SPF, DKIM, and DMARC Setup for Cold Email: Step-by-Step for Outbound Teams

Skipping email authentication can create avoidable outbound risk. SPF, DKIM, and DMARC help receiving mail servers assess sending identity and alignment; missing or misaligned records may increase rejection or spam-placement risk, depending on the provider and sending pattern.

Here is how to set up all three correctly for cold email outbound.

Why Authentication Matters More Than Ever

Google and Microsoft both published sender requirements that went into effect in 2024. Any domain sending more than a few thousand messages per day must pass SPF and DKIM alignment and publish a DMARC policy. Even below that threshold, the same signals feed deliverability scoring across all major providers.

Cold email lives and dies by inbox placement. A technically clean sending infrastructure is the floor, not a differentiator. If you are working with a done-for-you cold email partner or building your own outbound engine, authentication must be confirmed before sequences go live.

Fix the DNS first. Then worry about the copy.

Setting Up SPF

SPF (Sender Policy Framework) is a TXT record on your domain that lists the mail servers authorized to send on your behalf.

Basic structure:

v=spf1 include:_spf.google.com include:sendgrid.net ~all

How to build yours:

1. Identify every service that sends email from your domain: your CRM, your cold email platform, Google Workspace or Microsoft 365, any transactional provider.
2. Get the include value from each provider’s documentation.
3. Add one TXT record at @ (root) or at your sending subdomain.
4. End with ~all (softfail) while testing, then tighten to -all (hard fail) once you are confident the list is complete.

Keep the SPF record under ten DNS lookups. If you have many sending services, use SPF flattening tools to merge IPs into a single include.

Setting Up DKIM

DKIM (DomainKeys Identified Mail) works by adding a cryptographic signature to outgoing messages. The receiver checks the signature against a public key published in your DNS.

Each sending platform generates its own DKIM key pair. You publish the public key; the platform signs messages with the private key.

Steps:

1. In your email sending platform (Instantly, Smartlead, Google Workspace, etc.), navigate to domain authentication or DKIM settings.
2. Copy the CNAME or TXT record the platform generates. It will look something like: google._domainkey.yourdomain.com pointing to a long public key string.
3. Add that record to your DNS exactly as shown, including the selector prefix (google._domainkey, s1._domainkey, etc.).
4. Return to the platform and click “Verify.” Most platforms will confirm the key is live within a few minutes of DNS propagation.

If you run multiple sending domains (which you should for any serious outbound program), each domain needs its own DKIM record configured per sending provider.

Setting Up DMARC

DMARC (Domain-based Message Authentication, Reporting, and Conformance) ties SPF and DKIM together and tells receivers what to do when a message fails both checks.

Minimum valid record:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

Add this as a TXT record at _dmarc.yourdomain.com.

Policy progression for outbound teams:

• p=none: monitoring only. No messages are blocked. You receive aggregate reports at the rua address.
• p=quarantine: failing messages go to spam. Move here after your reports show clean alignment for several weeks.
• p=reject: failing messages are dropped entirely. The strongest protection for your domain reputation.

The rua tag should point to a real mailbox or a DMARC reporting service. Parse the XML reports (or use a tool that does it for you) to catch any sending sources you missed in your SPF record.

The Sending Subdomain Strategy

Most teams running AI cold email at volume route outbound through dedicated subdomains: mail.yourdomain.com, outbound.yourdomain.com, or secondary domains purchased specifically for campaigns.

Each subdomain needs its own SPF, DKIM, and DMARC configuration. The benefit: if a domain accumulates spam complaints or a high bounce rate, you rotate it out without touching your root domain’s reputation. GDPR-compliant outbound programs also use separate domains to enforce data handling boundaries by region or campaign type.

For reference on sender requirements, Google’s guidelines for bulk senders are published at support.google.com.

Verifying Everything Before You Send

After configuring all three records, run this checklist:

1. Send a test email to a tool like MXToolbox Email Health or mail-tester.com.
2. Check the raw headers of a received message and confirm Authentication-Results shows SPF=pass, DKIM=pass, DMARC=pass.
3. In your sending platform, look for a “Domain Health” or “Sending Authentication” status page. Most modern platforms surface this clearly.
4. Wait at least 24 hours and check your DMARC aggregate report for any unexpected failures.

Authentication is not a one-time setup. When you add a new sending platform, update your SPF. When you rotate DKIM keys (which your provider may do automatically), verify the new record is live. Audit your configuration every time you change infrastructure.

If you are building this for the first time or inheriting a broken setup, done-with-you outbound programs typically include a technical audit of your sending infrastructure as part of the onboarding, so you start clean.