Your cold emails keep landing in spam, and the missing piece is almost always email authentication.
Set up SPF, DKIM and DMARC on every domain you send from, in that order. SPF lists who may send, DKIM signs the message, and DMARC tells receivers what to do on a fail.
Below: DNS for Google Workspace and Microsoft 365, plus the cold-email traps most guides skip. Research from public docs only; we did not touch your live domains for this post.
What SPF, DKIM and DMARC each actually do
- SPF (Sender Policy Framework). A DNS TXT record that lists which servers may send mail for your domain. If the sending IP is not on that list, SPF fails.
- DKIM (DomainKeys Identified Mail). A cryptographic signature on the message. The receiver looks up your public key in DNS and checks that the body and key headers were not altered.
- DMARC (Domain-based Message Authentication, Reporting and Conformance). A policy that says what to do when SPF or DKIM fail to align with the visible From domain: monitor, quarantine, or reject. It also sends you reports.
Gmail and Yahoo both require authentication for personal inboxes. Over about 5,000 messages a day to Gmail, you need SPF, DKIM and a published DMARC record, with the From domain aligned to one of those checks. That rule is in Gmail's email sender guidelines.
Who this is for, and what you need ready
For founders and SDRs wiring a new outbound domain. If the root is already authenticated and you only need a sending subdomain, skim to the cold-email section. Before DNS:
- Access to your DNS host (Cloudflare, Namecheap, GoDaddy, Route 53, or whoever holds the zone).
- Admin access to Google Workspace or Microsoft 365 for the domain you will send from.
- A mailbox you control for DMARC reports, such as [email protected].
- A clear list of every service that sends as that domain: your ESP, CRM, form tool, billing app.
Our take: Put cold volume on a subdomain such as mail.yourbrand.com, authenticate that subdomain, and keep corporate mail on the root. One burned subdomain is cheaper than a burned brand domain.
The order that keeps you out of trouble
Do not publish p=reject on day one. Wait about 48 hours after SPF and DKIM pass, then start DMARC at p=none.
Email authentication in three layers
SPF first, then DKIM, then DMARC
-
Step 1 of 5
Publish one SPF TXT record
Merge every legitimate sender into a single record for that domain or subdomain. End with ~all while you are still learning who sends.
-
Step 2 of 5
Generate and publish DKIM
On Google Workspace prefer a 2048-bit key. On Microsoft 365 add both selector CNAMEs, then turn signing on. Wait for DNS to propagate before you enable signing.
-
Step 3 of 5
Add DMARC at p=none
After SPF and DKIM have been passing for about 48 hours, publish a monitor-only DMARC record with a rua mailbox you actually read.
-
Step 4 of 5
Tighten to quarantine, then reject
When aggregate reports show only known senders, move to p=quarantine. Move to p=reject only when you are sure nothing legitimate still fails.
-
Step 5 of 5
Verify on a real received message
Send to an external inbox, open the original headers, and confirm SPF=pass, DKIM=pass and DMARC=pass with alignment.
Set up SPF: one TXT record, every sender listed
SPF is a TXT record on the domain (or subdomain) in the SMTP MAIL FROM / Return-Path. One SPF record per name. Two on the same host return a permanent error.
Example records you can adapt
v=spf1 include:_spf.google.com ~allv=spf1 include:spf.protection.outlook.com ~allv=spf1 include:_spf.google.com include:servers.mcsv.net ~allIn Cloudflare or Namecheap, the host for the root is usually @. For mail.yourbrand.com, the host is mail and the SPF record sits on that subdomain.
~all vs -all, and the 10-lookup trap
~all (softfail) marks unauthorized mail as suspicious, usually spam. -all (hardfail) asks receivers to reject it. Google recommends ~all for Workspace. Start there while you audit senders, then move to -all once the list is clean.
Never use +all. That authorizes the entire internet to send as you.
SPF allows at most 10 DNS lookups. Each include, a, mx, exists or redirect counts, including nested vendor includes. ip4, ip6 and all do not. Cross the limit and you get a permerror that often fails DMARC.
Three ESPs on the root will blow that budget. Fix it with subdomains, not SPF flattening that hard-codes today's IPs and breaks when a vendor rotates them.
