WinnowedProspects, not padding.
◆ The setup walkthrough

Every click, from nothing to a running campaign

The six-step guide covers the decisions. This one covers the clicks: which button, which field, what to type in it. Roughly two hours of work spread across five weeks, because four of those weeks are spent waiting on purpose.

About the tools named here

This walkthrough names the stack we use ourselves (Google Workspace for mailboxes, Cloudflare for DNS, Instantly for sending) because a guide that says "your email platform" cannot tell you which checkbox is wrong.

None of it is an endorsement and nothing is sponsored. Microsoft 365, any registrar's DNS panel, and Smartlead or Lemlist all work the same way. The record values and the principles are identical everywhere; only the menus move. Written September 2026. Interfaces drift, so trust the intent over the exact wording.

PART 01: 15 MINUTES

Buy the sending domain

A domain bought for this purpose, kept separate from the one your invoices go out on. If it ever burns, you throw it away rather than repair it.

  1. Pick a name close to your real one. If you are brightwave.co.uk, buy brightwavehq.co.uk, getbrightwave.co.uk or brightwave-group.com. The reader should recognise it as you.
    • Avoid numbers, and avoid more than one hyphen: both read as disposable
    • .com and .co.uk are equally fine. Avoid the cheap new endings
    • Do not buy a domain that has been registered before. Check its history first, because you inherit whatever the last owner did with it
  2. Buy it from any registrar. It does not matter which. You will move the nameservers in part 03 anyway.
  3. Put a real page on it. One page is enough: who you are, what you do, a contact address.
    • A redirect to your main site is not enough. A domain that only redirects looks exactly like a throwaway, because usually it is
  4. Point the nameservers at Cloudflare. Add the domain in Cloudflare, take the two nameservers it gives you, and set them at the registrar. Propagation is usually minutes.
Buy it now, even if you are not ready

Domain age is a real deliverability factor and it is the one thing you cannot buy later. A six-week-old domain collects rejections that an identical, correctly configured two-year-old domain does not. We have watched exactly that happen on a technically perfect setup.

If a campaign is anywhere on your horizon, buy the domain today. It is a few pounds a year and it is the cheapest deliverability improvement available.

Done when
  • Domain bought, never previously registered
  • A real page on it, not a redirect
  • Nameservers pointing at Cloudflare
PART 02: 30 MINUTES

Create the mailboxes

Three of them, not one. Volume comes from more mailboxes sending a little, never from one mailbox sending a lot.

  1. Sign up for Google Workspace using the new domain. Choose the entry business tier. The cheapest one is enough; you are not using Drive or Meet.
  2. Create three users. Our own pattern, which works:
    • yourname@: a real person, and the one most replies come to
    • outreach@
    • team@
    Each user needs its own licence. Aliases will not do: an alias is not a separate sending identity and the platform cannot rotate across them.
  3. Set a real name and signature on each. A mailbox with no display name is a flag.
  4. Log into each one once through the web interface. A mailbox that has never been opened has no activity history at all.
  5. Turn on two-factor authentication, then generate an app password for each mailbox if your sending platform asks for one rather than using sign-in.
    • App passwords will not appear as an option until two-factor is switched on
If a mailbox will not connect later

Check Admin → Apps → Google Workspace → Gmail → End User Access and confirm access is enabled for that user or organisational unit. A connection that times out before it ever asks for a password is almost always this setting, not a bad password. We lost a fair while to that one.

Done when
  • Three licensed mailboxes, not aliases
  • Display name and signature set on each
  • Each one logged into at least once
  • Two-factor on, app passwords generated if needed
PART 03: 30 MINUTES

Publish the DNS records

Four kinds of record. All of them go in Cloudflare under the domain → DNS → Records → Add record.

1. MX, so the domain can receive mail

Google Workspace gives you these during setup. Modern setups use a single record:

TypeNameContentPriority
MX@smtp.google.com1

Delete any MX records the registrar added by default. Leaving a stray one in place sends a share of your mail somewhere you are not reading.

2. SPF, which servers may send as you

TypeNameContent
TXT@v=spf1 include:_spf.google.com ~all
The include that costs people months

Your sending platform may tell you to add its own include: include:spf.theirplatform.com. Before you add it, check that the hostname actually publishes a record.

If it does not, your SPF does not fail. It returns a permanent error. Most checkers show that as a warning rather than a failure, mail keeps going out, and nothing looks broken. On one of our own domains that ran unnoticed across 2,146 messages over eleven weeks, during which SPF never once passed.

And you may not need it at all. When Google Workspace holds the mailboxes, most platforms send through Google, so include:_spf.google.com already covers it and the extra include is not just broken, it is unnecessary. Part 04 shows the check.

