Most providers in this category sell you mailboxes and call it infrastructure. The actual job is harder. You need domains, DNS, authentication, mailboxes provisioned at the right ESP, IP warming, sub-account isolation per client, reputation monitoring across 50 blacklists, DMARC enforcement, and someone reachable when a Friday afternoon goes wrong. We do all of it under one roof, with the engineering team that has been running outbound at scale since 2008. From €499 per month for a small agency book, up to multi-region setups for agencies serving 200 clients.
In short
Cold outreach draws spam complaints and the occasional blacklist hit — that is the nature of mailing people who did not ask. If it runs on the domain that sends your invoices and password resets, that damage lands on the mail your business depends on. The fix is isolation: cold campaigns get their own domains, mailboxes and IPs, kept entirely separate from your primary domain. The diagram shows the split.
The isolation is visible in DNS: the outreach domains authenticate under their own records, while your primary domain's records are never touched by the cold-email setup:
# cold-email domains are isolated from your primary domain $ dig +short TXT outreach-brand-mail.com | grep spf "v=spf1 include:spf.osdomains.com -all" $ dig +short TXT _dmarc.outreach-brand-mail.com "v=DMARC1; p=reject; rua=mailto:[email protected]" # the primary business domain stays untouched: $ dig +short TXT yourbusiness.com | grep spf "v=spf1 include:_spf.google.com -all"
There are roughly thirty companies in 2026 selling something they call "cold email infrastructure". Most of them are doing one piece of the actual job. Mailforge sells you mailboxes on shared SMTP. Primeforge sells you Google Workspace and Microsoft 365 mailboxes with US IPs. Zapmail does the same with workspace isolation. Inframail sells flat-rate unlimited inboxes on dedicated IPs. Infraforge bundles dedicated IPs and DNS automation. The list goes on. Each of them is a fine product for what it is. None of them is a full infrastructure stack.
The actual job of running outbound for an agency book of clients involves at least seven moving parts. You need domains, ideally registered in bulk and on a registrar that does not flag bulk registrations. You need DNS, authoritative for those domains, with proper SPF, DKIM and DMARC at p=none transitioning to p=reject. You need mailboxes, either Google Workspace, Microsoft 365, or self-hosted IMAP/SMTP, and the choice depends on who your clients are targeting. You need an outbound SMTP layer with dedicated or pool-isolated IPs that have not been burned by other senders. You need IP warming, on a published curve, monitored against actual placement metrics. You need reputation monitoring across blacklists and feedback loops. And you need someone who can read aggregate DMARC reports when something goes sideways.
Buying these from seven different vendors is a mess. The handoffs leak: a domain registered at Namecheap with DNS at Cloudflare and mailboxes on Google and SMTP at Mailgun and warming at Warmbox and monitoring at GlockApps means seven dashboards, seven SLAs, seven invoices, and seven different support teams who blame each other when placement drops. Most agencies start this way because each piece is cheap and each piece is sold well. Two years in, the agency owner is spending Friday afternoons in vendor support tickets instead of running the agency.
The cleaner answer is one provider that runs the whole stack. Not because we are smarter than the specialists, but because the operational gain from having a single accountable team across all seven pieces is enormous. When placement drops, one investigation. When you onboard a new client, one provisioning workflow. When you need to scale from fifty to two hundred clients, one capacity conversation. Agencies that scale past a hundred client portfolios are usually the ones who consolidated infrastructure early.
That is what we sell. The full stack: domains, authoritative DNS, mailboxes (Google Workspace through us as a partner, Microsoft 365 the same way, or our own IMAP/SMTP for senders who want EU-jurisdiction inboxes), SMTP relay through our own MTA, IP warming managed against published curves, reputation monitoring across 50+ sources, DMARC monitoring and enforcement on a managed track, and sub-account isolation so each of your clients is a logically separate tenant with its own reputation footprint. One contract, one invoice in euros, one engineering team that knows your account.
And worth saying out loud: we are not the cheapest option in this category. The flat-rate-unlimited-inboxes providers will price-sell you for less per inbox. We are competing on the operational layer, the engineering team behind it, and the EU jurisdiction option that nobody else in this category offers. Agencies competing on price-per-client typically should not be our customer. Agencies competing on placement quality and client retention typically should.