Set up DKIM: sign every outbound message
DKIM proves the message left a server that holds your private key and that key headers and the body were not rewritten. Receivers look up the public key at selector._domainkey.yourdomain.
Google Workspace
DKIM on Google Workspace
2048-bit key, then Start authentication
-
Step 1 of 5
Open Authenticate email
In the Admin console go to Apps, Google Workspace, Gmail, then Authenticate email. Pick the domain.
-
Step 2 of 5
Generate a 2048-bit record
Click Generate new record. Choose 2048-bit if your DNS host accepts long TXT values. Leave the selector as google unless that name is already taken.
-
Step 3 of 5
Add the TXT at your DNS host
Host is usually google._domainkey. Paste the full TXT value Google shows, including the p= public key. Save.
-
Step 4 of 5
Wait, then Start authentication
Give DNS time to propagate, often several hours and up to 48. Only then click Start authentication. Enabling too early fails quietly.
-
Step 5 of 5
Confirm on a real message
Send to an external Gmail address. Open Show original and look for DKIM=pass in Authentication-Results.
Host: google._domainkey
Type: TXT
Value: v=DKIM1; k=rsa; p=<your-public-key>Microsoft 365
Microsoft publishes two CNAMEs instead of a long TXT key, so it can rotate keys without another DNS edit. Signing stays off until you enable it after the CNAMEs resolve.
selector1._domainkey CNAME selector1-yourdomain-com._domainkey.yourdomain.onmicrosoft.com
selector2._domainkey CNAME selector2-yourdomain-com._domainkey.yourdomain.onmicrosoft.comIn Defender: Email authentication settings → DKIM → your domain. Add the two CNAMEs shown, wait for DNS, then toggle Sign messages for this domain.
Set up DMARC: monitor first, then enforce
DMARC is a TXT at _dmarc.yourdomain. It only helps after SPF or DKIM already authenticate mail, and the authenticated domain aligns with the From the recipient sees.
Phase 1: p=none
v=DMARC1; p=none; rua=mailto:[email protected]; pct=100p=none is monitor mode: receivers still check alignment and email aggregate reports to rua, but nothing is quarantined or rejected. Read those reports for two to four weeks before you change policy.
Phase 2 and 3: quarantine, then reject
v=DMARC1; p=quarantine; rua=mailto:[email protected]; pct=100v=DMARC1; p=reject; rua=mailto:[email protected]; pct=100Quarantine usually means the spam folder; reject means the message never lands. For many cold-email setups, quarantine is the practical long-term setting. A forgotten billing app under p=reject is mail you will never see bounce in your ESP UI.
Alignment: the part cold emailers miss
SPF can pass on a return-path domain and still fail DMARC if that domain does not align with the visible From. DKIM can pass on a signature domain that is unrelated to From. DMARC needs at least one aligned pass.
Relaxed alignment (the default) lets mail.brand.com align with brand.com. Strict alignment (aspf=s or adkim=s) demands an exact match. Start relaxed; flip to strict only after every sender is audited.
Cold email caveats most setup guides skip
Authentication is the floor, not the ceiling. Passing SPF, DKIM and DMARC does not warm a new domain or fix a purchased list. It stops you failing the checks Gmail and Yahoo now enforce.
- One authenticated domain per sending stream. Do not share one SPF record across five outreach tools on the root. Give each major stream a subdomain with its own SPF, DKIM and DMARC.
- Authenticate every domain you From. If Reply.io (no affiliate link on our site) sends as [email protected], get.brand.com needs the full trio. A tool that only signs its own domain will not save a From on yours.
- Custom tracking domains need DNS too. Click and open tracking hosts often need CNAME records the ESP provides. Leave them half-set and you break links or dilute reputation.
- Warm before volume. New domains and mailboxes need a gradual ramp. Auth first, then warm, then scale. Reversing that order burns the domain while the DNS is still wrong.
Still building the list? Our email scraping tools roundup and Hunter.io review cover sourcing. Try Hunter via droidcrunch.com/go/hunter.
Affiliate disclosure: some links are affiliate. If you buy through them, we may earn a commission at no extra cost to you.
How to verify the setup without guessing
After DNS has had time to propagate:
- Confirm there is exactly one SPF TXT on the sending name.
- Confirm the DKIM selector resolves (TXT for Google, both CNAMEs for Microsoft) and signing is enabled in the admin console.
