If you send cold emails without SPF, DKIM, and DMARC records, you are leaving 30–40% of your deliverability on the table. These three DNS records are the foundation of email authentication — and they take 15 minutes to set up.
Here's exactly what each one does and how to configure them.
What these records actually do
When an email arrives at Gmail or Outlook, the receiving server runs three checks before deciding where to put it:
- SPF (Sender Policy Framework) — verifies that the sending server is authorised to send email for your domain
- DKIM (DomainKeys Identified Mail) — adds a cryptographic signature to every email, proving it hasn't been tampered with
- DMARC (Domain-based Message Authentication) — tells receiving servers what to do if SPF or DKIM fails, and sends you reports
Together they prove: (1) the email came from a server you authorised, (2) the content wasn't modified in transit, and (3) you have a policy for handling failures.
Step 1 — Set up SPF
SPF is a TXT record in your DNS that lists which servers can send email from your domain. Log into your domain registrar (GoDaddy, Cloudflare, Namecheap, etc.) and add this TXT record:
Type: TXT
Value: v=spf1 include:_spf.google.com include:spf.hostinger.com ~all
Replace with your actual sending provider's SPF include.
The ~all at the end means "soft fail" — emails from unlisted servers get marked as suspicious but not rejected outright. Once you're confident your setup is right, you can change to -all (hard fail).
Step 2 — Set up DKIM
DKIM requires generating a public/private key pair. Your email sending service (Google Workspace, Hostinger, Zoho) will generate the key and give you a TXT record to add to DNS.
In Google Workspace: Admin Console → Apps → Google Workspace → Gmail → Authenticate email → Generate new record. Copy the TXT record it gives you and add it to your DNS.
Type: TXT
Value: v=DKIM1; k=rsa; p=[long public key string]
Step 3 — Set up DMARC
DMARC is the simplest record. Start with a monitoring-only policy so you can see what's failing before enforcing anything:
Type: TXT
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
The p=none means "monitor only" — emails that fail will still be delivered, but you'll get reports. After a week of reviewing reports, upgrade to p=quarantine (spam folder) and eventually p=reject (block entirely).
Verify everything is working
Once you've added all three records (DNS changes take up to 48 hours to propagate), verify them:
- MXToolbox — free DNS lookup tool, check SPF, DKIM, and DMARC records separately
- mail-tester.com — send a test email, get a deliverability score out of 10
- Google Postmaster Tools — sign up and verify your domain for ongoing reputation monitoring
A fully authenticated domain that passes all three checks will consistently score 9–10/10 on mail-tester.
One more thing: Set up a separate sending domain for cold email — not your main company domain. Use something like mail.yourcompany.com or outreach.yourcompany.com. That way if your cold email reputation takes a hit, your main domain is protected.