What actually happens the week you onboard a new client's domain
The real week-by-week workflow of bringing a new client's sending domain online at an agency — not the billing model, the actual DNS-to-first-send mechanics.
By David Lara, Founder
Founder-reviewed ·How we research and correct articles
A client signs. Someone on your team is excited to start building the sequence. And then nothing sends for two and a half weeks, because a domain that’s never sent cold email before has to earn the right to, and that process runs on its own clock — one that has almost nothing to do with how good your copy is.
This isn’t about pricing or workspace structure — that ground’s covered elsewhere. This is the actual operational sequence: what happens the day a client signs, what you’re waiting on, and where the real bottleneck sits, because it’s almost never the platform.
The five things that have to happen, in order
From signed client to first send
Day 0 — spin up the client's own workspace
Before anything touches DNS, the client gets a workspace separated from every other account on your roster — its own senders, its own contacts, its own suppression list. That separation isn't paperwork; it's what stops one client's bounce rate or one client's unsubscribe list from ever touching another's.
Day 0-1 — decide the sending domain, then send DNS records to whoever holds the registrar
Almost never the client's root domain — a secondary domain (mail.clientco.com or a lookalike like getclientco.com) that protects the domain they actually do business on. Norbelys generates the exact SPF, DKIM and DMARC records to add; you're the one handing them to whoever has registrar access, which is frequently not the person you've been emailing.
Day 1-2 — verify DNS, connect the mailbox, start warmup immediately
Once records propagate, connect the mailbox and let warmup start the same day rather than waiting for the rest of onboarding to finish — warmup takes roughly two weeks regardless of when the campaign is ready, so the clock should start as early as legitimately possible.
Day 2-16 — build the actual campaign while warmup runs in the background
This is the part that surprises people who've only run one-off outbound before: warmup and campaign-building happen in parallel, not in sequence. Import and verify the client's list, write the sequence, set up suppression rules, get sign-off on copy — all of it fits inside the same window warmup needs anyway.
Day ~18 — first real send, from a domain with actual history
Once warmup clears its floor, launch. The first message that leaves the domain isn't the first thing that domain has ever sent — it's the first cold email from a mailbox that already has two-plus weeks of consistent, low-volume, well-received traffic behind it.
Five steps, roughly eighteen days — and one of them isn’t yours to speed up.
The bottleneck is never the tool
Every agency that’s onboarded more than a handful of clients has learned this the hard way: the platform generates the DNS records in seconds. The delay is always the same — someone at the client’s org has to actually go add three TXT records to a registrar they may not remember the login for. That step can take an hour or it can take nine days, and it’s almost entirely out of your hands.
SPF, DKIM
and a starting DMARC policy of p=none (monitor-only, so a
misconfiguration doesn’t silently drop mail) are the three records every
client needs before anything else — the full DMARC rollout
sequence covers the follow-up
steps once monitoring is live, including when it’s safe to move from
none to quarantine.
Why the secondary domain decision matters more than it looks
The other place agencies lose a day is deciding what to actually send from. The client’s root domain — the one their real business email runs on — should almost never be the cold-sending domain. A cold campaign that gets flagged, even briefly, shouldn’t be able to put their invoices and support replies at risk. A dedicated secondary domain built specifically for outreach absorbs that risk instead, and it’s a five-minute conversation to have with the client if you have it on day zero — much worse if you have it after their root domain’s reputation already took a hit.
What you actually need from the client, before the kickoff call ends
Most of the delay past day one isn’t the client refusing to help — it’s the client not knowing what “help” means until you ask specifically. A kickoff call that ends with “we’ll send you what we need” produces a week of silence. One that ends with a concrete, three-item list produces records in the DNS panel the same afternoon:
- Registrar access, or the name of whoever has it. Not “our IT team will handle it” — the actual person, so you have someone to follow up with directly on day three instead of routing through the client’s main point of contact again.
