A step-by-step SPF DKIM DMARC setup guide for cold email: the DNS records, the exact values to use, and how to verify all three pass.
Before you send a single cold email from a domain, that domain needs three DNS records: SPF, DKIM, and DMARC. Inbox providers increasingly treat all three as a baseline, and mail from a domain missing any of them is far more likely to land in spam or be rejected. This guide walks the setup step by step on a dedicated sending domain, with the record types, the values to use, and how to verify each. It is narrower than our full cold email infrastructure guide: this one is just the authentication records. For definitions, see what is an SPF record, what is DKIM, and what is DMARC.
SPF, DKIM, and DMARC are three DNS records that together authenticate outbound email. SPF lists which servers may send for a domain. DKIM adds a cryptographic signature proving a message was not altered in transit and came from the domain. DMARC tells receiving servers what to do when SPF or DKIM checks fail, and requests reports. Cold email requires all three on a dedicated sending domain.
Because receiving servers score authentication as close to a gate. SPF alone proves the sending server is allowed, but not that the message is intact. DKIM proves the message is intact and domain-signed, but not what to do on failure. DMARC ties SPF and DKIM to the visible "From" domain and sets the failure policy. Missing one weakens the whole chain, and 2026 sender guidance from major providers effectively expects all three. See Google bulk sender requirements and Yahoo sender requirements for the provider-specific rules.
Two setup rules first. Use a dedicated sending domain, not your primary company domain, so cold sending cannot burn the domain your normal email runs on. And expect DNS changes to take a few hours to propagate, with a standard window of 24 to 48 hours, per LeadHaste's 2026 guide.
Register a separate domain for cold outreach, often a close variant of your main domain, and connect it to your sending platform or mailbox provider. Everything below is done in that domain's DNS settings, at your registrar or DNS host. What good looks like: the domain resolves, and you can add TXT and CNAME records.
Create one TXT record on the root of the sending domain. The value starts with v=spf1, then includes your provider's sending servers (your provider gives you the exact include: value), then ends with a policy. For cold email infrastructure, ~all (soft fail) is the common recommendation over -all (hard fail), because hard fail can drop legitimate mail in some relay setups. Example shape: v=spf1 include:_spf.yourprovider.com ~all. Keep it to one SPF record; multiple SPF records for a domain break SPF entirely. What good looks like: one TXT record, one v=spf1, ending in ~all or -all.
Your sending provider generates a DKIM key pair and gives you a public key to publish, usually as one or two CNAME records or a TXT record at a selector subdomain like selector1._domainkey.yoursendingdomain.com. Paste exactly what the provider supplies; DKIM values are long and a single character off breaks the signature. What good looks like: the selector record resolves and your provider's dashboard shows DKIM as verified or active.
Create one TXT record at _dmarc.yoursendingdomain.com. Start in monitoring mode: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com. p=none means "do not act on failures yet, just send me reports." After a week or two of clean reports, tighten to p=quarantine, then optionally p=reject. The rua address collects aggregate reports so you can see what is failing. What good looks like: the _dmarc TXT record resolves and you begin receiving XML aggregate reports within a few days.
Use a checker such as mxtoolbox.com or your provider's built-in diagnostics. Look up SPF, DKIM (with your selector), and DMARC for the sending domain. All three should return a valid record with no syntax errors and no "multiple records found" warning. Send a test email to a Gmail address, open it, and use "Show original" to confirm SPF, DKIM, and DMARC each show PASS. What good looks like: three PASS lines in the Gmail original view.
Authentication is necessary but not sufficient. A freshly authenticated domain still has no reputation. Ramp sending slowly, starting around 5 to 10 emails per day with a warmup tool and building to roughly 50 to 75 cold emails per inbox per day over 4 to 6 weeks, per LeadHaste. What good looks like: bounce rate under 2% and spam-placement rate near zero as volume rises. See what is email warm-up and why it matters.
Most authentication problems trace to a handful of mistakes. Check for these before you assume the setup is fine.
The Three-Lock Gate: SPF, DKIM, and DMARC are three locks on the same door. Inbox providers increasingly check all three, and one missing or broken lock compromises the whole gate.
