SPF, DKIM and DMARC setup for cold email

SPF: name the servers, then stop

An SPF record is a single TXT record on the domain that lists authorised senders. It is read from left to right and has a hard limit of ten DNS lookups, so a long chain of includes is not free. If your provider tells you to add an include, add it once and remove the ones you no longer use.

The record ends with a policy. For an outreach domain, -all is the honest choice: it tells receivers that anything not listed is forged. ~all is softer and invites receivers to treat unlisted mail as suspicious rather than reject it. Either is workable; what is not workable is leaving no policy at all.

• One TXT record, not several competing ones on the same name.
• Every include still belongs to a service you actually send through.
• Stay under ten DNS lookups; flatten or split if you cannot.
• End with -all after you have confirmed the sender list is complete.

DKIM: the part that survives forwarding

DKIM signs selected headers and the body with a private key, and publishes the matching public key at a selector address. Because the signature travels with the message, it still verifies after a forward, which is why it carries more weight than SPF for reputation.

Your provider generates the selector and gives you a TXT record to publish. Rotate keys on a schedule you can remember, and keep the old selector published until its messages have expired. A selector that disappears while messages signed with it are still in flight turns valid mail into failures.

• 2048-bit key, published as a TXT record at selector._domainkey.domain.
• Sign the From, Subject, Date and Message-ID headers at minimum.
• Publish the new selector before switching signing to it.
• Check the signature on a real message, not only that the record resolves.

Authentication is the floor, not the whole score; sender reputation explains what else receiving servers weigh.

DMARC: choose a policy you can actually support

DMARC ties SPF and DKIM to the visible From domain through alignment, and tells receivers what to do on failure. Start at p=none with a reporting address, read the reports for a couple of weeks, then move to quarantine and finally reject.

Alignment is the detail people miss. SPF can pass while the message still fails DMARC because the envelope domain differs from the From domain. If you send through a provider that rewrites the return path, rely on DKIM alignment and make sure the signing domain matches the From domain.

• p=none with rua reporting first, so failures are visible before enforcement.
• Move to p=quarantine only when the reports are understood.
• p=reject when legitimate mail passes consistently.
• Decide adkim and aspf explicitly if your setup relies on subdomains.

Once all three records verify, run the rest of the deliverability checklist.

Verify with a message, not a lookup

A DNS lookup proves the records exist. It does not prove that your provider signs with the selector you published, or that the return path matches the domain. Send one message to a mailbox you control, open the full headers, and confirm three things: SPF passed for the envelope domain, DKIM verified with the expected selector, and DMARC passed with alignment.

Worked example: a sender published SPF and DKIM correctly but still failed DMARC. The provider signed with a shared selector on its own domain, so DKIM aligned with the provider, not with the From domain. Moving to a selector on the client domain made alignment pass and the spam complaints stopped arriving with the bounce reports.

Keep the DNS you need and nothing more

Every additional record is a future failure. Remove abandoned includes, delete selectors for providers you left, and keep one owner for the zone. If a marketing agency adds a record without telling you, the next DMARC report is where you find out, and by then a campaign has already run.

Write the records down in a place the team can find, with the date and the provider. A one-page note prevents the most common outage in outreach: a record changed by someone who did not know it was load-bearing.

If maintaining the sending infrastructure is the obstacle, managed cold email sending runs campaigns on authenticated mailboxes for you.

What each record does and what a failure looks like

Records above are the minimum for an outreach domain. A domain that only sends and cannot receive will lose its bounce and reply signals.

Frequently asked questions