3. DKIM, the signature

  1. Go to Admin → Apps → Google Workspace → Gmail → Authenticate email
  2. Select the domain, choose 2048-bit key length, and click Generate new record
  3. Copy the value it produces. It is long, so take all of it
  4. In Cloudflare add a TXT record with name google._domainkey and that value as the content
  5. Go back to the Admin console and click Start authentication. It will not confirm until the record has propagated. Wait a few minutes and try again rather than assuming it failed

4. DMARC, what to do when the others fail

TypeNameContent
TXT_dmarcv=DMARC1; p=none; rua=mailto:you@yourdomain.co.uk

Start at p=none. That is monitoring only: it changes nothing about delivery and asks receivers to send you reports. After two weeks of clean reports, change p=none to p=quarantine. Do not start at quarantine; if something is misconfigured you will not find out until your mail has already been disappearing for a fortnight.

Done when
  • One MX record, and no stray defaults left behind
  • Exactly one SPF record, with every include verified to exist
  • DKIM generated at 2048-bit, published, and authentication started
  • DMARC published at p=none with a reporting address
PART 04: 10 MINUTES

Verify the records actually work

Publishing a record and having it work are different things. This is the step almost everybody skips, and it is where the expensive mistakes are found.

Check each one directly

On a Mac or Linux machine, in Terminal. On Windows, use nslookup -type=TXT or any online DNS lookup tool.

dig +short TXT yourdomain.co.uk
dig +short TXT google._domainkey.yourdomain.co.uk
dig +short TXT _dmarc.yourdomain.co.uk
dig +short MX  yourdomain.co.uk

Each should return something. An empty answer means the record is not published, whatever the dashboard says.

Then the check nobody runs

Take every hostname named in your SPF record and look it up on its own. If your record says include:spf.theirplatform.com, then run:

dig +short TXT spf.theirplatform.com
If that comes back empty, your SPF is broken

Not failing. Erroring, which most tools report as a warning. Remove the include. If the platform sends through Google Workspace, the Google include already covers it and nothing is lost.

Two minutes. Almost nobody does it. It is the single highest-value check in this document.

Finally, a real message

  1. Send an email from each of the three mailboxes to a personal address on a different provider
  2. Open it and view the original or the message source
  3. Look for spf=pass, dkim=pass and dmarc=pass
  4. All three must say pass. A permerror or none on any line sends you back to part 03
Done when
  • All four lookups return a value
  • Every SPF include verified to publish a record of its own
  • A real message from each mailbox shows pass on all three checks
PART 05: 20 MINUTES

Connect the sending platform

Three mailboxes in, warm-up on, and nothing sent to anybody real for four weeks.

  1. Create the account and go to Email Accounts → Add new
  2. Add each of the three mailboxes. Google Workspace accounts usually connect by signing in; if it asks for a password instead, use the app password from part 02, not the account password
  3. Set the sending name on each to a real person's name. Not "Sales Team"
  4. Turn warm-up on for all three. Leave every warm-up setting at its default. The defaults are sensible and the ramp is the point
  5. Set the daily campaign limit per mailbox to 20. Not the maximum it offers. You will raise this later, slowly, in part 10
    • Usually at Email Accounts → the account → Settings → Campaign Settings
  6. Run the platform's own domain test if it has one. Most have a "test domain setup" button on the accounts screen. It is a second opinion on part 04, from the people who watch deliverability all day
Three at twenty, not one at sixty

Sixty emails a day from three mailboxes is ordinary. Sixty from one is a pattern, and it is the pattern filters are looking for. The cost is the same either way: it is three licences rather than one, and it buys you the only safe route to volume there is.

Done when
  • Three mailboxes connected and showing healthy
  • A real person's name on each
  • Warm-up running on all three
  • Daily campaign limit set to 20 per mailbox
PART 06: 15 MINUTES

Fix the settings that are wrong by default

This is the shortest part and the one that has cost us the most. Every item below is a default we did not check, and each one cost real time before we found it.

SettingDo this
Open and link tracking TURN IT ON. It can be off by default. If it is, your open rate is not low. It does not exist, and every number you look at for weeks is meaningless. This caught us twice on two different campaigns.
Automatically pause on high bounce rate Usually at Settings → Preferences → Outreach Preferences. Leave it on, but know it exists and know where it lives. When it fires, a stopped campaign looks exactly like a slow one. See part 10.
Unsubscribe link header Turn it on. It adds the opt-out into the message headers where mail clients can offer it natively. Good for deliverability, and it helps satisfy the opt-out obligation that applies to every message.
Provider matching Turn it on if your mailboxes are Google. It sends Google-to-Google where it can, which measurably helps.
Automatic subject line optimisation Leave it off for now. It needs hundreds of sends per variant before it means anything, and switched on early it will pick a winner from noise. Revisit once you have volume, and set it to judge on replies rather than opens.
Stop sequence on reply On. Nothing loses a warm reply faster than the follow-up arriving anyway.
Do this before you send anything, not after

Tracking that was off cannot be turned on retrospectively. Every send made while it was off is unmeasurable forever. You cannot go back and find out what those weeks did.

PART 07: FOUR WEEKS

Wait four weeks

Nothing to do. That is the hard part, and skipping it undoes parts 01 to 06.

Warm-up is building a sending history so the domain is not a stranger when your first real email arrives. There is no way to compress it and no setting that substitutes for it.

Check once a week, for two minutes

Use the time

Run your Winnowed count, build the list, and write the three emails from part 09. By the time the four weeks are up you want to be pressing go, not starting to think about copy.

