SPF, DKIM, and DMARC Explained (Simple Guide for Cold Email)

If you send cold email without proper SPF, DKIM, and DMARC, you are asking providers to treat you as suspicious. These three records are not optional extras — they are how the modern inbox decides whether you are allowed to speak for a domain.

SPF (Sender Policy Framework)

SPF is a TXT record on your domain that lists which servers may send mail as you.

Example shape:

v=spf1 include:_spf.google.com include:sendgrid.net ~all

Important limits:

• One SPF record per domain (multiple records break authentication)
• Max 10 DNS lookups in the chain (includes, redirects, etc.)

Over 10 lookups and many receivers return a permanent SPF error. Audit your live record with the SPF checker or build a clean one with the SPF record generator.

DKIM (DomainKeys Identified Mail)

DKIM attaches a cryptographic signature to each message. Receivers look up your public key in DNS (at selector._domainkey.yourdomain.com) and verify the signature.

Common selectors:

• google (Google Workspace)
• selector1 / selector2 (Microsoft 365)
• default, k1, s1, s2 (various ESPs)

If the public key is missing or the message was altered in transit, DKIM fails. Use the DKIM checker to confirm keys exist for the selectors you use.

DMARC (Domain-based Message Authentication)

DMARC sits on top of SPF and DKIM. It tells receivers what to do when authentication fails:

| Policy | Meaning |
|--------|---------|
| p=none | Monitor only — do not block |
| p=quarantine | Failures go to spam |
| p=reject | Failures are rejected |

Publish DMARC at _dmarc.yourdomain.com. Always include a rua= address so you receive aggregate reports. Check the live policy with the DMARC checker or generate a starting record with the DMARC generator.

The practical setup order

1. Fix SPF (valid record, under 10 lookups)
2. Enable DKIM at your ESP or mailbox provider
3. Publish DMARC at p=none with reporting
4. Watch reports for 2–4 weeks
5. Move to quarantine, then reject when aligned

Run a full pass with the email authentication checker after each change.

Why this matters for cold email

Cold outreach already starts with low trust. Without SPF/DKIM/DMARC alignment, you stack the deck against yourself. With them in place, you are eligible for the inbox — then list quality, warmup, and copy decide the rest.

Need this wired correctly across primary and secondary domains? Tell us what you are sending.