the minority view that using different domains does not help reply rates. I disagree for anyone sending at volume, because the risk to your main domain is real. But the instinct behind that view is right in one case.

If you are sending a handful of emails a week to people who already know you, use your real address. Warm outreach does not need protection, and an unfamiliar domain can only cost you trust there. Secondary domains are for volume, for strangers, and for protecting the address your customers and investors rely on.

What this means for a sale or a raise

The founder's worry was specific to selling his company, and it applies to fundraising too. Buyers and investors are the most suspicious readers you will ever email, because they are pitched constantly and some of those pitches are scams. Everything above matters double for them. Brand-like domain, redirect, your voice, a reason you picked them, and a question instead of a link.

Do that and the domain fades into the background. The reader stops asking whether the email is real and starts asking whether the offer is interesting, which is the question you wanted them asking all along.

If you want the domains, redirects and voice set up properly, see how sending domains are set up.

Frequently asked questions