Each lock does a distinct job. SPF answers "is this server allowed to send for this domain." DKIM answers "was this message actually signed by this domain and left unaltered." DMARC answers "does the visible From domain line up with the SPF and DKIM domains, and what happens if not." Only together do they prove a message is genuinely from you.
That is why partial setup underperforms so badly. A domain with SPF and DKIM but no DMARC has no alignment enforcement and no failure policy, and receiving servers treat it as less trustworthy. A domain with DMARC set to p=reject but a broken DKIM record will have its own legitimate mail rejected. The locks have to be installed together and checked together.
The quotable version: "Two out of three authentication records is not 67% delivered. It is a gate a filter can still refuse."
Authentication gets you eligible for the inbox. It does not get you into it. List quality, sending behavior, and engagement decide the rest, and a bounce-heavy list undoes clean records fast. See how to improve email deliverability and cold email deliverability guide.
Authentication is not a set-and-forget job. Three maintenance habits keep it working.
Perfect SPF, DKIM, and DMARC records still send bounces if the list is stale, and bounces damage the domain reputation those records are meant to protect. Authentication and list quality work together.
InboundLabs is a sales intelligence platform built on a database of 280M verified B2B contacts with 98% email deliverability on verified contacts. It lets you filter by industry, headcount, region, and title, so your authenticated domain sends to real inboxes and its reputation compounds instead of eroding on dead addresses. Monthly plans, no annual lock-in. Free to start, no credit card required.
See how InboundLabs finds verified contacts instantly → inboundlabs.app
Set SPF, DKIM, and DMARC on a dedicated sending domain before your first cold send. One SPF TXT record ending in ~all, the exact DKIM records your provider supplies, and a DMARC record starting at p=none for monitoring. Verify all three return PASS in a Gmail test, then warm the domain over 4 to 6 weeks before real volume. Authentication makes you eligible for the inbox; a verified list and steady sending get you the rest of the way.
Do I really need all three of SPF, DKIM, and DMARC for cold email?
Yes. Major inbox providers in 2026 effectively expect all three, and mail from a domain missing any of them is far more likely to be filtered or rejected. SPF authorizes the server, DKIM signs the message, and DMARC sets alignment and the failure policy. They only prove authenticity together.
Should my SPF record end in ~all or -all?
For cold email infrastructure, ~all (soft fail) is the common recommendation. -all (hard fail) is stricter and can cause legitimate mail to fail in some relay or forwarding setups. Start with ~all, and only move to -all once you are confident every sending source is listed.
What DMARC policy should I start with?
p=none, which is monitoring mode: receiving servers report failures but do not act on them. Include an rua address to collect aggregate reports. After a week or two of clean reports, tighten to p=quarantine, then optionally p=reject. Starting at p=reject risks rejecting your own valid mail.
How long do the DNS changes take to work?
Most propagate within a few hours, but allow 24 to 48 hours before assuming something is wrong. Verify with a checker like mxtoolbox.com and with a Gmail test email using "Show original" to confirm SPF, DKIM, and DMARC each show PASS.
Can I use my main company domain for cold email if it is authenticated?
You should not. Cold sending carries reputation risk, and a bad campaign can damage the domain your normal business email depends on. Use a dedicated sending domain, often a close variant, with its own SPF, DKIM, and DMARC records.
Does authentication alone get me into the inbox?
No. It makes you eligible. Domain reputation, sending-volume ramp, list accuracy, and recipient engagement decide placement from there. A fully authenticated domain sending to a stale list still bounces, and bounces erode the reputation the records protect.
LSI keywords: SPF record, DKIM signature, DMARC policy, DNS TXT record, dedicated sending domain, p=none monitoring, ~all soft fail, email authentication, mxtoolbox, domain warmup, Gmail show original, sender reputation
Yahoo sender requirements mirror Gmail's, with one sharper edge: Yahoo rejects non-compliant bulk mail outright instead of foldering it.
Google bulk sender requirements apply at 5,000 emails a day, but the thresholds that filter you apply to everyone. The full 2026 checklist.
How to get off an email blacklist: fix the root cause first, then request delisting. Skip the fix and you get relisted, often faster.
No commitment. No credit card. Just 50 free verified contact lookups.