Below is the full breakdown of what runs inside an agency-tier infrastructure account with us. Each layer is something you would otherwise buy separately. Bundling reduces the operational tax and the integration risk.
Domain registrar and bulk acquisition. We handle the registrations through partner registrars that do not flag bulk activity, so a hundred-domain provisioning batch does not trigger anti-fraud holds. Selection follows the patterns that work for outbound: variations on the client brand, .com and .co preferred, length kept reasonable. Optional auto-renewal on a per-batch basis. Domains can be transferred out at any time at no fee.
Every domain points at our authoritative DNS by default, with the right MX, SPF, DKIM and DMARC records published at provisioning time. The records are correct from minute one. No "wait 24 to 48 hours and check back". We manage the records continuously, so when a mailbox provider rotates its DKIM selectors, we keep up. You get DNS API access for custom records on top, as needed.
Three options depending on who your client is targeting. Google Workspace mailboxes through our partnership program at €4 to €5 per mailbox per month, with full admin access. Microsoft 365 mailboxes at €5 to €7 per mailbox, same model. Our own IMAP/SMTP mailboxes for clients who need EU-jurisdiction sending and receiving, at €3 per mailbox. The choice is per-client, sometimes mixed within a single client to maximize ESP matching with the recipient base.
For mailboxes that send through our SMTP relay (the IMAP option, plus optional SMTP override on Google or Microsoft for senders who want to bypass the daily limits), each client portfolio gets a sub-account with its own credentials, its own IPs, and its own reputation profile. When a client behaves badly, the rate limiting and reputation impact stays inside their sub-account. The other clients in your book are not affected. Architecturally isolated, not just logically tagged.
Every dedicated IP gets warmed on a 14 to 28 day curve depending on the volume profile. We monitor Postmaster Tools, SNDS, Sender Score and 50+ blacklists during warming. The curve adjusts dynamically based on observed reputation. If reputation softens, we hold the volume increase until it stabilizes. Progress is visible in the dashboard. For Google Workspace and Microsoft 365 mailboxes, warmup happens through our integrated warmup pool of around 4,000 actively-engaged inboxes that exchange real conversations.
Daily reputation pulls from Google Postmaster Tools, Microsoft SNDS, Validity Sender Score, Talos, plus checks against 50+ blacklists per IP. Placement testing weekly through GlockApps integration: send a probe campaign, measure inbox vs spam vs missing across 30 receiver mailboxes, get a per-receiver placement score. When something drops below threshold, you get an alert in Slack or email within an hour. This is the difference between knowing reputation tanked and knowing why.
For each client portfolio, we publish DMARC at p=none with reports flowing to our analysis infrastructure, parse the aggregate reports, identify failing sources, work them up to alignment, and walk policy from p=none through pct rollouts to p=reject over 8 to 12 weeks. The full Managed DMARC product (separate page) is included on Pro and Scale tiers. Most agencies do not realize how much placement they leave on the table by sitting at p=none indefinitely. The numbers are real and the difference shows up in client retention.
The choice of mailbox provider for a given client is not arbitrary. It depends on who the client is targeting and what receiver-side filters are most aggressive. We make this decision case by case, and the framework below is what we use during onboarding.
Best for
B2B targeting tech, SaaS, agencies, marketing, startups, anything where the recipient is statistically likely to be on Google Workspace too.
Why
Gmail-to-Gmail delivery has the cleanest spam filtering path because both endpoints are Google infrastructure and the receiver-side filter has perfect visibility into the sender side. ESP-matching effect is documented and meaningful — placement is typically 8 to 12 percentage points higher when sender and recipient are on the same provider versus crossed.
Limits
500 messages per day per Workspace user on standard plans, 2,000 per day on Workspace Plus. Daily limits enforced strictly. Sending volume above limits requires multiple mailboxes per client, which is the standard cold email pattern anyway.
Price
€4 to €5 per mailbox per month through our partnership
Best for
B2B targeting enterprise, financial services, healthcare, government, anything regulated. Roughly 60 to 70% of enterprise mailbox infrastructure runs on Microsoft 365 in 2026.
