SPF verifies which servers can send on behalf of your domain, DKIM adds a cryptographic signature proving the message was not altered in transit, and DMARC tells receiving servers what to do when SPF or DKIM checks fail. For cold email, the minimum correct setup is: publish an SPF record listing your sending service, enable DKIM signing through that service, and add a DMARC record starting with a policy of none so you can monitor failures before enforcing rejections.
Why do inbox providers care about SPF DKIM DMARC authentication?
Every inbox provider faces the same problem: distinguishing legitimate senders from spammers and phishers. Authentication records give them a way to verify that an email claiming to come from your domain actually originated from a server you authorised.
Without these records, anyone can forge your domain in the "From" field. Inbox providers have no reliable way to trust the message, so they treat it with suspicion. That suspicion often means the spam folder or outright rejection.
When you set up SPF DKIM DMARC correctly, you are essentially vouching for your sending infrastructure. You are telling Gmail, Outlook and others: "These are my approved servers. If a message fails these checks, treat it accordingly."
This matters enormously for deliverability. Even a perfectly written cold email will struggle to reach the inbox if authentication is missing or misconfigured. Before you worry about subject lines or personalisation, get these three records right.
What is SPF and how do you set it up?
SPF stands for Sender Policy Framework. It is a DNS TXT record that lists the IP addresses and domains permitted to send email on your behalf.
When a receiving server gets an email from your domain, it looks up your SPF record and checks whether the sending server's IP appears in that list. If the IP matches, the SPF check passes. If not, it fails.
A basic SPF record looks like this:
v=spf1 include:_spf.google.com ~all
This example authorises Google Workspace servers to send for your domain. The ~all at the end is a soft fail, meaning unauthorised servers are flagged but not automatically rejected.
To set up SPF:
- Identify every service that sends email from your domain (your email provider, any sequencing tools, transactional email services).
- Gather the SPF include statements from each provider's documentation.
- Combine them into a single TXT record on your root domain.
- Keep the record under 10 DNS lookups to avoid exceeding SPF's lookup limit.
One common mistake is creating multiple SPF records. You can only have one per domain. If you add a second, both become invalid.
What is DKIM and why does it matter for cold email?
DKIM stands for DomainKeys Identified Mail. It works differently from SPF. Instead of checking server IP addresses, DKIM uses public key cryptography to verify message integrity.
When you enable DKIM, your sending service adds a digital signature to the email header. This signature is generated using a private key that only your sending service holds. The corresponding public key is published in your DNS.
When the receiving server gets the email, it retrieves your public key and uses it to verify the signature. If the signature matches, the server knows the message was not tampered with after leaving your authorised infrastructure.
For cold email, DKIM is particularly important because forwarding does not break it the way it can break SPF. When someone forwards your email, the DKIM signature remains intact, helping maintain trust through the delivery chain.
To enable DKIM:
- Go to your email provider or sending service's admin panel.
- Generate a DKIM key pair (the service usually does this automatically).
- Add the public key as a TXT record in your DNS, typically at a selector subdomain like
selector1._domainkey.yourdomain.com. - Enable DKIM signing in the service's settings.
Most reputable email providers make this straightforward. The main risk is copying the DNS record incorrectly, so double check for missing characters or extra spaces.
What is DMARC and what policy should you start with?
DMARC stands for Domain-based Message Authentication, Reporting and Conformance. It ties SPF and DKIM together and tells receiving servers how to handle messages that fail authentication.
A DMARC record includes a policy (what to do with failing emails) and typically a reporting address (where to send aggregate reports about authentication results).
The three policy options are:
p=none: Monitor only. Failing emails are delivered normally, but you receive reports.p=quarantine: Failing emails go to spam.p=reject: Failing emails are blocked entirely.
For cold email, start with p=none. This lets you collect data on what is passing and failing without risking legitimate emails being blocked. Once you are confident that all your authorised sending sources pass SPF and DKIM, you can move to quarantine and eventually reject.
A basic DMARC record looks like this:
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com
Add this as a TXT record at _dmarc.yourdomain.com.
The reports you receive are XML files. They are not human-friendly, but free DMARC report analysers can parse them into readable dashboards. These reports reveal if anyone is spoofing your domain or if you have forgotten to authorise a legitimate sending service.
