What authentication (SPF, DKIM, DMARC) should be in place?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
All three. No exceptions for cold email. Here's what each one does and what to configure.
SPF (Sender Policy Framework) tells receiving mail servers which IP addresses are allowed to send email for your domain. You add a DNS TXT record that lists your authorized sending sources. For most cold email setups, your ESP gives you the exact SPF include value to add. One record, one DNS edit, done.
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every email you send. The receiving server checks the signature against a public key in your DNS. If it matches, the email wasn't tampered with in transit. Your ESP generates the key pair and tells you which DNS record to add. The value looks intimidating but you're just copying and pasting it.
DMARC (Domain-based Message Authentication) sits on top of SPF and DKIM and tells receiving servers what to do when messages fail those checks. Start with p=none (monitor only), then move to p=quarantine once you've confirmed your legitimate sending is passing authentication cleanly.
Since 2024, Google and Yahoo require all three for bulk senders. For cold email specifically, missing any of them gives mailbox providers an easy reason to filter you before a human ever sees your message.
After setting up each record, DNS propagation takes up to 48 hours. You can verify your records are live and parsing correctly with our free SPF checker, DKIM lookup, and DMARC parser.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