Why
Same ESP-matching effect as Google. Microsoft has tightened authentication requirements significantly through 2024 and 2025, and senders not aligned end up in Junk silently with no bounce. Our Microsoft 365 setup includes pre-validated SPF, DKIM, and DMARC alignment from minute one, which avoids the silent-junk problem most agencies hit.
Limits
300 to 500 messages per day per mailbox depending on tenant tier. Throttling is more aggressive than Google for new mailboxes — typically 30 messages per day for the first 14 days.
Price
€5 to €7 per mailbox per month through our partnership
Best for
Clients with EU jurisdiction requirements, regulated industries that need data residency proof, agencies whose clients have specifically asked about the data path. Also for clients targeting European receivers (Free.fr, GMX, ProtonMail, Strato) where our peering is stronger than US-based mailboxes.
Why
EU-only data path. The mailbox lives in Vienna, the SMTP send happens from EU IPs, the reception happens at EU IPs. No US infrastructure anywhere in the chain. For clients in finance, healthcare, public sector, this is the only workable option in a Schrems II world.
Limits
Configurable per mailbox — typical default is 200 messages per day, can be raised to 500 with proper warming. The limits are reputation-driven, not platform-imposed.
Price
€3 per mailbox per month, includes the underlying IMAP infrastructure
The pricing floor (€499 per month) filters out audiences below a certain operational maturity. The agencies that pass that filter usually look like one of the profiles below. If your operation does not fit any of them, the most honest thing we can say is that you are probably better served by one of the point-solution providers we mentioned earlier.
You have grown past the solo-operator stage and you have multiple clients on retainer. Each client has 3 to 5 sending domains and 3 to 5 mailboxes per domain. You are managing 100 to 500 mailboxes total. The point solutions you have been using do not scale operationally past this point — too many vendor handoffs, too much manual work per onboarding. The cost of consolidating to a single stack pays for itself in the engineering hours you stop losing to vendor coordination.
You have an SDR or sales team running outbound, not as the only growth channel but as a meaningful contributor. You graduated from "everybody sends from their @company.com address" because the deliverability problems became a real bottleneck. Now you have 20 to 100 outbound mailboxes on dedicated subdomains and you need someone competent operating the deliverability layer. We are that team.
Your clients are in finance, healthcare, legal, public sector, EU enterprise. Your prospects are correspondingly cautious about who handles their email infrastructure. Procurement asks about Cloud Act exposure. Audits flag US-based vendors as data residency concerns. The EU sovereign option is the only thing that gets you past the procurement gate, and most cold email infrastructure providers do not offer it. We do.
You started as a consultant, you have a methodology, and you are turning it into a recurring service. The infrastructure layer is the part you do not want to own — you want to focus on strategy and copy. White-label our stack on Pro and Scale tiers, brand the dashboard with your logo, and your clients see your name throughout. Common pattern with consultants who graduated to "growth as a service" offerings.
A pattern that has emerged in the last two years: PE firms acquiring two or three cold email agencies and merging the back-office. Multiple legacy infrastructure stacks have to be unified onto a single platform that scales. The migration is operationally painful, and the choice of target platform determines whether the merger thesis works. We have done two of these consolidations in the last year and we know what to expect.
Most cold email infrastructure providers in 2026 are companies that started between 2022 and 2024, built on top of cloud SaaS, and chose to focus on one piece of the stack. We are different in six specific ways that show up in operational behavior under load.
OS Domains GmbH is a Austrian entity, our infrastructure runs on EU sub-processors only, and our IMAP option keeps the entire mail path inside the EU. For clients in regulated industries who have flagged Schrems II concerns, this is the deciding factor. Mailforge, Primeforge, Zapmail, Inframail, Infraforge, Mailscale, MailDeck — all of them are US-headquartered with US-based mailbox infrastructure. The EU option closes deals these providers structurally cannot.
OS Domains has been operating email infrastructure since 2008. Most providers in this category were founded after 2022. The operational difference shows up in the boring stuff: how we handle a Spamhaus DBL listing event, how we coordinate cross-vendor escalations with Google Postmaster, how we read aggregate DMARC reports without confusing forwarding for spoofing. None of this is teachable in a year. It comes from running production for a long time.