How do SPF, DKIM and DMARC work together?
Think of these three protocols as layers of verification:
- SPF answers: "Was this email sent from an authorised server?"
- DKIM answers: "Is this email unaltered and signed by the domain owner?"
- DMARC answers: "What should happen when SPF or DKIM fails, and where should reports go?"
For a message to pass DMARC, it needs to pass either SPF or DKIM (or both) and the passing protocol must align with the domain in the "From" header. This alignment requirement prevents attackers from using a legitimate SPF record for one domain while forging a different domain in the visible "From" address.
When all three are configured correctly, inbox providers have strong signals that your emails are legitimate. This does not mean every email reaches the inbox (content, engagement and sender reputation still matter), but it removes a significant obstacle.
What happens if you skip authentication for cold outreach?
Without proper SPF DKIM DMARC setup, your cold emails face several problems:
- Inbox providers may reject messages outright or send them to spam.
- Your domain becomes easier to spoof, which can damage your reputation if attackers abuse it.
- You have no visibility into authentication failures, so problems go undetected.
- Warming up a new domain becomes harder because you are starting with negative trust signals.
For a complete setup process, see our cold email deliverability checklist. Authentication is the foundation, but list quality and sending behaviour matter too.
Does authentication alone solve deliverability problems?
No. Authentication is necessary but not sufficient. You can have perfect SPF DKIM DMARC records and still land in spam if:
- You are sending to invalid addresses (high bounce rate).
- Your content triggers spam filters.
- Recipients mark your emails as spam.
- You are sending too much volume too quickly from a new domain.
Authentication proves you are who you claim to be. It does not prove you are someone worth reading.
This is why list hygiene matters. Verifying email addresses before sending reduces bounces, which protects your sender reputation. You can verify email lists directly in Google Sheets before passing them to your sequencer.
Similarly, reducing your email bounce rate requires catching invalid addresses before they ever reach your sending infrastructure.
How do you verify your records are working?
After adding SPF, DKIM and DMARC records, verify them:
- Use a DNS lookup tool to confirm the records are published correctly.
- Send a test email to a service like Mail Tester or check the email headers manually.
- Look for "spf=pass", "dkim=pass" and "dmarc=pass" in the headers.
- Wait for DMARC reports to arrive (they are typically sent daily) and check for failures.
Common errors include typos in DNS records, propagation delays (DNS changes can take up to 48 hours), and forgetting to authorise a sending service.
Where does list preparation fit into this?
Authentication handles the "are you legitimate" question. List preparation handles the "should you be sending to this person" question.
Before your sequencer sends a single email, you need:
- Verified email addresses to minimise bounces.
- Relevant targeting so recipients might actually care.
- Personalisation that demonstrates you understand their context.
Sorzio helps with the preparation stage. It verifies email addresses, enriches lead data by reading company websites, and runs AI prompts across columns to personalise cold email at scale. The verified, enriched, personalised list then goes to whatever sequencer you use for actual sending.
Good firmographic enrichment helps you understand who you are emailing. Combined with proper authentication, you are giving your outreach the strongest possible foundation.
Common questions
Do I need all three records or can I skip one?
You need all three. SPF and DKIM handle different aspects of authentication, and DMARC ties them together with policy and reporting. Skipping any one leaves gaps that inbox providers notice.
How long does it take for DNS changes to take effect?
DNS propagation typically takes a few hours but can take up to 48 hours. During this window, some servers may see the new records while others still see the old ones. Avoid sending high volumes until propagation completes.
Can I use the same SPF and DKIM records for multiple sending services?
Your single SPF record must include all authorised senders. DKIM is different: each sending service typically has its own selector and key pair, so you will have multiple DKIM records (at different selector subdomains) coexisting without conflict.
What if my DMARC reports show failures I do not recognise?
Unrecognised failures could indicate spoofing (someone forging your domain) or a legitimate service you forgot to authorise. Investigate before moving to a stricter DMARC policy. If it is spoofing, a reject policy will eventually block those forgeries.
Does authentication affect whether my email gets opened?
Authentication affects whether your email reaches the inbox at all. Once it arrives, opens depend on your subject line, sender name and timing. For subject line guidance, see our subject line for cold email article.