What DNS records are needed for cold email?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
Before your first cold email lands anywhere, your DNS needs to be in order. Missing records don't just hurt deliverability, they give filters an easy excuse to reject you entirely.
Here's what you need and why each one matters:
MX records specify which mail servers receive email for your domain. Even if you're only sending, not receiving, you need MX records. Receiving servers check for them as a basic legitimacy signal. A domain without MX looks like a throwaway sending domain.
SPF record (a DNS TXT record) lists which IP addresses and services are authorized to send email from your domain. Your ESP provides the exact value. Without it, receiving servers can't verify your emails are legitimate, and many will filter or reject them.
DKIM record (a DNS TXT record) publishes the public key that receiving servers use to verify your email's cryptographic signature. Your ESP generates the key pair and tells you the exact record to add. Once it's in DNS, every email you send is signed and verifiable.
DMARC record (a DNS TXT record) tells receiving servers what to do when SPF or DKIM checks fail. Start with p=none to monitor without affecting delivery, then move to p=quarantine once everything is clean.
There are also optional records that become relevant at scale: BIMI (brand logo in inbox) requires a DMARC policy of p=quarantine or p=reject first. MTA-STS enforces TLS encryption on inbound connections. Both are nice-to-have, not required for cold email.
After adding each record, give DNS up to 48 hours to propagate. You can verify all of them are live with our free SPF checker, DKIM lookup, and DMARC parser. If something isn't parsing correctly, debugging auth failures is easier before you've sent at volume than after. Understanding what each record does also helps when you need to troubleshoot: the DMARC policy is the layer that ties SPF and DKIM together.
Our free email header analyzer can also confirm all three are passing on actual sent mail, not just that the records exist in DNS.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
