SPF, DKIM and DMARC setup for cold email

What the three records do

SPF, DKIM, and DMARC are three DNS records on the domain in the From address. A cold email domain needs all three before warmup. Records on the company domain do not cover a separately registered sending domain.

SPF lists the servers allowed to send. DKIM signs selected headers and the body so the receiver can see who signed and whether those parts changed. DMARC checks that the passing SPF or DKIM domain aligns with the From domain, says what to do on failure, and names a mailbox for reports. It does not replace the other two.

Google's email sender guidelines say authenticated messages are less likely to be rejected or marked as spam, and that unauthenticated messages might be marked as spam or rejected with a 5.7.26 error. A pass gets the message considered. Complaints, the list, and volume still decide the folder. Those are in the deliverability guide.

Publish one SPF record

SPF is one TXT record at the sending domain. RFC 7208 says a domain must not publish multiple records that a check could choose between. Two v=spf1 TXT records produce a permerror. Several quoted strings inside a single TXT record still count as one record.

A domain that sends only through Google Workspace:

v=spf1 include:_spf.google.com ~all

A domain that sends only through Microsoft 365:

v=spf1 include:spf.protection.outlook.com ~all

Use the include for the host that actually sends. Inbox SMTP needs the mailbox host's include. A sequencer that sends from its own servers, with your domain on the envelope, belongs in that same record. Do not add Google's include on a domain that never sends through Google.

End with ~all (softfail) or -all (fail), not +all. With no match and no redirect, RFC 7208 returns neutral, the same as an implicit ?all. Use ~all until the include list is confirmed.

Stay at or under 10 DNS lookups. RFC 7208 section 4.6.4 counts include, a, mx, ptr, exists, and redirect, and nested includes count toward the same 10. all, ip4, and ip6 do not. Over the limit, the result is permerror. One sending host per cold email domain stays under it. Stacking several vendors usually does not. Add a domain, or remove a retired host, before you add an include.

Turn on DKIM for the From domain

DKIM is a signature plus a public key in DNS at selector._domainkey on the sending domain. Google Workspace often uses the selector google. A sequencer usually gives you a CNAME. Publish that record, then turn signing on. A key with signing off does nothing.

Google requires a key of 1024 bits or longer for personal Gmail accounts, and recommends 2048 bits when the host supports it. Yahoo's sender best practices also set a 1024-bit minimum. Use 2048 when you can.

Alignment reads d= in the signature. It has to be your From domain, or a parent of it under relaxed alignment. If d= is the sequencer, DKIM can pass and DMARC still fails. A company-domain selector does not sign a different outreach domain.

Add a new selector before you remove the old one, so forwards of older mail still verify. Two selectors are normal. Two SPF records are not. Send the authentication test with tracking off. Link rewrites and open pixels change the body hash, and DKIM fails if they are applied after signing. Keep any tracking hostname on the same organizational domain as the From address.

Start DMARC at p=none

DMARC is one TXT record at _dmarc on the sending domain. For bulk senders, Google and Yahoo accept a policy of at least p=none. The record has to exist, and the message still has to pass, which means alignment.

v=DMARC1; p=none; rua=mailto:dmarc@outreach.example

p=none monitors: receivers can still deliver failures and send reports. p=quarantine asks them to treat failures with suspicion. p=reject asks them to refuse failures.

Leave adkim and aspf unset. RFC 7489 defaults both to relaxed (r), so a subdomain can align with the organizational domain. Strict (s) requires an exact host match. Use it only after reports show every legitimate path already matches.

The rua mailbox has to exist, preferably on the same organizational domain. A report address on a different organizational domain needs an authorization record there, or many reporters drop the report. Read those reports in the first week. Do not start an outreach domain at p=quarantine or p=reject. Tighten only after legitimate mail from that domain is aligned.

Alignment is the check most setups miss

SPF pass plus DKIM pass can still fail DMARC. DMARC passes only when at least one method passes and aligns with the From domain. SPF alignment uses the Return-Path domain. DKIM alignment uses d=. Google requires that alignment on direct mail from bulk senders. Yahoo requires it for bulk senders and accepts relaxed alignment.

Sequencers often set the Return-Path to their own bounce domain. SPF then passes for the tool, not for the From domain, so SPF does not satisfy DMARC. DKIM with d= on your From domain is the path that passes. If d= is the tool, DMARC fails even when the dashboard shows SPF passed.

Relaxed alignment still needs the same organizational domain. mail.outreach.example can align with outreach.example. It does not align with your company domain or the sequencer. In Gmail, Show original should look like this:

spf=pass
dkim=pass header.d=outreach.example
dmarc=pass header.from=outreach.example

If header.d and header.from differ at the organizational domain, the message is not aligned.

What Google and Yahoo require

Google's rules have applied to personal Gmail accounts since February 1, 2024. Yahoo began enforcing its bulk requirements in February 2024 and does not publish a daily count for who is bulk. If the domain sends cold email, meet Yahoo's bulk column.

