How to Set Up SPF, DKIM and DMARC for Cold Email

The Short Answer

Once a sending domain has its mailboxes, set up the records in this order: SPF first, then DKIM, then DMARC last, starting DMARC at p=none (monitor only). Google's own advice is to set up DKIM and SPF at least 48 hours before DMARC (Google).

The order matters because DMARC only checks the other two. Publish a strict DMARC record before SPF and DKIM work, and you tell inbox providers to junk or reject your own mail. For cold email, all of this goes on separate sending domains, never the domain your clients write to.

What Do SPF, DKIM and DMARC Actually Do?

All three are text entries in your domain's DNS settings, the same place you point your website. Each one answers a different question for the inbox that receives your email:

SPF lists the servers that may send for your domain (Microsoft Learn). DKIM adds a signature to each message, and the matching public key sits in your DNS so the receiver can check it (Microsoft Learn). DMARC passes when SPF or DKIM passes and lines up with the domain people see in the From address, and it tells the receiver what to do when that fails (Google).

Do You Need All Three for Cold Email?

• Google. Since February 1, 2024, everyone sending to Gmail needs SPF or DKIM. Anyone sending close to 5,000 messages a day to Gmail needs SPF, DKIM and DMARC, with DMARC allowed at p=none, and must keep spam complaints below 0.3% (Google).
• Microsoft. Since May 5, 2025, domains sending more than 5,000 messages a day to Outlook.com, Hotmail.com and Live.com addresses need SPF and DKIM to pass and a DMARC record of at least p=none. Mail that doesn't comply goes to Junk, and Microsoft said it would later be rejected with the error 550; 5.7.515 Access denied (Microsoft).

A single cold email domain usually sends far less than 5,000 a day, so strictly only SPF or DKIM is required. We set up all three on every domain anyway. They cost nothing, Google's and Microsoft's sender rules are built on them, and Microsoft's own guidance is that SPF alone is not enough (Microsoft Learn).

Before You Start: Use a Separate Sending Domain

Microsoft recommends a separate subdomain for email services you don't directly control, so problems with that mail don't hurt the reputation of your main domain (Microsoft Learn). Cold email takes the same idea further: send from separate domains that look like your brand, and keep your main domain for clients, invoices and your team.

Each sending domain needs its own records. The SPF record on your main domain does not cover any other domain or subdomain (Microsoft Learn), so the three steps below repeat for every domain you send from. Not sure how many domains you need? Our Email Scaling Calculator works it out from your daily volume.

Set up the mailboxes before the records. Add each domain to Google Workspace or Microsoft 365 and create its mailboxes first. The DKIM key is generated inside that admin panel (Google, Microsoft Learn), so DKIM can't exist before the domain does, and DMARC has to wait for DKIM.

Step 1: Add One SPF Record

At your DNS host, add a TXT record on the domain itself (host @). Use the value your mailbox provider gives you:

• Google Workspace (Google):

v=spf1 include:_spf.google.com ~all

• Microsoft 365 (Microsoft Learn):

v=spf1 include:spf.protection.outlook.com -all

Three rules keep SPF working:

• Only one SPF record per domain. Two records make SPF fail with a permanent error, because the receiver can't tell which one to use (RFC 7208). If another service also sends for the domain, add its include: to the same record.
• No more than 10 lookups. Each include: costs at least one DNS lookup, and the includes inside it count too. More than 10 and SPF fails (RFC 7208). Fewer than 10 include: entries does not guarantee fewer than 10 lookups (Microsoft Learn).
• ~all or -all: follow your provider. Google's record ends in ~all (soft fail) and Microsoft recommends -all (hard fail). DMARC treats both as an SPF failure (Microsoft Learn).

Step 2: Turn On DKIM Signing

DKIM keys come from your mailbox provider, so this step starts in its admin panel, not at your DNS host.

Google Workspace

1. In the Google Admin console, go to Apps > Google Workspace > Gmail > Authenticate email.
2. Pick the domain and click Generate New Record. Choose a 2048-bit key if your DNS host supports it; Google says longer keys are more secure (Google).
3. Add the TXT record Google shows (host name and value) at your DNS host.
4. Go back to Authenticate email and click Start authentication. Until you do, the record sits in DNS but your mail isn't signed with it.

Microsoft 365

1. In the Microsoft Defender portal, open Email authentication settings and the DKIM tab, then select the domain.
2. Add the two CNAME records it asks for, with host names selector1._domainkey and selector2._domainkey. Copy the values from the portal; they are different for every organization (Microsoft Learn).
3. Once Microsoft detects both records, switch DKIM signing on for the domain.

Step 3: Add DMARC Last, Starting at p=none

Only after SPF and DKIM are in place, and Google suggests waiting at least 48 hours, add a TXT record with the host name _dmarc (Google):

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

• p=none means monitor only: mail is delivered as normal while you check that everything passes. It meets both Google's and Microsoft's bulk-sender rules.
• rua= is the address that receives DMARC reports, so you can see which messages pass and which fail. Use a mailbox you actually read, or a DMARC report tool.
• Then tighten it. Google's rollout moves to p=quarantine starting with a small share of mail (for example pct=5), raises it to 100%, and treats p=reject as a step to take with care (Google).

Never start a new domain at p=reject. If a DNS checker flags DMARC as missing on a domain where DKIM isn't live yet, don't click its "fix" button: a strict policy published before DKIM works asks inboxes to reject the very first emails you send.

Step 4: Check Every Domain Before Warm-Up

1. Check the records. Run each domain through our free DNS Health Checker. It reads the SPF, DKIM, DMARC and MX records and flags what is missing or broken.
2. Send a test. Email a Gmail address from the new mailbox, open the message, then click More > Show original (Google). The summary at the top should show SPF, DKIM and DMARC as PASS.
3. Then start warm-up. New mailboxes need at least two weeks of warm-up before campaigns (Instantly). Records that break halfway through warm-up waste that time, which is why the check comes first.

Common Mistakes and How to Fix Them

How We Set Up Sending Domains

When we build a client's sending setup, every domain goes through the same order: SPF, then DKIM, then DMARC at p=none, then a check of all three before warm-up starts. We send only from separate domains, never the client's own; nothing goes out before at least 14 days of warm-up; and we pause sending if bounces pass 3%.

Frequently Asked Questions

Related Reading

• The Ultimate Spam Words List for Cold Email
• Cold Email Agency vs In-House SDR
• DNS Health Checker: check a domain's SPF, DKIM, DMARC and MX records before you send.
• Email Scaling Calculator: plan the domains and mailboxes your volume needs.
• Spam Word Checker: scan your copy for spam-trigger words.
• Case Studies: real campaigns and the pipeline they generated.