SPF, DKIM and DMARC for Cold Email: What to Set Up Before You Send

Most cold email that lands in spam was never judged on its words. It was judged on whether the receiving server could believe the sender was who they claimed to be. Three DNS records decide that: SPF, DKIM and DMARC. They take under an hour to set up, they are checked on every message you send, and skipping them is one of the most common reasons a new sending domain struggles from day one.

What each record actually does

All three are short text entries you add to the DNS settings of the domain you send from. Together they answer one question for the inbox provider: is this message really from this domain, and what should I do if it is not?

SPF (Sender Policy Framework) lists which servers are allowed to send mail for your domain. If a message arrives from a server that is not on the list, the receiver has a reason to distrust it.
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each message. The receiver checks the signature against a public key in your DNS. A match shows the message was sent by an authorised system and was not altered on the way.
DMARC (Domain-based Message Authentication, Reporting and Conformance) ties the other two together. It tells receivers what to do when a message fails (nothing, quarantine it, or reject it) and where to send reports about what they saw.

A useful way to remember it: SPF is the guest list, DKIM is the signature on the envelope, and DMARC is the instruction to the doorman about what to do with anyone who is not on the list.

Why this matters more than it used to

Since 2024, Google and Yahoo have required bulk senders to authenticate with SPF and DKIM, publish a DMARC record, support one-click unsubscribe, and keep spam complaints low. The bulk threshold is about volume to personal inboxes, and a small cold email sender may sit below it. But the direction is clear, and receiving servers at companies of every size lean on the same signals. Authentication is no longer an optional extra for anyone sending outreach.

It also protects you. Without DMARC, anyone can send mail that appears to come from your domain, and the bounces and complaints land on your reputation.

How to set them up

Step 1: Use a dedicated sending domain

Cold email is safest sent from a separate domain, not your main company domain. If something goes wrong with reputation, your invoices and customer email are not caught in it. The domain should look like yours (a close variation of your brand) and should have a real website behind it.

Step 2: Publish SPF

Add one TXT record that names the services allowed to send for the domain, such as your mailbox provider. The word to remember is one. A domain can only have a single SPF record, and a second one makes both invalid. If you use more than one sending service, merge them into the same record.

Step 3: Turn on DKIM

Your mailbox provider generates a key pair and gives you a public key to publish in DNS, usually as a TXT or CNAME record under a name called a selector. Publish it, then switch signing on in the provider's admin settings. Publishing the record without enabling signing is a common slip, and the messages go out unsigned.

Step 4: Add DMARC, starting gently

Publish a TXT record at _dmarc on your domain. Start with a policy of p=none and a reporting address, so you can watch what passes and fails without blocking anything. Once the reports show only legitimate mail passing, tighten the policy to quarantine, and later to reject if you want the strongest protection.

How to check that it worked

Send a test message from the new mailbox to a personal Gmail address and open the original message headers. Look for spf=pass, dkim=pass and dmarc=pass.
Confirm the domain in the From address matches the domain in the SPF and DKIM results. DMARC passes only when they align.
Re-check after any change to your mailbox provider, since a new sending service means the SPF record needs updating.

What these records do not do

Authentication proves identity. It does not prove you are worth hearing from. A fully authenticated domain can still reach spam if the list is bad, the volume ramps too fast, or recipients mark the messages as unwanted. Think of the three records as the entry ticket: necessary, and nowhere near sufficient. Verified addresses, a gradual ramp, a working unsubscribe and an email that is actually relevant to the reader do the rest.

This is also where doing it by hand gets tedious. Each new sending domain needs its own records, and a mistake in one of them is silent. ApexOutreach checks SPF, DKIM and DMARC on each connected mailbox and offers a test message that shows how it is signed, so a silent mistake surfaces before a prospect's server finds it.

Frequently asked questions

Do I need all three records, or is SPF enough?

Set up all three. SPF alone breaks when mail is forwarded, and without DKIM and DMARC you give receivers little reason to trust a brand new domain.

Can I use the same DMARC policy on every domain?

The format is the same, but each sending domain needs its own record. Start each one at p=none and tighten it after you have seen the reports.

How long until the records take effect?

DNS changes can take anywhere from a few minutes to a day to spread. Test after waiting, and re-test if a check fails right after you publish.

Want to see the whole chain working before you spend anything? Tell us who you sell to and we will send you three real decision-makers in your market, plus the exact email we would send the first one. Free, no signup and no card. Try it here.