- Confirm _dmarc returns your policy string.
- Send a real message to an external inbox you control. Open the original headers. You want SPF=pass, DKIM=pass and DMARC=pass.
Free DNS checkers are fine for a second opinion. Trust Authentication-Results on a real received message over a green badge on a marketing site.
Common mistakes that fail authentication
Fixes for the failures we see most
Duplicate SPF, early reject, broken alignment
-
Step 1 of 6
Two SPF TXT records on the same host
Merge them into one v=spf1 line. Multiple SPF records cause a permerror.
-
Step 2 of 6
include: for a tool you no longer use
Stale includes waste lookup budget and confuse audits. Remove them.
-
Step 3 of 6
DMARC p=reject before the report mailbox is clean
You will silently drop legitimate mail from a forgotten SaaS. Stay on p=none until the rua reports are boring.
-
Step 4 of 6
From domain does not match the signing domain
Point the ESP to send and sign as the domain in From, or change From to the domain you authenticated.
-
Step 5 of 6
Start authentication clicked before DKIM DNS exists
On Google Workspace, wait for the public key to resolve, then enable. Retry after a full day if it failed early.
-
Step 6 of 6
Strict alignment on a subdomain-heavy stack
aspf=s and adkim=s break mail.brand.com From brand.com setups. Keep relaxed until you mean it.
Where this fits the outreach tools we cover
Cold email platforms assume you bring authenticated domains. Our Reply.io review covers sequences on that stack. For a lighter ESP, see the Brevo review or start via droidcrunch.com/go/brevo.
Copy tools such as email writing software and ChatGPT for emails help the message. Auth keeps it out of spam. Inside WordPress, FluentCRM is an owned-list CRM, but the same DNS rules apply if it sends from your domain.
How we checked this
Facts above come from Google Workspace Help, Microsoft Learn Defender docs, and Yahoo's sender best practices, checked on 19 Oct 2026. We did not publish records on a live DroidCrunch domain. Treat the example strings as templates.
Frequently asked questions
Do I need SPF, DKIM and DMARC for cold email?
Yes if you want reliable inbox placement in 2026. Gmail requires SPF or DKIM for all senders, and all three once you cross roughly 5,000 messages a day to Gmail. Yahoo has matching bulk rules. Most cold sequences hit that bar within weeks.
Can one SPF record cover Google Workspace and my outreach tool?
Yes, as one merged TXT line with both include: mechanisms. Keep the total DNS lookups at 10 or under. If you add a third ESP, move that stream to its own subdomain instead of stacking more includes on the root.
Is p=none enough for Gmail bulk sender rules?
Yes. Gmail accepts a DMARC policy of none for the bulk-sender requirement. You still need SPF and DKIM passing with From alignment. Tighten to quarantine later for spoofing protection, not just for compliance.
Why does SPF pass but DMARC fail?
Usually alignment. SPF checked a return-path domain that does not match the visible From domain under your DMARC alignment mode. Fix the From, the MAIL FROM, or the DKIM signing domain so at least one aligned check passes.
How long before DNS changes take effect?
Often under an hour on modern DNS, but plan for up to 48 hours. Google asks you to wait about 48 hours after SPF and DKIM authenticate before adding DMARC. Do not enable DKIM signing until the public key resolves.
What is the SPF 10 lookup limit in plain English?
Receivers will only follow ten DNS lookups while evaluating your SPF record. Nested includes inside vendor records count. Go over ten and SPF returns a permanent error, which can fail DMARC under quarantine or reject.
Can I use the same DKIM key for Google and Microsoft?
No. Each provider issues its own key material. Google uses a TXT at google._domainkey by default. Microsoft uses two CNAMEs at selector1 and selector2. Publish both sets if both platforms send for the domain.
Does authentication replace email warmup?
No. Authentication only proves you are allowed to send as that domain. Warmup is a separate ramp of daily volume and positive replies that builds mailbox reputation. Do auth first, then warm for one to two weeks, then scale sequences.
Bottom line
Publish SPF, then DKIM, wait until both pass on real mail, then add DMARC at p=none. Tighten only when the reports are clean. Put cold volume on a subdomain, and authenticate every From domain you use.
That is the deliverability floor under Reply.io, Hunter and Brevo. Get the DNS right once, then spend your energy on the list and the offer.