Leave warm-up running afterwards

It is not a setup phase you switch off at launch. Leave it on permanently alongside the campaign. It keeps a baseline of ordinary conversation under your sending, which is what a real mailbox looks like.

PART 08: 20 MINUTES

Import your Winnowed list

Suppression check first, then dedupe, then upload. In that order, because the first two cannot be undone after the third.

  1. Open the file Winnowed produced. It contains kept rows, refused rows with the reason, and withheld rows with a phone number.
  2. Split it in two. Rows with an email address go to the campaign. Rows with a phone and no address go to a separate sheet. That is your call list, and part 05 of the six-step guide covers working it.
  3. Check against your suppression list. Anyone who has ever opted out, or hard bounced, comes out now. If this is your first campaign you have no suppression list yet. Create the empty sheet anyway, because you will need it within a fortnight.
  4. Dedupe against every previous campaign. Contacting the same company twice from two campaigns is the fastest way to look exactly like what you are trying not to look like.
  5. Upload. Map the columns when it asks: company, email, website, and anything else you want available in the copy.
  6. Read the import summary. It will report rows rejected as duplicates or invalid. Look at what it rejected rather than clicking through. That summary is where data problems surface.
Finding one lead again later

The leads search usually matches on email address, not company name. If a company search returns nothing, search a fragment of the address instead. It is not a bug and the record is not missing.

Done when
  • Phone-only rows split into their own call list
  • Suppression list checked, even if it is empty
  • Deduped against previous campaigns
  • Import summary read, not dismissed
PART 09: 45 MINUTES

Build the sequence

Three emails at day 1, day 3 and day 10. Subject line variants on the first one only.

  1. Create the campaign and open Sequences
  2. Write step 1. Under 120 words, one concrete ask, no attachments, no images, and ideally no links at all
    • "Reply, or call me on 07…", not "worth a quick conversation?"
    • No merge field you cannot fill on every single row. "Hi ," is worse than no greeting
  3. Add two or three subject line variants to step 1 using + Add Variant. Change only the subject. Keep the body identical across all of them, or the test tells you nothing
  4. Add step 2 at day 3. The reason a customer would care, put a different way. Not "just following up" and nothing else
  5. Add step 3 at day 10. A clean close: acknowledge the timing may be wrong, leave the door open, stop
  6. Put your opt-out and a postal address in every step, not only the first. The obligation applies to each message
  7. Set the schedule to weekdays, roughly 09:00 to 16:00 in the recipient's time zone
Steps 2 and 3 do not get variants

The platform does not branch by which step 1 variant a lead received. Every lead flows into one shared step 2 and one shared step 3 regardless. Adding variants there creates a test you cannot read.

Only step 1 gets variants. It took us a while to work that out.

On when the test means anything

With 1,000 leads across three variants you get a few hundred sends each, which is enough, eventually. At 25 sends per variant it is noise, and we have read far too much into a difference that turned out to be nothing. Wait, then judge on replies rather than opens.

Done when
  • Three steps at day 1, 3 and 10
  • Variants on step 1 only, differing by subject alone
  • Opt-out and postal address in all three
  • Weekday schedule set
PART 10: 15 MINUTES, THEN WEEKLY

Launch, and the first week

Four checks before you press go, then one number that matters more than the dashboard.

Before launching

  1. Send yourself a test of every step, to an address on a different provider from your own
  2. Open each one on a phone. That is where it will be read. Check the line breaks and that the signature is not three screens long
  3. Click your own unsubscribe link and confirm it works. If it does not, you have a problem in every message you are about to send
  4. Confirm the daily limit is still 20 per mailbox and that tracking is on. Check it now rather than trusting part 06

Then the first week

WhenCheck
Day 1, an hour after launchMail is actually going out. Any immediate bounces
Day 2Bounce rate. Above 5% and something is wrong with the list. Pause and look before it pauses you
Day 4Bounce categories, not just the total. See below
Day 7First read on replies worth having. Write the week's four numbers down
Watch sends in the last few days, never the all-time average

A paused campaign and a slow campaign look identical on a dashboard showing lifetime figures. Both sit there displaying a reassuring, unchanged number.

We lost twenty-one days to exactly this. The automatic high-bounce pause from part 06 had fired, the campaign had stopped entirely, and the averages looked stable. It read as deliverability quietly recovering. It was a stopped campaign.

Every check you make, look first at how many emails went out in the last three days. If that is not moving, nothing else on the page means anything.

Raising the volume

Not before a run of clean days with no reputation-based rejections. Then 20 → 25 → 30 per mailbox, a week apart, and one policy-blocked bounce resets the clock. There is no prize for getting there faster and the downside is weeks of repair.

The record that outlives the platform

One row a week in a spreadsheet: sent, bounced, replied, conversations. Four numbers, taken the same day each week. Six weeks of that tells you more than any dashboard, and it is the only thing that survives you changing tools.

Running weekly
  • Sends in the last three days (first, every time)
  • Bounce rate under 3%, broken down by category when it moves
  • Replies tracked; opens used only to compare subject lines
  • Four numbers written down