Every client portfolio gets a sub-account at the SMTP layer. The isolation is queue-level in the MTA, not a soft tag in the database. When client A misbehaves — complaint spike, list quality issue, sudden volume change — only client A gets rate-limited and only client A's reputation is affected. Clients B through Z keep sending normally. The blast radius is structurally contained. Most providers in this category run a single shared pool and the bad-tenant problem propagates to everyone.
There is no first-line tier. When you open a ticket, a deliverability engineer reads it. Average first-response time on agency-tier tickets in 2025 was 24 minutes during business hours. The engineer who reads the ticket has root on the boxes, can read DMARC reports, knows what every PowerMTA parameter does, and has been doing this for several years. Other providers in this category route you through a tiered support structure where the first three responses are from someone reading a script.
Domains, DNS, mailboxes, SMTP relay, IP warming, reputation monitoring, DMARC enforcement. One contract, one invoice in euros, one technical account. Other providers in the category cover one or two layers and you bring your own for the rest. The operational tax of running seven vendors versus one is significant, and it does not show up on the price-per-inbox comparison everyone fixates on.
There is no €19 starter plan. There is no free tier. The minimum is €499 a month. This filters out the senders who would otherwise contaminate shared pools with scraped lists and high complaint rates. The result: when you join a shared pool with us (Starter tier), the other senders in the pool are paying enough that they take their reputation seriously. Most "cheap" cold email infrastructure providers solve the price problem by accepting bad senders into the pool. We solve the placement problem by excluding them.
Plans are €499 (Agency Starter), €1,499 (Agency Pro) and €3,499 (Agency Scale), plus custom Enterprise. Pricing is per-agency, not per-mailbox. The mailbox count and domain count caps reflect what each tier actually supports operationally. There is no per-seat or per-client surcharge — your team can be of any size, your clients can be of any number within the tier limits. Annual contracts save 15%.
Entry tier for small agencies serious about deliverability. Shared pool with paying senders only.
Live in 5 to 7 business days
Ideal for
Cold email agencies with 5 to 10 clients, in-house outbound teams at SaaS Series A, lead-gen consultancies stepping up from point solutions.
For mid-size agencies. Dedicated IPs, sub-account isolation per client, white-label option.
Live in 7 to 10 business days, dedicated IPs warmed in 21 days
Ideal for
Agencies with 20 to 50 client portfolios, B2B SaaS in-house outbound at Series B, regulated industry agencies needing EU jurisdiction option.
For large agencies. Multi-region, /28 IP block, dedicated account engineer in Slack.
Live in 10 to 15 business days
Ideal for
Agencies with 100 to 200 client portfolios, PE-backed roll-ups consolidating multiple agency stacks, mature outbound consultancies productizing their service.
Multi-region, multi-block, signed SLA, dedicated infrastructure team.
Onboarding 15 to 30 business days
Ideal for
Agencies past 200 client portfolios, holdco structures with multiple agency brands, infrastructure outsourcing for ESPs and lead-gen platforms.
Mailbox costs (Google Workspace at €4-5/mo, Microsoft 365 at €5-7/mo, our IMAP at €3/mo) are billed separately as passthrough — we do not mark them up. Domain registration at cost (typically €10-15/yr per .com). Above-quota volume on the Starter and Pro tiers is billed at €0.20 per 1,000 messages. Annual prepay saves 15%.
From signed contract to first send is 7 to 14 days. Onboarding an agency book is more involved than provisioning a single tenant because we have to set up the sub-account architecture, the per-client DNS, the per-client warming curves, and the white-label branding (where applicable). The phases below are what happens for a typical Pro-tier customer.
A 60-minute call with your operations lead. We map your current client book: how many clients, average mailbox count per client, domains per client, current vendor stack you are migrating from, any clients with special requirements (regulated industry, EU jurisdiction, multi-region). We propose target architecture and produce a migration runbook. NDA at this point. The discovery itself is no charge; we charge starting from day of provisioning.
