SPF, DKIM, and DMARC are the three DNS-based authentication records that tell receiving mail servers your emails are legitimate. Without all three correctly configured, Gmail and Microsoft route a disproportionate share of cold email to spam - regardless of content quality or list hygiene. This guide explains each record, shows exact DNS syntax, and walks through DMARC policy progression.
SPF is a TXT record that lists which services are authorised to send email for your domain. Receiving servers check SPF before delivering - if the sending IP isn’t in your SPF record, the message may be marked as spam or rejected.
@ (root domain)v=spf1 include:_spf.google.com ~all
@ (root domain)v=spf1 include:spf.protection.outlook.com ~all
@ (root domain)v=spf1 include:sendgrid.net ~all
@ (root domain)v=spf1 include:_spf.google.com include:sendgrid.net ~all
Common SPF mistakes
-all (hardfail) before testing - use ~all (softfail) until all senders are confirmedDKIM attaches a cryptographic signature to every email you send. The receiving server looks up your public key in DNS and verifies the signature. If it passes, the email provably came from your domain and wasn’t tampered with in transit.
Your email provider (Google Workspace, Microsoft 365, Instantly, Smartlead) generates a private/public key pair. The private key stays on their servers; you publish the public key in DNS.
Record name: selector._domainkey.yourdomain.com - the selector is provided by your email service (usually “google”, “mail”, or a custom string). Record value: v=DKIM1; k=rsa; p=MIGf... (the public key from your provider).
Run: nslookup -type=TXT selector._domainkey.yourdomain.com - you should see your public key in the response. Most providers have a built-in verification button.
# Replace "google" with your DKIM selector # Replace "yourdomain.com" with your domain nslookup -type=TXT google._domainkey.yourdomain.com # Expected output includes something like: # v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3... # If you see "can't find", the record is not yet published
DMARC tells receiving servers what to do when SPF or DKIM fail. It also instructs receiving servers to send you XML reports of who is sending email claiming to be from your domain - legitimate or not.
| Policy | DNS record | What happens | When to use |
|---|---|---|---|
| none (monitor) | v=DMARC1; p=none; rua=mailto:[email protected] | Reports sent; no action on failing mail | First 30 days - collect data before enforcing |
| quarantine | v=DMARC1; p=quarantine; rua=mailto:[email protected] | Failing mail goes to spam folder | Safe production setting for cold email domains |
| reject | v=DMARC1; p=reject; rua=mailto:[email protected] | Failing mail is blocked entirely | Only when all legitimate sending is confirmed authenticated |
DMARC DNS setup
Add a TXT record at _dmarc.yourdomain.com (not the root @). The rua address receives aggregate XML reports - use a dedicated mailbox or a service like Postmark DMARC Digests or Google DMARC Reporting.
SPF record published for your sending domain
nslookup -type=TXT yourdomain.com | grep spf
SPF includes your ESP (Google Workspace, M365, sending tool)
Check your ESP’s DKIM setup guide
DKIM key added to DNS for your sending domain
nslookup -type=TXT selector._domainkey.yourdomain.com
DMARC record published at _dmarc.yourdomain.com
nslookup -type=TXT _dmarc.yourdomain.com
DMARC policy is p=none or p=quarantine (not p=reject until tested)
Read rua reports after first send
Run a test via mail-tester.com before first send
Aim for 9/10 or 10/10 score
DMARC rua address is a monitored mailbox or service
Set up Postmark DMARC Digests (free)
SPF is a DNS TXT record listing services authorised to send email for your domain. For Google Workspace: v=spf1 include:_spf.google.com ~all. For Microsoft 365: v=spf1 include:spf.protection.outlook.com ~all. Add at the root (@) of your domain. Use ~all not -all to avoid false positives if you add new senders later.
DKIM attaches a cryptographic signature to every email, proving it wasn’t tampered with in transit. Cold email without DKIM fails authentication checks at Gmail and Microsoft, significantly increasing spam placement. Your ESP generates the key pair - you publish the public key as a TXT record at selector._domainkey.yourdomain.com.
Start with p=none for 30 days to collect reports without blocking mail. Move to p=quarantine once you confirm all legitimate sends pass SPF and DKIM. Only advance to p=reject when fully confident no legitimate paths are failing authentication.
SPF, DKIM, and DMARC prevent spoofing. BounceZero prevents bounces - removes invalid, disposable, and high-risk addresses before your first send. $3/1K. 100 free credits.
Ayoub built BounceZero's 5-stage validation pipeline, its dedicated BGP-announced IP infrastructure, and the Patroni HA PostgreSQL cluster behind every verification. Previously built high-volume email delivery infrastructure. Trained at 1337 Benguerir (École 42 network, 2019). Open-source: bgp_analyzer.
Provider behaviour, DNS setup, warm-up, and inbox placement
Generate, publish, and verify DKIM - Google Workspace, M365, and custom SMTP
SPF syntax, provider includes, 10-lookup limit fix, ~all vs -all explained
How to set up SPF, DKIM, and DMARC in 2026: exact DNS records, verification commands, common
How to warm up a new email domain in 2026: the right tool, a realistic 30-day timeline
Benchmarks, Apple MPP inflation explained, and what metrics to track instead
12 steps to keep hard bounce rate under 2% - prevention + recovery
Continue through related topics