- SPF, DKIM, and DMARC are all three required for reliable cold email deliverability — any one missing degrades inbox placement.
- Never send cold email from your primary business domain; use a dedicated secondary domain to protect your main reputation.
- Start DMARC at p=none with a reporting address, review the reports for several weeks, then tighten the policy incrementally.
- Complete a pre-send authentication checklist on every new sending domain before the first message goes out.
- Good infrastructure only pays off if your contact list is accurate — verified contacts and clean authentication together determine real campaign results.
Why Do SPF, DKIM, and DMARC Matter for Cold Email?
Email providers use these three protocols together to decide whether a message is legitimate. SPF checks that your mail came from a server you authorized. DKIM proves the message body was not tampered with in transit. DMARC ties the first two together and gives you reporting so you can see what is failing.
For cold email specifically, the stakes are higher than for newsletters. You are emailing people who did not opt in, so inbox providers apply stricter filters. A domain with no DMARC record is a flag. A domain with no DKIM signature is another flag. Stack two or three flags and your entire campaign goes to spam regardless of how good the copy is.
Google and Yahoo made bulk sender authentication mandatory in 2024 for anyone sending more than 5,000 messages per day to their users. Even if you send smaller volumes, the same logic applies: authenticated domains get better treatment across the board.
How Do You Set Up SPF for Cold Email?
SPF is a TXT record you add to your domain's DNS. It lists the mail servers allowed to send on your domain's behalf. If you use Google Workspace to send, the record looks like this:
Type: TXT Host: @ Value: v=spf1 include:_spf.google.com ~all
If you use a dedicated cold email tool like Instantly or Smartlead and they route through SendGrid or Amazon SES, replace the include value with the provider's own SPF include string, which they will give you in their documentation. Never stack more than one SPF record on the same host. Multiple TXT records with v=spf1 cancel each other out and cause failures.
The ~all at the end means soft fail: messages from unauthorized servers are accepted but marked. Use -all (hard fail) only after you have confirmed your setup is complete and no other systems send on your behalf, otherwise you will block your own legitimate mail.
How Do You Set Up DKIM for Cold Email?
DKIM requires generating a public/private key pair. Your sending platform handles the private key; you publish the public key as a TXT record in DNS. The process differs slightly by platform but follows this pattern:
1. In your sending platform (Google Workspace, Microsoft 365, Instantly, etc.), navigate to email authentication or DKIM settings. 2. Generate a DKIM key. Google Workspace uses a 2048-bit key by default, which is the minimum you should accept. 3. Copy the DNS record the platform gives you. It looks like: selector._domainkey.yourdomain.com pointing to a long public key string. 4. Add that TXT record in your DNS registrar (Cloudflare, Namecheap, GoDaddy, etc.). 5. Return to your sending platform and click Authenticate or Verify.
DNS changes can take up to 48 hours to propagate, though most registrars resolve within minutes to a few hours. Use MXToolbox's DKIM lookup to confirm the record is live before you start sending.
How Do You Set Up DMARC for Cold Email?
DMARC is another TXT record, this time at _dmarc.yourdomain.com. Start permissive and tighten over time. A safe starting record:
Type: TXT Host: _dmarc Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com
p=none means take no action on failures, just report them. This lets you monitor without breaking anything. After two to four weeks, review the reports. If everything looks clean, move to p=quarantine, then eventually to p=reject.
The rua address receives aggregate XML reports from Gmail, Yahoo, and other providers showing which messages passed or failed authentication. You can parse these manually or use a free tool like Postmark's DMARC Digests to make them readable. Do not skip the reporting address. Blind DMARC gives you none of the visibility that makes the protocol useful.
Should You Send Cold Email From Your Main Domain?
No. This is the single most important operational decision in cold email infrastructure. If your main domain gets spam-flagged or blacklisted, your entire business email goes down with it.
Buy one or two secondary domains that closely resemble your main brand. If your company is acmepainting.com, register acme-painting.com or getacmepainting.com. Set up SPF, DKIM, and DMARC on each sending domain exactly as described above. Limit each domain to a modest daily send volume and rotate across them.
This also means you can warm up each new domain gradually without affecting the domain your team uses for day-to-day correspondence. A domain warmup period of four to eight weeks, starting at low daily volumes and increasing incrementally, is standard practice before any serious cold campaign.
What Does a Complete Pre-Send Authentication Checklist Look Like?
Run through this before any cold campaign goes out:
☐ SPF TXT record is live on the sending domain with the correct include for your mail provider ☐ No duplicate SPF records exist on the same host ☐ DKIM key is 2048-bit or higher and verified by your sending platform ☐ DKIM TXT record resolves correctly in MXToolbox DKIM checker ☐ DMARC TXT record is live at _dmarc.yourdomain.com ☐ DMARC rua reporting address is active and monitored ☐ Sending domain is not your primary business domain ☐ Sending domain has been warmed up for at least four weeks ☐ Reverse DNS (PTR record) on your mail server matches the sending domain ☐ Sending domain is not on any major blocklist (check MXToolbox Blacklist Lookup)
If any item is unchecked, fix it before sending a single message. Deliverability problems compound. A domain that starts with poor authentication builds a negative reputation that is slow and painful to recover.
How Does This Connect to the Contacts You Actually Reach Out To?
Authentication infrastructure determines whether your email is delivered. The quality of your contact list determines whether it is worth delivering. Both matter and neither substitutes for the other.
A tool like JAYISAAC lets you search North American businesses in plain English and reveal verified business emails and direct phone numbers before you build your outreach sequence. Getting the infrastructure right and starting with accurate, targeted contacts is how cold email produces real pipeline instead of just burning domain reputation.
One credit on JAYISAAC reveals one contact's verified email and phone number. The Starter plan is $26.99 per month for 500 credits. A free trial gives you 25 credits with no card required.
Frequently asked questions
What happens if I send cold email without SPF, DKIM, and DMARC?
Your messages are likely to land in spam or be rejected outright. Gmail and Yahoo treat unauthenticated email from unfamiliar senders as a strong spam signal, and there is no practical way to compensate for missing authentication with better copy or timing.
Do I need all three records or will one or two be enough?
You need all three. SPF and DKIM are the authentication mechanisms; DMARC is the policy that enforces and reports on them. A domain with only SPF and DKIM but no DMARC record leaves inbox providers without a clear instruction on what to do with failures, and that ambiguity tends to resolve against you.
How long does it take for DNS records to go live?
Most DNS changes propagate within a few minutes to a few hours. The technical maximum is 48 hours. Use MXToolbox to confirm each record is resolving before you test or send.
Can I use my main business domain for cold email?
You should not. A dedicated sending domain protects your primary domain's reputation. If the sending domain gets flagged or blacklisted, your main business email is unaffected and you can recover without operational disruption.
What DMARC policy should I start with?
Start with p=none to monitor without enforcing. After reviewing two to four weeks of aggregate reports and confirming clean authentication, move to p=quarantine and eventually p=reject as your confidence in the setup grows.
How many cold email domains should a small business run?
Most small sales operations run two to four sending domains simultaneously, rotating volume across them. This distributes sending reputation risk and gives you room to increase overall volume without overwhelming any single domain.