SPF, DKIM and DMARC are three email authentication records you publish in your domain's DNS. Together they tell receiving mail servers which servers may send for your domain, prove the message was not altered, and say what to do with mail that fails those checks.
- SPF (Sender Policy Framework) lists the servers allowed to send email for your domain.
- DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each message, checked against a public key in your DNS.
- DMARC (Domain-based Message Authentication, Reporting and Conformance) ties the two together, checks that the visible From domain matches, and tells receivers whether to accept, quarantine or reject failures. It can also send you reports.
Why it matters when you send outreach
Cold email has no existing relationship to lean on. The receiving server knows nothing about you except your domain, your sending patterns and whether your mail authenticates. Missing or broken records give it an easy reason to filter you.
The major mailbox providers have also made authentication an explicit requirement for bulk senders. Our summary of the Gmail and Yahoo bulk sender rules covers what they ask for. Check the current requirements of the providers you send to, since they change.
Authentication does not make your email wanted. It only proves you are who you say you are. Good records plus a bad list or spammy copy still hurts your sender reputation. But without the records, even great copy starts at a disadvantage.
A concrete example
Say you run a small agency at brightpixel.co and send from Google Workspace, plus a newsletter tool that uses its own SMTP servers.
SPF record (TXT on the root domain):
v=spf1 include:_spf.google.com include:mail.newslettertool.com ~all
This says Google and your newsletter tool may send for you. The ~all marks everything else as a soft fail.
DKIM record: in the Google Workspace admin you generate a key, then publish it as a TXT record at something like google._domainkey.brightpixel.co. Your newsletter tool gives you its own selector and key to add as well. Each sender signs with its own key.
DMARC record (TXT at _dmarc.brightpixel.co):
v=DMARC1; p=none; rua=mailto:dmarc@brightpixel.co
p=none means monitor only. You collect reports for a few weeks, confirm all legitimate mail passes, then move to p=quarantine and later p=reject if you are confident.
Once live, send a test to a Gmail address, open it, choose "Show original", and look for PASS next to SPF, DKIM and DMARC.
Common mistakes
Two SPF records
A domain must have only one SPF record. Adding a second one when you sign up for a new tool breaks both. Merge the include: entries into a single record.
Too many DNS lookups in SPF
SPF has a limit of 10 DNS lookups. Every include: can pull in more. Stack enough tools and SPF fails silently. Remove services you no longer use.
Setting up DKIM for one tool but not another
If your CRM or sending tool sends as your domain but does not sign with your DKIM key, those messages can fail DMARC alignment. Every service that sends as you needs its own setup.
Jumping straight to p=reject
A strict policy before you know all your senders can block your own invoices or password resets. Start with p=none and read the reports.
Forgetting alignment
DMARC passes only if SPF or DKIM passes and the domain matches your From address. A tool signing with its own domain instead of yours will pass DKIM but fail DMARC.
Treating authentication as the whole job
Records do not fix bounces from bad addresses or volume spikes. Run email verification on lists before sending, and keep daily volume sensible. Our post on Gmail daily sending limits explains the caps.
Should you use a separate domain for cold email?
Many senders put outreach on a second domain (for example brightpixel-mail.co) so problems there do not affect the main domain that handles client mail. That is a judgement call, not a rule. If you do it, the new domain needs its own SPF, DKIM and DMARC, and it should be warmed up gradually with low volume first.
What to do next
- List every service that sends email as your domain.
- Check your current DNS for existing SPF, DKIM and DMARC records.
- Fix or merge SPF into one record under 10 lookups.
- Enable DKIM in each sending service and publish the keys.
- Add DMARC at
p=nonewith a reporting address, review reports, then tighten. - Send test emails and confirm all three pass in the message headers.
Once the domain is set up, the sending side matters as much as the records. In GetClient you connect your own Gmail or SMTP accounts, so mail goes out through the servers your SPF and DKIM already authorize. You can verify a list first, set send-day limits by weekday, and every email includes a one-click unsubscribe link, which bulk sender rules also expect. From there, a short, well-paced sequence like the one in our three-step email sequence guide is a sensible place to start.