# How to Set Up SPF, DKIM and DMARC for Cold Email

> A step-by-step guide to adding the three DNS records that prove your emails are really from you, so your cold outreach has a fair chance of reaching the inbox.

You wrote a good cold email, sent it to a clean list, and heard nothing back. Before you rewrite the copy, check something more basic: can the receiving mail server prove the email actually came from you? If not, it may have gone to spam or been rejected outright.

That proof comes from three DNS records: SPF, DKIM and DMARC. Gmail and Yahoo now expect bulk senders to have them, and even at small volumes, missing records make you look like a spoofer. The good news is that setting them up takes under an hour, and you only do it once per domain.

## Before you start: use a separate sending domain

If your main business domain is `yourcompany.com`, consider sending cold email from a lookalike such as `getyourcompany.com` or `yourcompany.co`. Point its website to your main site with a redirect.

The reason is simple: cold email carries more risk of spam complaints than normal business mail. A separate domain keeps that risk away from the domain your invoices, support and client conversations depend on.

You will need:

- Login access to your domain registrar or DNS host (Cloudflare, GoDaddy, Namecheap and so on)
- Admin access to your email provider (Google Workspace, Microsoft 365, or your SMTP service)
- About 30 to 60 minutes, plus time for DNS changes to spread

## Step 1: Add an SPF record

SPF lists the servers allowed to send email for your domain. It is a single TXT record on the root of the domain.

1. Open your DNS settings and add a new **TXT** record.
2. Host/name: `@` (meaning the root domain).
3. Value, depending on your provider:
   - Google Workspace: `v=spf1 include:_spf.google.com ~all`
   - Microsoft 365: `v=spf1 include:spf.protection.outlook.com ~all`
   - Other SMTP services: use the `include:` value from their setup docs.
4. Save.

If you use more than one service, combine them into **one** record, for example `v=spf1 include:_spf.google.com include:mailservice.example ~all`. Two separate SPF records break SPF entirely, and this is one of the most common setup errors.

Also keep an eye on the 10 DNS lookup limit. Each `include:` can trigger several lookups. Only include services that actually send mail for this domain.

## Step 2: Turn on DKIM

DKIM adds a digital signature to each email. The receiver checks it against a public key published in your DNS. Unlike SPF, you generate DKIM inside your email provider first.

**Google Workspace:**

1. Go to Admin console > Apps > Google Workspace > Gmail > Authenticate email.
2. Select your domain and click Generate new record. Choose a 2048-bit key if your DNS host allows it.
3. Copy the host name (usually `google._domainkey`) and the long TXT value.
4. Add them as a TXT record at your DNS host.
5. Wait a little, then return to the admin console and click **Start authentication**.

**Microsoft 365:** In the Defender portal under email authentication settings, enable DKIM for your domain. Microsoft gives you two CNAME records (`selector1._domainkey` and `selector2._domainkey`) to add to DNS.

**Other SMTP providers:** Look for a section called domain authentication or DKIM. They will give you either a TXT or CNAME record to copy.

The step people forget is the last one: adding the record is not enough for Google, you must also press Start authentication.

## Step 3: Publish a DMARC record

DMARC tells receivers what to do when an email fails SPF and DKIM, and where to send reports. It only works once SPF and DKIM are in place.

1. Add a new **TXT** record.
2. Host/name: `_dmarc`
3. Value to start with:

`v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com`

`p=none` means "monitor only". Nothing gets blocked while you confirm everything passes. The `rua` address receives daily summary reports. Use a mailbox you actually check, or a free DMARC report reader so the XML files are readable.

After a couple of weeks of clean reports, tighten it:

| Policy | What it does | When to use it |
|---|---|---|
| `p=none` | Reports only | First 1 to 2 weeks |
| `p=quarantine` | Failing mail goes to spam | Once reports show your mail passes |
| `p=reject` | Failing mail is refused | When you are confident nothing legitimate fails |

The timeline is a rule of thumb, not a requirement. Move up when your reports look clean.

## Step 4: Test that all three pass

DNS changes can take from a few minutes to 48 hours to spread. Then test:

1. Send an email from your new domain to a personal Gmail address.
2. Open it, click the three dots, and choose **Show original**.
3. Look for `SPF: PASS`, `DKIM: PASS` and `DMARC: PASS`.

If any shows FAIL or is missing, check for typos, extra quotes added by your DNS host, duplicate SPF records, or a DKIM key that was never activated. Public DNS lookup tools can also confirm each record is published.

## Step 5: Do the rest of the deliverability basics

Authentication proves who you are. It does not make people want your email. A few other things matter just as much:

- **Warm up slowly.** A brand new domain sending hundreds of emails on day one looks suspicious. Start with a small daily number and grow over a few weeks. See our guide to [Gmail daily sending limits](https://getclient.pro/blog/gmail-daily-sending-limits) for the caps you must stay under.
- **Verify your list.** Bounces hurt your sender reputation. Run email verification before every campaign.
- **Make it easy to opt out.** Include an unsubscribe link and honour it straight away. Here is how to [remove unsubscribed contacts](https://getclient.pro/blog/remove-unsubscribed-contacts) properly.
- **Go light on tracking.** Open tracking pixels and heavy link tracking can count against you. Read more on [tracking pixels and deliverability](https://getclient.pro/blog/tracking-pixels-and-deliverability).
- **Check the rules.** Laws on cold email differ by country (CAN-SPAM, GDPR, CASL and others). Identify yourself, include a physical address where required, and check the rules that apply to you. This is not legal advice.

## Putting it to work

Once your domain passes all three checks, you can connect the mailbox to your sending tool. A one-click unsubscribe link is added for each recipient and unsubscribed addresses are skipped automatically. New accounts get 100 free credits with no card needed; see [plans and credits](https://getclient.pro/pricing) for the rest.

Whichever tool you use, set up SPF, DKIM and DMARC first. It is the cheapest deliverability work you will ever do.

## Frequently asked questions

### Do I need SPF, DKIM and DMARC on every domain I send from?

Yes. Each sending domain needs its own records. If you use three lookalike domains for cold email, set up all three records on each one.

### Will SPF, DKIM and DMARC guarantee my emails land in the inbox?

No. They prove you are a legitimate sender, which is required, but inbox placement also depends on your sending volume, list quality, bounce rate, spam complaints and the content of your emails.

### Should I use ~all or -all at the end of my SPF record?

~all (soft fail) is the safer, common choice while you rely on DMARC to set enforcement. -all (hard fail) is stricter and can cause legitimate mail to be rejected if you forget to include a service.

### Can I use the same DMARC report email for several domains?

Yes. You can point the rua tag of several domains to one mailbox. Some receivers require an extra DNS record on the receiving domain when reports go to a different domain, so check your report tool's instructions.

### How long should I wait after setup before sending cold emails?

Wait until a test email shows SPF, DKIM and DMARC all passing, then start warming up with low daily volumes over a few weeks rather than sending a full campaign straight away.

Source: https://getclient.pro/blog/set-up-spf-dkim-dmarc-for-cold-email