What are SPF, DKIM and DMARC, and how do you set them up for cold email?

Receivers cannot see who really sent a message, so they check three DNS records on the domain in the From address. Those records are Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message Authentication, Reporting and Conformance (DMARC). A cold sender without them gives a receiver one more reason to distrust the message.

What does each record do?

DMARC also checks alignment. The domain that passed SPF or DKIM has to match the domain in the visible From address. A message can pass SPF and still fail DMARC if the two domains differ.

How do you set them up?

Follow the steps in this order, and do the steps for each sending domain.

1. Publish SPF. Add one TXT record at the root of the domain that names your mail provider. For Google Workspace the record contains include:_spf.google.com, and for Microsoft 365 it contains include:spf.protection.outlook.com. A record looks like v=spf1 include:_spf.google.com ~all. Publish one SPF record per domain and merge every sender into it.
2. Turn on DKIM. Generate the key in your provider's admin console, then publish what it shows you. Google gives a TXT record at a selector, and Microsoft 365 uses two CNAME records. Then switch signing on in the console.
3. Publish DMARC. Add a TXT record at _dmarc.yourdomain.com, for example v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. The rua address receives aggregate reports.
4. Wait, then check. DNS changes can take time to spread. Send a test to a mailbox at Gmail and view the message headers for spf=pass, dkim=pass and dmarc=pass.
5. Read the reports. After a few weeks, confirm that your legitimate mail passes. Then consider moving the policy to p=quarantine and later to p=reject.

What do the DMARC policies mean?

p=none takes no action and collects reports. p=quarantine asks receivers to treat failing mail with suspicion, usually by sending it to spam. p=reject asks them to refuse it. Start at none. A stricter policy before you have read your reports can block your own mail.

Which mistakes break authentication most often?

• Two SPF records. A domain may publish one. Merge them.
• Too many lookups. SPF allows 10 DNS lookups in total. Each include can add several, so a long chain of tools can push you over the limit.
• Signing set up but not switched on. Publishing the DKIM key does nothing until the provider signs messages with it.
• A different From domain. If a mailbox sends as an address on another domain, SPF and DKIM do not align, and recipients with a quarantine or reject policy may drop the email.
• Setting DMARC to reject too early. Read reports first.

Why does it matter for cold email in particular?

Cold email goes to people who have no relationship with you, so a receiver has little to go on except technical signals. Gmail and Yahoo require SPF, DKIM and DMARC from bulk senders, and the records are sensible for any sender. Passing authentication does not decide where a message lands. It removes one reason for a filter to distrust you.

Many teams send cold email from a secondary domain close to the main one, so that a problem with sending reputation does not reach the domain that carries customer email. Each secondary domain needs its own full set of records.

What are the limits of a check?

A passing result describes the day it was run. A record can change the day after, when someone edits DNS. A DKIM check also needs to know the selector, which belongs to the mail provider and cannot be read from the domain alone. An honest tool says when it could not check, and it dates every result.

How does anymail check your domain?

anymail runs a domain audit that checks SPF, DKIM and DMARC for each sending domain and shows the date of the last check. For DKIM it tries common selectors, and when it cannot find one it reports that it could not check instead of showing a pass. Each record has a link to instructions for setting it up. See the deliverability page for the rest of what the audit covers.