For each existing client in your book, we create a sub-account at the SMTP layer with isolated reputation profile, allocate domains, and pre-configure DNS records. The mailbox provisioning happens in parallel — Google Workspace, Microsoft 365 or our IMAP, depending on what you specified during discovery. At the end of this phase, every client has its infrastructure ready but not yet sending production traffic.
For agencies on Pro tier with white-label enabled, the dashboard gets configured with your domain, your logo, your brand colors, your support email. Your clients see your branding throughout. We retain the technical account but the customer-facing surface is yours. Onboarding documentation gets re-themed for your brand.
Existing clients get migrated from their current providers, one cohort at a time. We run parallel sending for 48 hours per cohort to confirm metrics are stable. Once a cohort is confirmed clean, the cutover happens and the old provider goes into 14-day standby as rollback insurance. Cohorts are sized based on your operational capacity for managing client communications during the migration.
Dedicated IPs warm on the published curve. Reputation monitoring kicks in. Weekly placement testing across major receivers. After 21 days at full warmed reputation, the engagement transitions to steady state. Quarterly review with the deliverability engineering team to discuss anomalies, planned book growth, or migration of new clients onto the platform.
Three things matter. First: scope. Inframail and Infraforge sell mailboxes and dedicated IPs. We sell the full stack: domains, DNS, mailboxes, SMTP, warming, monitoring, DMARC. They cover one to two layers; we cover all of them. Second: jurisdiction. Inframail and Infraforge are US companies with US infrastructure. We are a Austrian GmbH with EU sub-processors only. For agencies with regulated-industry clients, that gap is structural. Third: operational maturity. Inframail launched in 2022. Infraforge launched in 2023. We have been operating MTAs since 2008. The boring operational stuff — how we handle Spamhaus listings, how we read DMARC forensic reports — comes from years of doing it. None of that is teachable in eighteen months.
Yes. The mailboxes we provision integrate with Instantly, Smartlead, Lemlist, Reply.io, Apollo, Salesforge, and any other sequencer that accepts standard SMTP credentials or IMAP/SMTP for inbox monitoring. We provide the credentials in the format each tool expects, including CSV export for bulk import. Most agencies keep their existing sequencer because that is where the team is trained. We are the infrastructure underneath.
For most use cases targeting US prospects, Google Workspace mailboxes deliver better placement at Gmail recipients because of ESP matching. The downside is daily limits (500 to 2,000 per mailbox per day depending on Workspace tier) and the data path goes through Google US infrastructure. Our IMAP option has lower hard limits per mailbox (typically 200 a day, scalable to 500 with proper warming) but the data stays in the EU end to end, and placement on European receivers (Free.fr, GMX, ProtonMail, Strato) is meaningfully better than US mailboxes. The choice is per-client based on the recipient profile. We run both for most agencies.
For Google Workspace and Microsoft 365 mailboxes, yes — we have a warmup pool of around 4,000 actively-engaged inboxes that exchange real conversations to seed reputation. New mailboxes provisioned through us go into the warmup pool automatically and are ready for production sending after 10 to 14 days. For our own IMAP mailboxes, the warming uses our dedicated IP infrastructure and follows a 14 to 28 day curve. Either way, you do not get a "fully warmed mailbox in 30 minutes" — that claim from some providers is marketing, not reality. Real warming takes time and the providers who claim instant warmup are using shortcuts that get caught by receiver filters within weeks.
Domains are registered in your name as registrant from day one — if we disappear tomorrow, you keep the domains. DNS can be transferred to any other provider in 24 to 48 hours. Mailboxes on Google Workspace and Microsoft 365 are owned by you (we are admin partner, not owner) and you can transfer the admin role any time. Mailboxes on our IMAP would need to be exported, which the API supports. The only piece that has lock-in is the reputation profile of dedicated IPs, which you cannot transfer to another provider — that is structural to how IP reputation works, not a contract trick. We are a profitable bootstrap company without VC pressure, so the disappearance scenario is unlikely, but the architecture lets you exit if it happens.
