Blog

SPF, DKIM and DMARC for Cold Email: What to Set Up Before You Send

A well-written email to a potential client is worth nothing if it never reaches the recipient’s inbox. Before you launch your first campaign, it pays to sort out what mail servers check before they even read your message: domain authentication. Below we explain in plain language what SPF, DKIM and DMARC are, in what order to set them up, and what to do with your mailboxes before you start sending to companies.

Why email authentication matters in cold email

The address in the „From” field can be forged as easily as the sender on an envelope. That is why receiving mail servers try to establish whether a message was really sent from an authorised place. If the sender’s domain does not have authentication configured correctly, the recipient has no reason to trust it. As a result, messages can end up in spam or be rejected.

Authentication is not a guarantee of delivery. Where an email lands is also affected by the reputation of the domain and mailbox, the content of the message, the sending pace and recipients’ reactions. Still, it is the foundation without which the rest of your effort makes little sense.

SPF: who may send email on behalf of your domain

SPF (Sender Policy Framework) is a DNS record of your domain that lists the servers authorised to send mail from that domain. The recipient’s server compares the address the message actually came from with this list.

  • The record is a TXT record in the DNS of your domain.
  • The list should include every service you really send from: your business email provider and, for example, a newsletter or invoicing system.
  • A domain should have a single SPF record. Two separate records are a common mistake that breaks verification.
  • Adding a service you do not use is an unnecessary open door, while leaving out one you do use makes verification fail.

DKIM: a signature that confirms the content was not altered

DKIM (DomainKeys Identified Mail) works like a digital signature on a message. The sender’s server signs the outgoing email with a private key, and the public key is published in the DNS of the domain. The recipient checks the signature and so knows that the message comes from the domain owner and was not modified on the way.

  • Enabling DKIM usually happens in your email provider’s panel, which gives you a DNS record to paste.
  • After adding the record, check that a sent message shows a passing DKIM result in its headers.
  • Every service that sends on your behalf should have its own signature.

DMARC: instructions for the recipient on what to do when verification fails

DMARC ties SPF and DKIM together and adds two things: with a policy you tell receiving servers how to treat messages that failed verification, and you can receive reports about who is sending mail on behalf of your domain. It also requires the domain in the „From” address to align with the domain checked by SPF or DKIM.

The policy can have three levels:

  • none: observation only, with no effect on delivery. A good start, because it lets you see whether anything is sending mail unnoticed.
  • quarantine: messages that fail verification should be treated with suspicion, usually by placing them in spam.
  • reject: such messages should be rejected.

It is sensible to start at „none”, review the reports, fix the sending sources, and only then tighten the policy.

Step-by-step order of implementation

  1. List all services that send email from your domain.
  2. Set up SPF with the list of those services.
  3. Enable DKIM with every provider and check the signature on a test message.
  4. Add DMARC with the „none” policy and an address for reports.
  5. After a few weeks of observation, consider tightening the policy.
  6. Test sending to several of your own mailboxes with different providers and look at the message headers.

Warming up mailboxes before full volume

A new mailbox, or a domain that has sent little so far, has no history. If you suddenly start sending large volumes, it looks like the behaviour of a spammer. That is why volume is increased gradually: first a small number of messages a day, and over time more, as long as there are no bounces or complaints. There is no single universal number that is safe for every domain, so watch bounces and recipients’ reactions instead of sticking to a rigid schedule.

What else affects whether a cold email reaches the inbox

  • Quality of addresses. Writing to companies whose contact addresses are publicly visible on their websites is safer than using purchased lists. Wrong addresses cause bounces, which hurt reputation.
  • Sending pace. Even intervals between messages look more natural than a series of hundreds of emails at once.
  • Content. A short, individual message about a specific company does better than a generic template. Avoid too many links and images in the first email.
  • Option to opt out. A simple note on how to stop receiving messages is good practice and respects the recipient.
  • Reaction to bounces and replies. A contact who replied, or whose address bounced, should not receive further reminders.

How to check that the configuration works

The simplest way is to send a test message to your own mailbox with several email providers and open its headers („show original” or „message source”). Look for the SPF, DKIM and DMARC verification results: they should indicate a pass. Also check that the domain in the „From” address matches the domain for which verification passed. To view DNS records, any DNS lookup tool or your domain panel is enough. After every DNS change, wait for it to propagate before judging the result, because new records are not always visible immediately.

The most common mistakes

  • Two SPF records instead of one.
  • Sending a campaign from the company’s main mailbox, without considering a separate mailbox for outreach, so any reputation problems hit all of the company’s email.
  • Skipping DKIM for an external tool that sends email on your behalf.
  • Setting DMARC to „reject” straight away without earlier reports.
  • Starting with the full daily volume on a fresh mailbox.

How it works with us

In our B2B lead generation service based on cold email, before launch we set up SPF, DKIM and DMARC for your domain and warm up the mailboxes, gradually increasing the volume. Emails go out from your own domain and mailbox, at a safe pace. We do not promise that every message will reach the recipient’s main inbox, because deliverability also depends on the reputation of your domain, but we take care of what can be controlled. If you want to discuss your situation, get in touch.

This is not legal advice. Rules on sending commercial messages to companies and on processing contact data are worth consulting with a lawyer.

Sources

Read next

Book a free consultation