SPF, DKIM, and DMARC are the three DNS-based authentication records that tell receiving mail servers your emails are legitimate. Without all three correctly configured, Gmail and Microsoft route a disproportionate share of cold email to spam - regardless of content quality or list hygiene. This guide explains each record, shows exact DNS syntax, and walks through DMARC policy progression.
SPF is a TXT record that lists which services are authorised to send email for your domain. Receiving servers check SPF before delivering - if the sending IP isn’t in your SPF record, the message may be marked as spam or rejected.
@ (root domain)v=spf1 include:_spf.google.com ~all
@ (root domain)v=spf1 include:spf.protection.outlook.com ~all
@ (root domain)v=spf1 include:sendgrid.net ~all
@ (root domain)v=spf1 include:_spf.google.com include:sendgrid.net ~all
Common SPF mistakes
-all (hardfail) before testing - use ~all (softfail) until all senders are confirmedDKIM attaches a cryptographic signature to every email you send. The receiving server looks up your public key in DNS and verifies the signature. If it passes, the email provably came from your domain and wasn’t tampered with in transit.
Your email provider (Google Workspace, Microsoft 365, Instantly, Smartlead) generates a private/public key pair. The private key stays on their servers; you publish the public key in DNS.
Record name: selector._domainkey.yourdomain.com - the selector is provided by your email service (usually “google”, “mail”, or a custom string). Record value: v=DKIM1; k=rsa; p=MIGf... (the public key from your provider).
Run: nslookup -type=TXT selector._domainkey.yourdomain.com - you should see your public key in the response. Most providers have a built-in verification button.
# Replace "google" with your DKIM selector # Replace "yourdomain.com" with your domain nslookup -type=TXT google._domainkey.yourdomain.com # Expected output includes something like: # v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3... # If you see "can't find", the record is not yet published
DMARC tells receiving servers what to do when SPF or DKIM fail. It also instructs receiving servers to send you XML reports of who is sending email claiming to be from your domain - legitimate or not.
| Policy | DNS record | What happens | When to use |
|---|---|---|---|
| none (monitor) | v=DMARC1; p=none; rua=mailto:[email protected] | Reports sent; no action on failing mail | First 30 days - collect data before enforcing |
| quarantine | v=DMARC1; p=quarantine; rua=mailto:[email protected] | Failing mail goes to spam folder | Safe production setting for cold email domains |
| reject | v=DMARC1; p=reject; rua=mailto:[email protected] | Failing mail is blocked entirely | Only when all legitimate sending is confirmed authenticated |
DMARC DNS setup
Add a TXT record at _dmarc.yourdomain.com (not the root @). The rua address receives aggregate XML reports - use a dedicated mailbox or a service like Postmark DMARC Digests or Google DMARC Reporting.
SPF record published for your sending domain
nslookup -type=TXT yourdomain.com | grep spf
SPF includes your ESP (Google Workspace, M365, sending tool)
Check your ESP’s DKIM setup guide
DKIM key added to DNS for your sending domain
nslookup -type=TXT selector._domainkey.yourdomain.com
DMARC record published at _dmarc.yourdomain.com
nslookup -type=TXT _dmarc.yourdomain.com
DMARC policy is p=none or p=quarantine (not p=reject until tested)
Read rua reports after first send
Run a test via mail-tester.com before first send
Aim for 9/10 or 10/10 score
DMARC rua address is a monitored mailbox or service
Set up Postmark DMARC Digests (free)
SPF is a DNS TXT record listing services authorised to send email for your domain. For Google Workspace: v=spf1 include:_spf.google.com ~all. For Microsoft 365: v=spf1 include:spf.protection.outlook.com ~all. Add at the root (@) of your domain. Use ~all not -all to avoid false positives if you add new senders later.
DKIM attaches a cryptographic signature to every email, proving it wasn’t tampered with in transit. Cold email without DKIM fails authentication checks at Gmail and Microsoft, significantly increasing spam placement. Your ESP generates the key pair - you publish the public key as a TXT record at selector._domainkey.yourdomain.com.
Start with p=none for 30 days to collect reports without blocking mail. Move to p=quarantine once you confirm all legitimate sends pass SPF and DKIM. Only advance to p=reject when fully confident no legitimate paths are failing authentication.
SPF, DKIM, and DMARC prevent spoofing. BounceZero prevents bounces - removes invalid, disposable, and high-risk addresses before your first send. $3/1K. 100 free credits.
Ayoub built BounceZero's 5-stage validation pipeline, its dedicated BGP-announced IP infrastructure, and the Patroni HA PostgreSQL cluster behind every verification. Previously built high-volume email delivery infrastructure. Trained at 1337 Benguerir (École 42 network, 2019). Open-source: bgp_analyzer.
Deep-dive guides on how email verification and inbox placement work
272,446-domain census: DMARC gap, provider divide, catch-all rates
10.2M verifications: 12.3% of addresses are dead, and where they hide
826K re-verifications: only 19% of valid addresses survive 90 days
True catch-all is 1.4% - most of what looks catch-all is unprobeable providers
info@ bounces 4.5x more than personal addresses - measured, not guessed
The 3x invalid-rate gap that vanishes when you control for domain size
Explore other topics