SPF says which servers may send email for your domain. DKIM signs each message so providers can see it was not altered. DMARC tells providers what to do if SPF or DKIM fail and sends you reports. You add all three as DNS records, then test them with a message to your own Gmail account.
If your cold emails keep landing in spam, authentication is one of the first things to check. It is also one of the few causes you can fully fix. This guide explains the three records in plain English, who needs them and how to set them up. It is part of our wider look at why cold emails go to spam.
What SPF, DKIM and DMARC do
- SPF (Sender Policy Framework). A record that lists the servers allowed to send email for your domain. If a message arrives from a server that is not on the list, the provider can treat it with suspicion.
- DKIM (DomainKeys Identified Mail). Your email system adds a digital signature to every message. The receiving provider checks it against a public key in your DNS to confirm the message is genuine and unchanged.
- DMARC. A policy record that sits on top of SPF and DKIM. It tells providers what to do when the checks fail (nothing, quarantine or reject) and where to send reports about who is sending mail as your domain.
Do you need them for cold outreach?
Google's sender guidelines ask all senders who email Gmail addresses to use SPF or DKIM. Senders of more than 5,000 messages a day to Gmail must use both, plus DMARC, and offer one-click unsubscribe on marketing mail. You may send far fewer than that. Even so, setting up all three is cheap, takes less than an hour and removes an obvious reason for providers to distrust you.
Note that these requirements are about authentication, volume and complaints, not a promise that your email will reach the inbox. Reputation, wording and list quality still matter.
How to set them up
- Use a domain you own. You cannot authenticate a free Gmail or Outlook address in the same way.
- Find your email provider's instructions. Google Workspace, Microsoft 365 and most outreach tools each give you the exact records to add. Use their values, not a copy from a blog.
- Add the SPF record. In your domain's DNS settings, add a TXT record that includes your provider. There must be only one SPF record per domain, so if one exists, edit it instead of adding a second.
- Turn on DKIM. Your provider generates a key. You publish it as a DNS record (usually a TXT or CNAME), then switch signing on in the provider's settings.
- Add a DMARC record. Start with a monitoring policy. A basic record looks like this:
v=DMARC1; p=none; rua=mailto:you@yourdomain.com. Theruaaddress receives reports. - Wait for DNS to update. Changes can take from a few minutes to a day or more to spread.
How to test that it works
- Send an email from your domain to your own Gmail address.
- Open it, click the three dots and choose Show original.
- Check that SPF, DKIM and DMARC all say PASS.
If you send enough volume, Google Postmaster Tools shows reputation and spam rate data for your domain.
Common mistakes
- Two SPF records. A domain should have just one. Merge them.
- Too many lookups in SPF. SPF allows a limited number of DNS lookups. Adding many tools can break it.
- Forgetting to switch DKIM on. Publishing the record is not enough. Signing must be enabled with your email provider.
- Jumping straight to a strict DMARC policy. Start with p=none, read the reports, then tighten once legitimate mail passes.
- Assuming authentication fixes everything. It shows who you are. It does not make an unwanted email wanted.
After authentication: the rest of the checklist
Once your records pass, focus on what recipients see: a short, personal message, no attachments in the first email, a clean list and a slow start. Our guide to why cold emails go to spam walks through that step by step. If you would rather not run outreach yourself, our link building services handle it for you, or request a free proposal.
Frequently asked questions
What are SPF, DKIM and DMARC?
They are DNS records that help mail providers confirm an email really comes from your domain. SPF lists the servers allowed to send for you, DKIM adds a digital signature to each message, and DMARC tells providers what to do when those checks fail and sends you reports.
Do I need SPF, DKIM and DMARC for cold outreach?
Google requires SPF or DKIM from everyone who emails Gmail addresses, and DMARC from bulk senders of more than 5,000 messages a day. Even if you send far fewer, setting up all three removes an easy reason for filtering.
Will authentication keep my emails out of spam?
No. It proves who you are but not that your email is wanted. Sender reputation, wording, list quality and recipient reactions still decide where the message lands.
What DMARC policy should I start with?
Most people start with p=none, which only monitors and sends reports without affecting delivery. Once you know that all your legitimate mail passes, you can move to a stricter policy.
How do I test that my records work?
Send an email to your own Gmail address, open it, choose Show original and check that SPF, DKIM and DMARC show as pass.
Khalil is the founder of Serpify Media, a link building and guest posting agency. He writes about honest, research-led off-page SEO. Meet the team.
