SPF, DKIM and DMARC: the cold email setup checklist

Before you send a single cold email, your domain needs to prove it is who it says it is. Three DNS records do that: SPF, DKIM and DMARC. Large mailbox providers expect them from anyone sending email at volume, and missing records are a common reason mail goes to spam.

SPF: who may send for this domain

SPF (Sender Policy Framework) is a DNS record listing the servers allowed to send email for your domain. When a message arrives, the receiving server checks whether the sending server is on that list. If you use Google Workspace or Microsoft 365, your provider gives you the value to publish.

DKIM: this message was not tampered with

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each message. The matching public key is published in your DNS. The receiving server uses it to confirm the message really came from your domain and was not changed in transit.

DMARC: what to do when checks fail

DMARC ties SPF and DKIM to the address people see in the From line, and tells receivers what to do when a message fails: nothing, quarantine it, or reject it. It can also send you reports so you can see who is sending mail in your name. Start with a monitoring policy, then tighten it once you know your real mail passes.

The checklist

1. Use a sending domain you control, and think about keeping cold outreach on a separate domain from your main website domain to protect it.
2. Publish an SPF record that includes your email provider.
3. Turn on DKIM signing in your email provider and publish the key it gives you.
4. Publish a DMARC record, starting with a monitoring policy.
5. Make sure the domain has valid MX records and a working reply path.
6. Send test messages to a few of your own inboxes and confirm they pass the checks in the message headers.

Want to see where your domain stands right now? Our free checker looks up all four records and explains what to fix. Check your SPF, DKIM and DMARC →

Then warm up and send gently

New mailboxes have no reputation. Start with small volumes and increase gradually, and keep an eye on bounces and complaints. Reachbox spaces out sends and pauses mailboxes that need a cooldown, but the DNS records above are your job and are worth doing first.

Mailbox providers publish their own sender requirements and they change. Check your provider's current documentation for exact thresholds and policies.