Google's spam-rate section tells senders to keep the Postmaster Tools rate below 0.10% and to avoid 0.30% or higher. That page also says Google does not track open rates. The 5,000-message line counts mail to Gmail accounts. Meet the bulk rules on every sending domain even when a single domain stays under it.

One-click unsubscribe applies to marketing and subscribed messages. Google specifies List-Unsubscribe and List-Unsubscribe-Post: List-Unsubscribe=One-Click. Cold email still needs an opt-out and a postal address under CAN-SPAM, covered in the deliverability guide. Do not impersonate Gmail From headers. Google says it will use a DMARC quarantine policy, and that copying those headers can affect delivery.

Publish a real A record on the sending domain. The sending IP needs a PTR that matches that hostname both ways. Google points administrators to Admin Toolbox Dig. Google and Microsoft publish PTR for their own IPs. If you run the server, the PTR should name your domain. TLS has been a Gmail requirement since the December 2023 update in the guidelines.

For Outlook.com, Hotmail, and Live, dmarcian documents Microsoft's rule: domains sending 5,000 or more messages a day must pass SPF, DKIM, and DMARC alignment. dmarcian quotes the rejection as 550 5.7.515, with enforcement from May 5, 2025. The same three records are what that check looks for.

BIMI, briefly

BIMI shows a logo beside authenticated mail in inboxes that support it. It does not make SPF, DKIM, or DMARC pass, and it does not warm a domain.

The BIMI Group implementation guide requires DMARC at quarantine or reject, and it does not accept p=none or a pct under 100. The TXT record is at default._bimi:

v=BIMI1; l=https://example.com/brand/logo.svg; a=https://example.com/brand/certificate.pem

Google's BIMI setup also requires a Verified Mark Certificate or a Common Mark Certificate before Gmail shows the logo, plus DMARC at quarantine or reject with pct=100. Gmail shows a checkmark for a VMC.

Skip BIMI on a new cold email domain. A logo and a reject policy, before reports are clean, do not fix alignment. Publish it on the corporate domain that already sends aligned mail at enforcement. Leave outreach domains at p=none until their own reports are clean.

Test before anyone is on the list

1. Confirm one v=spf1 TXT record, ending in ~all or -all, for the host you use. Confirm the DKIM selector resolves, and that _dmarc has the policy you intended and a rua mailbox that accepts mail.
2. Use Google Admin Toolbox Check MX for the mail host and SPF, and Dig, linked above, for PTR.
3. Run a second SPF check in MX Toolbox. Stop on a permerror from duplicate records or from more than 10 lookups. Check DMARC syntax in dmarcian's DMARC inspector.
4. Send one plain message, tracking off, to a Gmail account you control. In Show original, require spf=pass, dkim=pass with header.d on the From domain, and dmarc=pass with header.from on that domain.
5. After real Gmail traffic exists, watch authentication and spam rate in Postmaster Tools. With DKIM signing, enroll a complaint feedback loop in Yahoo Sender Hub.

The Gmail Authentication-Results header is the check that matches that receiver. If it fails, fix the record and send again. Do not ramp on a fail.

Mistakes that fail an otherwise careful setup

• Two SPF TXT records, from adding a host beside the old record instead of editing it.
• More than 10 DNS lookups after nested includes are counted.
• DKIM left off, or published on the company domain while the From domain is the outreach domain.
• d= set to the sequencer, so DKIM passes for the tool and DMARC fails for you.
• DMARC only on the company domain. A separate sending domain does not inherit it.
• An rua address that bounces, or p=reject before any reports exist.
• A key under the 1024-bit minimum Google and Yahoo describe, when 2048 is available.
• Tracking rewrites after the signature, or warmup before a Gmail header shows all three passes.
• A green check in the tool standing in for header.d and header.from.

Where this sits with warmup

Warmup does not publish DNS, and DNS does not build a reputation. Publish the records first.

Use a domain that is not the company's primary domain, publish SPF, DKIM, and DMARC, wait until a public lookup shows the TXT records, prove the Gmail header, then warm. The warmup guide waits 24 to 48 hours for caches, then runs a 21-day ramp per inbox. The daily volume guide is the ceiling after that. If authentication fails, pause and retest. More warmup days will not fix DNS.

In the first week, read the aggregate reports. You want your own aligned mail and nothing else on that domain. A second inbox on the same host usually keeps the same SPF record. A new domain needs the full set. A new sequencer needs a new selector, a fresh test, and only then removal of the old key.

When placement drops, sample a live header again. A DNS edit, a rotated selector, or a tracking change can break a record that passed last month. Passing these checks is part of how our infrastructure sends 400,000 emails a day at a 99% delivery rate, across 30-plus client programs. A pass does not forgive a bad list. The domains, the tests, and the ramp are part of the cold email program if you want them handled. You still approve the market and the copy.

FAQ

Sources

1. Google, Email sender guidelines
2. Google, Set up BIMI
3. Yahoo Sender Hub, Sender best practices
4. RFC 7208, Sender Policy Framework (10 DNS lookup limit, section 4.6.4)
5. RFC 7489, DMARC
6. BIMI Group, Implementation guide
7. dmarcian, Microsoft enforces SPF, DKIM and DMARC for high-volume senders