- The domain they’ve agreed to send from. Confirmed in writing, because “we’ll figure out the subdomain later” is how a client ends up asking, three days into warmup, whether you can switch it — which restarts the clock.
- Their existing suppression obligations. Any prior unsubscribes, do-not-contact lists, or CAN-SPAM/GDPR history the client already has needs to load into the workspace’s suppression list before the first import, not after the first complaint.
Get those three things on the kickoff call itself, while the client is still paying attention, and the DNS step usually resolves in a day or two instead of a week.
What happens when a client pauses or leaves
The onboarding sequence has a mirror image that agencies plan for far less often: what happens to a client’s domain, senders and suppression list when the engagement ends. Because each client lives in its own workspace, offboarding is the reverse of onboarding rather than a manual cleanup job — pause the senders, export whatever the client is contractually owed (their contact list, their suppression history, their sent-message archive), and the next client’s setup never has to worry about a stray sender or an old suppression entry bleeding in from an account that closed six months ago. That separation is the same structural guarantee that kept clients isolated on day one; it just pays off again on the way out.
Common questions from teams doing this for the first time
Frequently asked questions
Can we speed up the DNS step by doing it ourselves?
Only if the client gives you registrar access directly, which is unusual and adds its own risk — you're now holding credentials to infrastructure outside your own accounts. The faster, safer pattern is handing the client exact copy-paste-ready records and a specific person to follow up with, not trying to get access yourself.
Does every client need their own DMARC policy, or can we manage one for all of them?
Each client's domain needs its own DMARC record and its own monitoring, because DMARC alignment is evaluated per domain, not per agency. What can be shared is the view: one monitoring workspace can surface every client's DMARC reports side by side, even though the underlying policy is set separately for each domain.
What if the client insists on sending from their main domain?
Have the conversation explicitly rather than letting it default that way. Explain the actual risk — a cold campaign that gets flagged putting their invoice and support email at risk too — and if they still insist after understanding that trade-off, it's their domain to protect or not. Most clients choose the secondary domain once the risk is stated plainly instead of assumed obvious.
How long does onboarding take if the client already has DNS access ready on day one?
The mechanical minimum is close to warmup's own floor — roughly two weeks from mailbox connection to a safe first send, since warmup can't be rushed regardless of how fast everything else moves. The eighteen-day estimate in this piece assumes a day or two of normal DNS friction on top of that floor; a client with records added same-day compresses toward the two-week minimum instead.
What running this across a dozen clients actually looks like
The steps above don’t change whether it’s your first client or your fortieth — that’s the actual point of doing it this way. What changes is whether you’re repeating the same manual checklist by memory each time or running it as an actual repeatable process. If any part of onboarding — DNS verification, a sender-health check, an import audit — is something you’d rather script once and run against every client workspace, the CLI supports one profile per client org so the exact same command runs unchanged whether it’s targeting client one or client twelve:
Whether you run it by hand from the dashboard or scripted from the CLI, the sequence is identical: workspace, DNS, mailbox, warmup running alongside campaign-building, launch. Once that sequence is set up per client, monitoring their domain doesn’t stop being a one-time task either — DMARC monitoring across every client domain lives in one view rather than a report nobody reads.
Where Norbelys actually removes days, not just clicks
None of the above pretends a platform can shrink the part that’s a human at the client’s company finding their registrar password. What it does remove: no separate warmup product to connect per client, no per-mailbox warmup invoice showing up a month after the client signed, no DMARC report sitting unread in an inbox nobody checks until a client asks why their reply rate dropped. Every workspace on the agency plan gets warmup, DMARC monitoring and unlimited mailboxes included from the first client onward — the only thing that scales with client count is the work itself, which was always going to scale, not the number of tools you’re stitching together to do it.
If you’re running client domains through a stack of separate warmup, verification and reporting tools right now, the honest comparison is how many of those steps collapse into one workspace and one bill. See the plans or read the full pricing breakdown — then bring the next client’s domain online the same week you sign them, not the week after.