# SPF, DKIM and DMARC: what they are and how to set them up

> Three DNS records decide whether inboxes trust mail from your domain. Here is what each one does, why it matters for cold outreach, and the mistakes that quietly send you to spam.

SPF, DKIM and DMARC are three email authentication records you publish in your domain's DNS. Together they tell receiving mail servers which servers may send for your domain, prove the message was not altered, and say what to do with mail that fails those checks.

- **SPF** (Sender Policy Framework) lists the servers allowed to send email for your domain.
- **DKIM** (DomainKeys Identified Mail) adds a cryptographic signature to each message, checked against a public key in your DNS.
- **DMARC** (Domain-based Message Authentication, Reporting and Conformance) ties the two together, checks that the visible From domain matches, and tells receivers whether to accept, quarantine or reject failures. It can also send you reports.

## Why it matters when you send outreach

Cold email has no existing relationship to lean on. The receiving server knows nothing about you except your domain, your sending patterns and whether your mail authenticates. Missing or broken records give it an easy reason to filter you.

The major mailbox providers have also made authentication an explicit requirement for bulk senders. Our summary of the [Gmail and Yahoo bulk sender rules](https://getclient.pro/blog/gmail-yahoo-bulk-sender-rules) covers what they ask for. Check the current requirements of the providers you send to, since they change.

Authentication does not make your email wanted. It only proves you are who you say you are. Good records plus a bad list or spammy copy still hurts your [sender reputation](https://getclient.pro/learn/sender-reputation). But without the records, even great copy starts at a disadvantage.

## A concrete example

Say you run a small agency at `brightpixel.co` and send from Google Workspace, plus a newsletter tool that uses its own SMTP servers.

**SPF record** (TXT on the root domain):

`v=spf1 include:_spf.google.com include:mail.newslettertool.com ~all`

This says Google and your newsletter tool may send for you. The `~all` marks everything else as a soft fail.

**DKIM record**: in the Google Workspace admin you generate a key, then publish it as a TXT record at something like `google._domainkey.brightpixel.co`. Your newsletter tool gives you its own selector and key to add as well. Each sender signs with its own key.

**DMARC record** (TXT at `_dmarc.brightpixel.co`):

`v=DMARC1; p=none; rua=mailto:dmarc@brightpixel.co`

`p=none` means monitor only. You collect reports for a few weeks, confirm all legitimate mail passes, then move to `p=quarantine` and later `p=reject` if you are confident.

Once live, send a test to a Gmail address, open it, choose "Show original", and look for `PASS` next to SPF, DKIM and DMARC.

## Common mistakes

### Two SPF records
A domain must have only one SPF record. Adding a second one when you sign up for a new tool breaks both. Merge the `include:` entries into a single record.

### Too many DNS lookups in SPF
SPF has a limit of 10 DNS lookups. Every `include:` can pull in more. Stack enough tools and SPF fails silently. Remove services you no longer use.

### Setting up DKIM for one tool but not another
If your CRM or sending tool sends as your domain but does not sign with your DKIM key, those messages can fail DMARC alignment. Every service that sends as you needs its own setup.

### Jumping straight to p=reject
A strict policy before you know all your senders can block your own invoices or password resets. Start with `p=none` and read the reports.

### Forgetting alignment
DMARC passes only if SPF or DKIM passes *and* the domain matches your From address. A tool signing with its own domain instead of yours will pass DKIM but fail DMARC.

### Treating authentication as the whole job
Records do not fix bounces from bad addresses or volume spikes. Run [email verification](https://getclient.pro/learn/email-verification) on lists before sending, and keep daily volume sensible. Our post on [Gmail daily sending limits](https://getclient.pro/blog/gmail-daily-sending-limits) explains the caps.

## Should you use a separate domain for cold email?

Many senders put outreach on a second domain (for example `brightpixel-mail.co`) so problems there do not affect the main domain that handles client mail. That is a judgement call, not a rule. If you do it, the new domain needs its own SPF, DKIM and DMARC, and it should be warmed up gradually with low volume first.

## What to do next

1. List every service that sends email as your domain.
2. Check your current DNS for existing SPF, DKIM and DMARC records.
3. Fix or merge SPF into one record under 10 lookups.
4. Enable DKIM in each sending service and publish the keys.
5. Add DMARC at `p=none` with a reporting address, review reports, then tighten.
6. Send test emails and confirm all three pass in the message headers.

Once the domain is set up, the sending side matters as much as the records. You can verify a list first, set send-day limits by weekday, and every email includes a one-click unsubscribe link, which bulk sender rules also expect. From there, a short, well-paced sequence like the one in our [three-step email sequence](https://getclient.pro/blog/three-step-email-sequence) guide is a sensible place to start.

## Frequently asked questions

### Do I need all three, or is SPF enough?

Set up all three. SPF alone does not prove the message was not altered and does not check the visible From address. DKIM and DMARC fill those gaps, and major providers now expect them from people sending in volume.

### How long do DNS changes take to work?

Often minutes, sometimes up to a day or two depending on your DNS host and TTL settings. Send a test email and check the headers rather than assuming it is live.

### Can I set these up if I use a free Gmail address?

No. You can only publish records for a domain you control. With an @gmail.com address, Google handles authentication for its own domain. To authenticate your own brand, you need a custom domain, for example through Google Workspace.

### What do DMARC reports actually show?

Aggregate reports are XML files listing which IP addresses sent mail as your domain and whether each passed SPF, DKIM and alignment. They help you spot forgotten tools or someone spoofing your domain. A free report reader makes them much easier to understand.

### Will perfect authentication keep me out of spam?

No. It removes one common reason for filtering, but inbox placement also depends on bounce rates, complaints, engagement, volume and content. Treat it as the foundation, not the finish line.

Source: https://getclient.pro/learn/spf-dkim-dmarc