Home › Blog › Bulk DNS Setup for 100 Cold Email Domains with Cloudflare
Bulk DNS Setup for 100 Cold Email Domains with Cloudflare (Without Clicking 100 Times)
Configuring one sending domain takes ten minutes of careful clicking. Configuring a hundred takes a script and twenty minutes total, or a week of error-prone copy-paste. Here is the automated pipeline: CSV of domains in, Cloudflare zones created, DNS templates applied, redirects set, and a validation report out.
Quick Answer: CSV → Cloudflare API → Template → Validate
Standardize DNS on Cloudflare (one API for every registrar's domains), then script four steps: create zones, switch nameservers via registrar API, apply the record template (MX + SPF + unique DKIM + DMARC + 301 redirect with SSL), and validate every record by querying it back. Pilot on 3 domains before the batch, automation multiplies typos as efficiently as correctness. The CSV driving the script becomes your fleet inventory.
The Pipeline
INPUT: domain, registrar, dkim_selector, dkim_key
1. ZONES POST /zones per domain
→ capture assigned nameservers
2. NS registrar API (Namecheap/Porkbun):
set nameservers → wait for activation
3. RECORDS per domain, from template:
MX provider's hosts
TXT v=spf1 include:<provider> ~all
TXT <selector>._domainkey → per-domain key
TXT _dmarc p=none; rua=mailto:...
A/@ proxied + Redirect Rule 301 → main site
4. VALIDATE DoH query every record on every domain
→ red/green report; greens proceed to
mailbox provisioning, reds get fixed
before anything sends- •The redirect belongs in the template, not as a later chore: naked domain and www 301 to your main site with SSL, done at birth for every domain (why this matters).
- •DMARC starts at p=none with reporting, then tightens to quarantine after warmup proves alignment; automating the later tightening across the fleet is the same script with a different template (policy guidance).
- •Respect API rate limits with batching and retries; both Cloudflare and registrars throttle, and a script that half-configures a fleet is worse than one that runs slow.
- •Spot-check the output with the Deliverability Checker and SPF Checker on a sample, your validation pass verifies existence, these verify correctness (lookup counts, alignment, syntax).
Terraform and DNSControl, When the Fleet Gets Serious
Past a couple hundred domains, move from imperative scripts to declarative state: DNSControl or Terraform hold every zone's intended records in version control, and applying changes becomes a diff you review instead of a script you rerun. The killer feature is drift detection, when someone hand-edits a record in the Cloudflare UI at 11pm during an incident, the next plan flags it, and fleet state stays knowable. The CSV inventory from the starter pipeline migrates straight into their config formats, so nothing is wasted by starting simple.
Frequently Asked Questions
How do I set up DNS for 100 cold email domains at once?
Standardize on Cloudflare as the DNS layer regardless of registrar, then automate four steps through its API: (1) create a zone per domain and capture the assigned nameservers, (2) update nameservers at the registrar (Namecheap and Porkbun both have APIs for this), (3) apply a DNS template per domain, MX, SPF, DKIM, DMARC, and the redirect records, with per-domain values like DKIM keys injected, (4) run a validation pass that queries every record back and outputs a red/green report. A ~100-line script does all of it; the manual equivalent is a week of clicking with a guaranteed typo rate.
Why Cloudflare instead of managing DNS at each registrar?
One API, one format, one automation, regardless of where domains were bought, which matters because fleets accumulate across registrars over time. Cloudflare's API is the best-documented in DNS, the free tier covers unlimited zones, propagation is fast, and redirect rules replace the flaky registrar forwarding that silently breaks mail records (the classic disaster covered in our domain forwarding post). Terraform or DNSControl on top gives you version-controlled zone state, worth it beyond ~200 domains.
What belongs in the DNS template for a sending domain?
Per domain: MX records for the mailbox provider; SPF TXT with only that provider's include and ~all; DKIM record (unique per domain, generated at mailbox provisioning, injected per row, never shared); DMARC starting at p=none with rua reporting, tightened after warmup; and web records plus a 301 redirect rule pointing the naked domain and www at your main site with SSL. Nothing else: sending domains should carry the minimum surface.
How do I avoid one bad template propagating to 100 domains?
Pilot discipline: run the pipeline on 2-3 domains, validate them completely (records resolve, auth passes on a real send, redirect works with SSL), and only then unleash the batch. Automation multiplies whatever you feed it, a typo in the SPF template becomes 100 broken SPF records in ninety seconds. The validation pass at the end is non-negotiable for the same reason: never trust that an API call worked, query the record back.
Do all 100 domains get identical records?
Identical structure, distinct values. The MX and SPF lines are usually uniform per mailbox provider, but DKIM keys must be unique per domain, DMARC rua addresses can be shared or per-domain, and redirects all target your main site. Store the per-domain values (DKIM selector and key, assigned nameservers, provisioning date) in the same CSV the script consumes, that file becomes your fleet inventory, which the monitoring post turns into a dashboard.
Get FREE .com Domains
Prewarmed Inboxes So You Can Send Cold Emails Today
Get Prewarmed & Fresh InboxesPrewarmed & Fresh Inboxes
Google, Microsoft 365 and Azure inboxes with free prewarmed domains and DNS configured before you log in. Prewarmed inboxes send the day they land; every order is delivered within 48 to 72 hours.
Get Prewarmed & Fresh Inboxes