SPF, DKIM and DMARC for Cold Email: Setup in 30 Minutes

If your cold emails land in spam, the cause is usually three missing DNS records rather than your copy. SPF, DKIM and DMARC tell receiving servers that mail claiming to be from your domain really is. Without them, Google and Microsoft now routinely refuse or junk bulk mail. Setting them up takes about half an hour and costs nothing.

What each record actually does

Think of an email arriving at Gmail. Gmail asks three questions.

SPF — "is this server allowed to send for this domain?" A DNS record listing which servers may send mail as you. Gmail checks the sending server against the list.

DKIM — "was this message tampered with?" Your sending server signs each message with a private key. The matching public key sits in your DNS. Gmail verifies the signature.

DMARC — "what should I do if the checks fail?" Your instruction to receiving servers: ignore it, quarantine it, or reject it. It also asks them to report back.

SPF and DKIM are the evidence. DMARC is the policy.

Why this became non-negotiable

Google and Microsoft both tightened their sender requirements substantially in 2024, and have kept tightening since. For anyone sending in volume, the practical baseline now is: SPF and DKIM authenticated, a DMARC record present, one-click unsubscribe, and spam complaints kept below roughly 0.3%.

Below that bar, mail gets throttled or junked. It doesn't bounce with a clear error — it just quietly stops arriving, which is far worse because you keep sending into a void.

Setting them up

You add all three as DNS records at whoever manages your domain — Cloudflare, your registrar, your host.

1. SPF

One TXT record on your root domain. If you send through Google Workspace:

`` Type: TXT Name: @ Value: v=spf1 include:_spf.google.com ~all ``

Microsoft 365 uses include:spf.protection.outlook.com. Your provider will tell you the right value.

The one rule that matters: you may have only one SPF record per domain. If you already have one and you add a second, both break. Merge them instead:

`` v=spf1 include:_spf.google.com include:amazonses.com ~all ``

Second rule: SPF allows a maximum of 10 DNS lookups. Each include: costs at least one. Chain too many providers and SPF fails silently. If you're near the limit, drop providers you no longer use.

~all means "soft fail" — treat unlisted senders as suspicious. -all means "hard fail" — reject them. Start with ~all and tighten later.

2. DKIM

Your email provider generates the key pair. You copy the public half into DNS. Typically:

`` Type: TXT Name: google._domainkey (varies by provider) Value: v=DKIM1; k=rsa; p=MIGfMA0GCSq... ``

Then switch it on in the provider's admin panel. This is the step people skip: the DNS record exists, the signing was never enabled, and nothing is actually signed.

If you send through more than one service — your mailbox plus a transactional provider — each needs its own DKIM record under a different selector.

3. DMARC

One TXT record:

`` Type: TXT Name: _dmarc Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com ``

p=none means "don't change anything, just report". Always start here. It lets you see what's being sent as you before you enforce anything.

After a few weeks of reports, tighten to p=quarantine (failures go to spam), and eventually p=reject (failures are refused).

Going straight to p=reject is the classic self-inflicted wound: some legitimate service you forgot about — your invoicing tool, your CRM, your newsletter — starts failing and its mail vanishes.

Checking your work

DNS takes minutes to a few hours to propagate. Then:

• Send yourself a test at a Gmail address. Open it, choose "Show original". You want SPF: PASS, DKIM: PASS, DMARC: PASS.
• Free checkers like MXToolbox will read all three records back to you.
• Watch the DMARC reports arriving at your rua address for a couple of weeks.

Five mistakes that quietly cost you

1. Two SPF records. Breaks both. Merge into one.
2. DKIM record added, signing never enabled. Half a setup is no setup.
3. Jumping straight to p=reject. Kills legitimate mail you forgot about.
4. Sending cold outreach from your main domain. If deliverability tanks, it takes your invoices and client mail with it. Use a separate domain — getleadradary.com rather than leadradary.com — and let it warm up.
5. Perfect authentication, terrible list. Authentication proves you are who you say. It does nothing about complaint rates. If people mark you as spam, you'll be filtered regardless — which is really an argument for contacting fewer, better-qualified businesses.

What this does and doesn't fix

Authentication is necessary, not sufficient. It gets you past the door. Whether you stay in the inbox depends on complaints, bounce rate and engagement.

The fastest way to ruin all three is volume without relevance. Which is why the deliverability problem and the targeting problem are the same problem wearing different hats.

Summary

• SPF says which servers may send as you. Only one record, max 10 lookups.
• DKIM signs messages. Add the record and turn signing on.
• DMARC sets policy. Start at p=none, tighten gradually.
• Use a separate domain for outreach.
• Verify with "Show original" in Gmail — you want three PASSes.