Twins ProxyMasked domains for cold email: the complete guide
Everything between "buy a second domain" and "it actually protects you."
Masked domains — also called secondary domains, alias domains, or outreach
domains — are alternate domains used for cold email so that your primary business domain never
touches the campaign. If yourbrand.com runs your website, your team's inboxes,
and your transactional mail, then yourbrand-hq.com and
getyourbrand.com do the sending. When one of them takes spam complaints, gets a
bad week, or burns out entirely, you replace it — and the domain your business runs on never
noticed.
That's the theory. In practice a masked-domain setup has four parts, and most guides only cover the first two.
1. Buying and naming the domains
Pick names a human would accept as yours: close variants of your brand
(yourbrand-hq.com, tryyourbrand.com, getyourbrand.com,
yourbrandapp.com) on mainstream TLDs — .com first, .co
and .io acceptable. Avoid hyphen pileups, digits, and bargain-bin TLDs that spam
filters already distrust on sight. Register them wherever you like; ownership matters more
than registrar.
How many? The common convention is to spread mailboxes across several domains rather than stack everything on one — small numbers of mailboxes per domain, more domains as volume grows. The exact ratio is a sending-strategy question for your sequencer; what matters here is that every one of those domains is a real, resolving, HTTPS website — see part 3.
2. DNS and mailboxes
Each masked domain gets its own mail plumbing: SPF, DKIM, and DMARC records, plus the mailboxes your sending tool will use. Your email platform or mailbox provider walks you through this, and new domains need their warm-up period before real volume. This guide won't duplicate your sequencer's docs — the part they skip is what comes next.
3. What the domain serves — the part everyone skips
Every link you send gets visited by things that are not your prospect: corporate mail gateways, security scanners, and the prospect's own thirty seconds of due diligence typing your domain into a browser. What they find decides how your mail is treated:
Nothing / parked page: the classic footprint of a throwaway spam domain. Filters score it accordingly; prospects close the tab.
A 301 redirect to your primary site: functional, but it publicly ties every secondary domain to your primary — the exact linkage the secondary domains exist to prevent. Filters that follow links now hold the complete map, and enough domains funneling into one site can trigger spoofing-style alerts on the primary. The full breakdown is in masking vs forwarding.
A masked copy of your real site: the domain serves your landing pages under its own hostname, with its own valid HTTPS certificate. To every visitor — human or machine — it's simply a real company website. Your primary domain appears nowhere. This is what a domain masking proxy does, and it's the piece that makes the rest of the setup actually deliver the isolation you're paying domain registrations for.
4. Keeping masked domains out of Google
A masked domain serves a copy of your primary content, and you don't want search engines
indexing five copies of your site — the masked domains exist for email links, not for
ranking. The clean solution is a noindex response header
(X-Robots-Tag: noindex, nofollow) on everything the masked domain serves.
Notably, not a robots.txt Disallow: blocking crawling means Google
never sees the noindex signal, and blocked-but-referenced URLs can still end up indexed.
Allow the crawl, send the header. Twins Proxy does this by default on every masked domain,
with a per-domain toggle if you ever want one indexed.
The checklist
| Step | Done when… |
|---|---|
| Domains registered | Brand-plausible names on mainstream TLDs, owned by you |
| Mail DNS configured | SPF, DKIM, DMARC pass for every sending domain |
| Mailboxes warmed | Volume ramped per your sequencer's guidance |
| Every domain serves a real site | HTTPS, valid certificate for the domain itself, your actual landing pages — no parked page, no redirect to the primary |
| Search engines excluded | noindex header on masked responses; primary domain is the only indexed copy |
| Rotation plan | A burned domain can be swapped without touching the primary or the rest of the fleet |
Setting up the serving side in minutes
Twins Proxy handles part 3 and 4 as a product: connect a DNS provider (or delegate one CNAME, or paste records manually), add your masked domains, point them at your landing pages — it verifies DNS, issues a wildcard certificate per domain, serves your content under each domain's own hostnames, and sends the noindex header by default. The free plan covers your first domain; $15/month covers ten.