SPF, DKIM and DMARC for cold email domains
By Travis Heurtelou · 6 min read · October 10, 2026
The short version
- SPF says which servers can send for the domain. DKIM signs each email. DMARC says what to do when either check fails.
- Google and Yahoo have required all three from bulk senders since February 2024. Microsoft added the same for Outlook.com in May 2025.
- Set all three on every sending domain before warm-up starts.
- Cold email goes out from separate domains. Your main domain never sends it.
What each record does
| Record | What it does | Where it lives |
|---|---|---|
| SPF | Lists the servers allowed to send email for the domain | A TXT record on the domain |
| DKIM | Adds a signature to each email so the receiver can check it wasn't changed and came from the domain | A TXT or CNAME record at a selector your email provider gives you |
| DMARC | Tells receivers what to do when SPF or DKIM fails, and where to send reports | A TXT record at _dmarc.yourdomain.com |
What the big providers require
Since February 2024, Google and Yahoo require anyone sending more than 5,000 emails a day to their users to have SPF, DKIM and DMARC set up, with the From domain aligned to SPF or DKIM, and to keep spam complaints under 0.3%. Microsoft announced the same for Outlook.com, Hotmail and Live addresses starting May 2025. Senders below that volume are still judged on the same signals, so set them up regardless.
Our setup on every sending domain
- SPF with only the provider that sends for that domain, ending in ~all. One SPF record per domain. Two records break both.
- DKIM turned on in Google Workspace or Microsoft 365, with the key published in DNS.
- DMARC starting at p=none with a reporting address, so you can see failures without blocking mail. Move to quarantine once the reports are clean.
- The domain redirects to your real website, so anyone who types it in lands somewhere real.
- A custom tracking domain if you track clicks, or tracking turned off.
Why your main domain stays out of it
Your main domain sends invoices, quotes, password resets and every email your team writes to customers. If cold email ever hurts its reputation, all of that starts landing in spam. Separate domains carry the risk instead. If one has a bad week you rest it or retire it, and nothing your customers depend on is affected.
How to check it worked
Send a test email to a Gmail address, open it, and choose 'Show original'. SPF, DKIM and DMARC should each say PASS. Do this on every domain before warm-up starts, and again if you change email providers.
One SPF record, DKIM on, DMARC at p=none to start, on every sending domain before warm-up. Check with Gmail's 'Show original'. Keep your main domain off cold email entirely.
Questions
Do I need DMARC at p=reject?
Not to start. The providers require a DMARC record, and p=none meets that. Tighten it once the reports show everything passing.
Does a subdomain of my main domain count as separate?
Partly. Reputation on a subdomain can still affect the parent. Separate root domains keep the risk fully apart.
How long do DNS changes take?
Usually minutes to a few hours. Check with 'Show original' before assuming they're live.
Related
Rather we just run it?
We work one market at a time and hand you the introductions worth having. If your market does not fit, we will tell you before you spend a dollar.
Request a GTM Audit