For HIPAA-adjacent clients, we recommend the IMAP option with EU-only data residency and a custom BAA addendum to the DPA. For financial services in the EU, the standard DPA covers most requirements; for clients under DORA or NIS2, we add specific incident-reporting clauses on the Pro and Scale tiers. We have agency clients serving banks and insurance customers, and the contractual structures are well-documented. The key constraint: cold email to consumers in regulated industries (B2C) is rarely legal under GDPR regardless of infrastructure. We will not work with agencies whose campaigns target B2C in the EU without proper opt-in.
Yes, on Pro and Scale tiers. White-label includes the dashboard hosted at your domain (relay.youragency.com), your branding throughout, your support email on system notifications, and a custom DPA structure where your clients sign with you and we are your sub-processor. We do not appear in any customer-facing surface. About 35% of Pro and Scale customers run white-label. The legal structure for sub-processor disclosures is well-documented and we work with your legal team during onboarding to get the contracts right.
In the EU, cold email to consumers is largely illegal under GDPR without prior opt-in. We do not work with agencies whose campaigns target EU consumers without proper opt-in basis. In the US, B2C cold email is technically legal under CAN-SPAM but is widely abused and the receiver-side filters are tuned aggressively against it. We accept legitimate B2B outbound, including outbound to small business owners (which can blur the B2C line). We do not accept consumer marketing dressed up as cold email. The AUP is short and we enforce it. We would rather lose the deal than lose the netblock.
You go to the next tier. The portfolio caps are operational caps — exceeding them means we have to allocate additional infrastructure regardless. There is no proportional pricing between tiers. If you are at 75 portfolios you go on Scale (€3,499/mo). If your book is growing fast, we recommend going to the higher tier proactively because the migration is operationally easier than scrambling after you exceed the cap. For agencies right at the boundary between tiers, we sometimes negotiate a custom intermediate plan; ask during the discovery call.
Fast and mostly automated. From the dashboard or via API: create new sub-account, allocate domains (we handle registration), specify mailbox provider per client, push warming start date. Provisioning takes 24 to 48 hours from request to first authenticated send for the new client. Domain registrations finalize in around an hour. Mailbox provisioning depends on the provider — Google Workspace partners through us provision in around 2 hours, Microsoft 365 takes 4 to 8 hours, our IMAP is instant. Warming for new dedicated IPs is the long pole at 14 to 21 days. Most agencies onboard 5 to 15 new clients per month at this cadence and the operational tax is roughly 30 minutes per onboarding.
No. We are infrastructure. Copy, list building, sequencing strategy, ICP research, all the strategic and creative work — those are not our domain and we are not pretending to be agencies ourselves. We have referral relationships with three or four agencies we trust, and we will introduce you if you ask. We are deliberately out of the strategy layer because going there would put us in competition with the agencies we serve, which is the wrong incentive structure.
Placement drops happen. The monitoring exists to catch them fast, not to prevent them entirely. When it happens, the workflow is: alert fires (typically within an hour of detection), our deliverability engineer investigates, we identify the cause (specific mailbox, specific list segment, specific receiver, specific complaint pattern), we propose a remediation, we execute it with you. Most placement events resolve within 48 to 72 hours. For events caused by your client behavior (bad list, aggressive copy, sudden volume change), the remediation involves working with the client. For events caused by infrastructure-side issues, we own the fix. The line between the two is usually clear from the data, and we will tell you which side a given event sits on directly. No blame-shifting.
It raises the floor. Google escalated to hard rejection of unauthenticated bulk mail in late 2025 and Microsoft moved the same way, so by 2026 a sending domain without aligned SPF, DKIM, and a DMARC policy is rejected outright rather than filtered to spam. Every domain we provision is authenticated to enforcement before it sends a single message, because an unauthenticated cold domain in 2026 does not underperform, it simply does not deliver. The lazy operations that skipped this work are the ones now reporting that cold email died, when what died was sending without authentication. The practical effect is that authentication moved from a deliverability optimization to a precondition for the domain functioning as a sending identity at all, which is the bar we build every cold domain to clear from its first message.
The discovery call is 60 minutes. We will look at your current setup, your client book, your placement metrics, and tell you whether we are the right fit. Half the discovery calls we run end with us recommending a different provider because the agency is below our minimum sensible scale. The other half end with a written architecture proposal and a migration runbook. Either way you walk away with something useful.
