SPF, DKIM and DMARC for cold email: how to set them up

SPF, DKIM and DMARC are three public settings on your domain that prove your emails really come from you. For cold email, set up SPF and DKIM before your first send, and add DMARC 48 hours later, which is the wait Google asks for. It's a few copy-and-paste changes.

Why cold email needs all three

You send a good email and it lands in spam, or it comes back saying "This email has been rate limited because it is unauthenticated." That's Gmail saying it can't confirm the email came from you. Anyone can type your company's name into the "From" line, so inboxes check.

Think of a company letter:

Here's what the big inboxes require:

You probably won't send 5,000 a day, and these rules don't cover company inboxes on Google Workspace or Microsoft 365. Set up all three anyway. Google says "we recommend that you always set up SPF, DKIM, and DMARC", and Microsoft says "all senders benefit".

Before you start

• Access to your domain's DNS. DNS holds your domain's public settings. You change them where you bought the domain or where it's hosted.
• An admin account at your email provider. On Google Workspace, it has to be a super administrator.
• A look at what you already have. Run your domain through the free DMARC checker, and skip any step that already shows OK.

If you send from an @gmail.com or @outlook.com address, you can skip this guide. Those domains belong to Google and Microsoft, and you can't change their settings.

Step 1: Add your SPF record

An SPF record is one line of text in your DNS, called a TXT record. Add a new record with these settings:

The ending tells inboxes how to treat email from anywhere else. Use the one your provider gives you.

A domain can only have one SPF record. Two cancel each other out, so if you already have one, add to it. If another service also sends as your domain, one line covers both, like this: v=spf1 include:_spf.google.com include:amazonses.com ~all.

Step 2: Turn on DKIM

DKIM needs two things: your provider creates a key, and you publish it in DNS. Then your provider starts signing your emails.

Google Workspace

1. In the Google Admin console, go to Menu, Apps, Google Workspace, Gmail, then click Authenticate email.
2. Select your domain and click Generate New Record. Choose 2048, keep the prefix google and click Generate.
3. At your domain host, add a TXT record with the DNS Host name and TXT record value Google shows. The host starts with google._domainkey.
4. Back on Authenticate email, click Start authentication. When it's working, the page says "Authenticating email with DKIM".

Google says this can take up to 48 hours, and until then the page may tell you to update your DNS records. If you only just turned on Gmail, you may have to wait 24 to 72 hours before you can create the key.

Microsoft 365

1. Go to security.microsoft.com/authentication and open the DKIM tab.
2. Find your domain and switch its toggle to Enabled. You'll get an error, which is expected because the DNS records don't exist yet. Click OK.
3. Click your domain's row. Under Publish CNAMEs, copy the two values.
4. At your domain host, add two records of type CNAME, which point one name at another. The hosts are selector1._domainkey and selector2._domainkey, each with the value Microsoft shows.
5. Wait a few minutes or longer. Then go back to your domain and turn on Sign messages for this domain with DKIM signatures. The status should say "Signing DKIM signatures for this domain".

Another provider: search its help pages for DKIM. The idea is the same: it gives you a record to publish, then you turn signing on.

Step 3: Add your DMARC record

Wait until SPF and DKIM have been working for 48 hours, which is what Google asks. Adding DMARC too early can cause delivery problems.

First, create a mailbox or group for the reports, such as dmarc-reports@example.com. They usually arrive once a day, and Google advises against using your own address.

Then add this record, with your own domain in the address:

p=none means "take no action, just report". rua is where the reports go.

Some hosts add your domain to the Host field by themselves, and some need you to type _dmarc.example.com. After saving, check that the name isn't doubled.

Check it worked

1. Run your domain through the DMARC checker again. You want OK on all four lines. It remembers each result for an hour, so a fix can take that long to show.
2. Send a real email to a Gmail address that isn't yours. Google says you can't verify DKIM with a test message to yourself.
3. Open it in that Gmail account, click More (the three dots next to Reply), then Show original. Look for spf=pass, dkim=pass and dmarc=pass.

Common mistakes

How Coldoutbound helps

Coldoutbound sends through your own mailbox, so you don't add anything for Coldoutbound itself. Each mailbox's page has a Domain health card with these same checks and what to fix, so you see a problem before you send.

Read more: Gmail's sender guidelines, Yahoo's sender requirements, Outlook's sender requirements, Google on SPF, Microsoft on SPF, Google on DMARC.