Cold Email Deliverability: SPF, DKIM, and DMARC Setup Guide

Why Email Authentication Matters

Every cold email you send passes through multiple checkpoints before reaching your prospect's inbox. Email service providers like Gmail and Outlook verify three things about every incoming message:

Is the sender who they claim to be? (Authentication)
Has this sender been trustworthy in the past? (Reputation)
Does this email look like spam? (Content filtering)

Email authentication — SPF, DKIM, and DMARC — addresses the first question. Without proper authentication, your emails are treated as potentially forged, and most ESPs will either reject them outright or route them to spam.

For cold email specifically, authentication is non-negotiable. You're emailing people who don't know you. ESPs are already skeptical of your messages. Proper authentication removes one major reason to distrust your emails.

SPF Record — What It Is and How to Set It Up

What SPF Does

SPF (Sender Policy Framework) tells receiving mail servers which IP addresses and servers are authorized to send email on behalf of your domain. When Gmail receives an email from you@yourdomain.com, it checks your domain's SPF record to verify the sending server is on the approved list.

How SPF Works

You publish a TXT record in your domain's DNS
The record lists all servers authorized to send as your domain
Receiving servers check this record when your email arrives
If the sending server matches, SPF passes; if not, it fails

Setting Up SPF

Your SPF record is a single TXT record added to your domain's DNS. The format:

v=spf1 include:_spf.google.com include:sendgrid.net ~all

Breaking this down:

v=spf1 — Version identifier (always spf1)
include:_spf.google.com — Authorize Google Workspace servers
include:sendgrid.net — Authorize SendGrid (if used for transactional email)
~all — Soft-fail for all other servers (recommended over -all for cold email)

Common include values:

Google Workspace: include:_spf.google.com
Microsoft 365: include:spf.protection.outlook.com
SendGrid: include:sendgrid.net
Mailgun: include:mailgun.org
Amazon SES: include:amazonses.com

SPF Best Practices

Use ~all (soft-fail) instead of -all (hard-fail) for cold email. Hard-fail can cause legitimate emails to bounce if you add a new sending service and forget to update SPF.
Keep your SPF record under 10 DNS lookups. Each include: triggers a DNS lookup. Exceeding 10 causes SPF to fail. Use tools like MXToolbox to check your lookup count.
Only one SPF record per domain. Multiple SPF records cause both to fail. Combine all includes into a single record.

DKIM — Technical Explanation and Setup

What DKIM Does

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every email you send. The receiving server uses your domain's public key (published in DNS) to verify the signature. This proves the email wasn't tampered with in transit and genuinely came from your domain.

How DKIM Works

Your email server signs each outgoing email with a private key
The signature is added as a header in the email
Your domain's DNS contains the matching public key
Receiving servers verify the signature using the public key
If the signature matches, DKIM passes

Setting Up DKIM for Gmail/Google Workspace

Go to Google Admin Console > Apps > Google Workspace > Gmail > Authenticate email
Click "Generate new record"
Select your domain and DKIM key bit length (2048-bit recommended)
Google gives you a TXT record to add to your DNS
Add the record at your domain registrar
Return to Google Admin and click "Start authentication"

The DNS record looks like:

Host: google._domainkey.yourdomain.com
Type: TXT
Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8...

Setting Up DKIM for Microsoft 365

Go to Microsoft 365 Defender > Email & Collaboration > Policies > DKIM
Select your domain
Microsoft provides two CNAME records to add:
- selector1._domainkey.yourdomain.com → selector1-yourdomain-com._domainkey.yourdomain.onmicrosoft.com
- selector2._domainkey.yourdomain.com → selector2-yourdomain-com._domainkey.yourdomain.onmicrosoft.com
Add both CNAME records at your registrar
Return to Microsoft and enable DKIM signing

DKIM Best Practices

Use 2048-bit keys instead of 1024-bit. Longer keys are more secure and increasingly required by ESPs.
Rotate keys annually. While not strictly necessary, key rotation is a security best practice.
Verify DKIM is signing. Send a test email to a Gmail account, click the three dots > "Show original", and look for dkim=pass in the headers.

DMARC — Policy Types and Recommended Setup

What DMARC Does

DMARC (Domain-based Message Authentication, Reporting & Conformance) ties SPF and DKIM together with a policy that tells receiving servers what to do when authentication fails. It also provides reporting so you can monitor who's sending email as your domain.

DMARC Policy Types

| Policy | Meaning | When to Use | |--------|---------|------------| | p=none | Monitor only, don't block anything | Starting out, gathering data | | p=quarantine | Send failing emails to spam | After verifying legitimate senders pass | | p=reject | Block failing emails entirely | Maximum protection (advanced) |

Setting Up DMARC

Add a TXT record to your DNS:

Host: _dmarc.yourdomain.com
Type: TXT
Value: v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; pct=100

Breaking this down:

v=DMARC1 — Version identifier
p=quarantine — Policy: send failing emails to spam
rua=mailto:dmarc@yourdomain.com — Where to send aggregate reports
pct=100 — Apply policy to 100% of emails

Recommended DMARC Progression for Cold Email

Week 1-2: Monitor mode

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; pct=100

This lets you see who's sending as your domain without blocking anything. Review the reports to identify all legitimate sending services.

Week 3-4: Quarantine mode

v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; pct=100

Once you've confirmed all legitimate senders pass SPF and DKIM, switch to quarantine. Unauthorized senders (spoofers) will land in spam.

Month 2+: Reject mode (optional)

v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com; pct=100

For maximum protection. Only do this when you're confident all legitimate email passes authentication.

Testing Your Setup

Using MegaOutreach DNS Checker

MegaOutreach includes a built-in deliverability checker that validates all your DNS records:

Navigate to Deliverability > DNS Check
Enter your domain
The checker validates SPF, DKIM, DMARC, MX records, and BIMI
Green checkmarks indicate passing records
Red flags show issues with fix instructions

Manual Testing Tools

MXToolbox (mxtoolbox.com): Comprehensive DNS lookup and SPF/DKIM/DMARC validation
Google Admin Toolbox: Check specific record syntax
Mail-tester.com: Send a test email and get a deliverability score out of 10
Google Postmaster Tools: Monitor your domain reputation over time

Reading Email Headers

Send a test email to a Gmail account, then check authentication results:

Open the email in Gmail
Click the three dots menu > "Show original"
Look for these headers:
- spf=pass — SPF is working
- dkim=pass — DKIM is signing correctly
- dmarc=pass — DMARC policy is satisfied

All three should show pass. If any show fail or softfail, review your DNS records.

Common Issues and Fixes

SPF failing: Usually caused by missing an include: for your sending service. Check which server sent the email (in headers) and add the corresponding include.

DKIM failing: Often means the DNS record hasn't propagated yet (wait 24-48 hours) or the key was entered incorrectly. Double-check for extra spaces or line breaks in the TXT record value.

DMARC failing: Can happen when SPF alignment or DKIM alignment fails. The "From" domain must match the domain in SPF or DKIM. Using a different subdomain for sending can cause alignment issues.

Need help checking your email authentication? Try MegaOutreach's DNS checker — it validates SPF, DKIM, DMARC, and MX records in seconds. Free during your 14-day trial.