Email Domain Setup: SPF, DKIM, DMARC Explained Simply

If your cold emails are landing in spam, the problem usually is not your copy. It is your email domain setup for cold email that determines whether you reach the inbox at all. SPF, DKIM, and DMARC are not optional extras for serious outreach teams. They are the foundation. Get them wrong and it does not matter how good your sequence is, your emails never reach a human.

This guide breaks down exactly how to set up all three, in plain English, with the common mistakes that are silently killing deliverability for thousands of senders right now.

---

Why Email Authentication Can Make or Break Your Cold Outreach in 2026

The rules changed fast. Google and Yahoo required DMARC for bulk senders starting February 2024. Microsoft followed with enforcement effective November 2025 for senders pushing 5,000 or more emails per day to Outlook inboxes. If you hit those volumes and your domain is not authenticated, mailbox providers are actively filtering your emails out.

The inbox placement difference is not marginal. Fully authenticated domains land 85 to 95 percent of emails in the inbox versus under 50 percent for unauthenticated senders. That gap alone explains why two outreach teams running the same sequences can have wildly different results.

Think of SPF, DKIM, and DMARC as three locks on your sending identity:

• SPF tells receiving servers which IP addresses are allowed to send on your behalf.
• DKIM attaches a cryptographic signature to each email, proving it was not tampered with in transit.
• DMARC ties the first two together and tells receiving servers what to do when an email fails either check.

You need all three. One or two is not enough. Here is how to set them up correctly.

---

SPF: The First Line of Defense (And Why 14.5% Still Get It Wrong)

SPF stands for Sender Policy Framework. In plain English, it is a DNS record that lists which mail servers are authorized to send email from your domain. When a receiving server gets an email from you, it checks your DNS to see if the sending server is on the approved list. If it is not, the email fails SPF.

That check fails more than you would think. Right now, 14.5 percent of all emails still fail SPF validation. Most of those failures are not caused by attackers. They are caused by misconfigured DNS records.

How to Set Up SPF

1. Go to your domain's DNS settings (wherever you bought the domain: GoDaddy, Namecheap, Cloudflare, etc.).
2. Add a TXT record for your root domain (@ or your sending subdomain).
3. The value will look something like this:

v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all

Replace the include: values with the SPF entries provided by your sending tools. Instantly, Smartlead, and other cold email platforms will give you their specific SPF include string in their setup docs.

The Mistake That Breaks 23% of Senders

Here is the critical rule: you can only have one SPF record per domain. Analysis of domain DNS configurations shows 23 percent of senders have multiple SPF records, which completely invalidates SPF. If you have two TXT records that both start with v=spf1, receiving servers do not know which one to trust and the check fails.

If you are adding a second sending tool, do not create a new SPF record. Add it as an additional include: in your existing record.

The 10 DNS Lookup Limit

SPF has a hard limit of 10 DNS lookups per check. Each include: counts as at least one lookup, and some sending tools chain multiple lookups behind a single include. If you are using several tools on one domain, you can hit the limit fast. When you exceed it, SPF fails even if all the servers are legitimate. Use a tool like MXToolbox to count your lookups after setting up.

---

DKIM: The Cryptographic Signature That Proves You Are Real

DKIM stands for DomainKeys Identified Mail. Where SPF verifies the sending server, DKIM verifies the message itself. Your sending tool generates a private/public key pair. The private key signs every outgoing email. The public key lives in your DNS. When a receiving server gets your email, it looks up your public key and uses it to verify the signature. If the signature matches, the email was not tampered with between you and the recipient.

How to Add DKIM

1. Log into your sending platform (Instantly, Google Workspace, Microsoft 365, etc.).
2. Find the DKIM setup section. The platform will generate a DKIM key and give you a DNS record to add.
3. Add that record to your DNS as a TXT record. It will look something like this:

Type: TXT
Host: selector1._domainkey.yourdomain.com
Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w...

The selector1 prefix is just a label. Your platform may use a different one. Copy exactly what they provide.

Why DKIM Matters Even When SPF Passes

SPF only validates the sending server. It does not prove the message content was untouched. DKIM covers that gap. More importantly, DMARC alignment (covered next) requires that either SPF or DKIM aligns with your From domain. In practice, DKIM alignment is more reliable because it travels with the message, not just the server path. If your SPF breaks due to forwarding or a relay, DKIM can still save deliverability.

---

DMARC: The Policy That Ties Everything Together

DMARC stands for Domain-based Message Authentication, Reporting, and Conformance. It is the layer on top of SPF and DKIM that actually enforces your policy and tells receiving servers what to do when an email fails either check.

DMARC also introduces alignment. It is not enough for SPF or DKIM to pass on their own. The domain in the email's From header must match (align with) the domain verified by SPF or DKIM. This closes the loophole where spammers pass SPF on a different domain than the one shown to recipients.

The Three Policy Levels

• p=none: Monitor mode. Emails are delivered regardless of authentication failures. You receive reports but nothing is blocked.
• p=quarantine: Emails that fail DMARC go to spam or are held for review.
• p=reject: Emails that fail DMARC are rejected outright, never delivered.

How to Set Up DMARC

Add a TXT record to your DNS at the host _dmarc.yourdomain.com. A basic starting record looks like this:

v=DMARC1; p=none; rua=mailto:[email protected]

The rua address is where aggregate reports get sent. Use a real mailbox or pipe it to a DMARC reporting tool like EasyDMARC so the reports are readable.

The Adoption Gap You Need to Know About

As of 2026, 52.1 percent of top domains have DMARC configured, up from 27.2 percent in 2023. That sounds like progress. But only 5.2 percent have enforcement set to p=reject. The other 47 percent are sitting on p=none indefinitely, which means they have DMARC set up but are not actually using it to protect their domain or their deliverability.

Start at p=none for two to four weeks while you review reports and confirm your legitimate email is passing. Then move to p=quarantine, then to p=reject once you are confident. Do not stay on p=none forever. It does not protect you.

---

Why You Should Never Send Cold Email from Your Main Domain

This is the mistake that will hurt you even if SPF, DKIM, and DMARC are perfectly configured. Sending cold outreach from your primary business domain puts your entire email reputation at risk. If your deliverability tanks, your internal emails, client communications, and transactional messages all get affected.

The data backs this up: senders using dedicated secondary domains for outreach see 31 percent higher inbox placement than those using their primary business domain. That is not a small edge. That is the difference between a campaign that generates pipeline and one that generates nothing.

How to Set Up a Sending Domain

1. Register a variation of your primary domain. Common naming conventions:

• outreach.yourcompany.com
• hello-yourcompany.com
• getyourcompany.com
• tryyourcompany.com

2. Set up SPF, DKIM, and DMARC on the new domain exactly as described above.
3. Connect the new domain to your sending platform (Instantly, Smartlead, etc.).
4. Warm it up before sending at volume. See the complete email warm-up guide for the full timeline and tool recommendations.

Keep your main domain separate. Use it for sales calls, inbound, and anything where your brand reputation is on the line. The sending domain takes the heat from cold outreach. If it takes a hit, you recover it or rotate to a new one without touching your core reputation.

For more on protecting your deliverability long-term, see this guide on cold email deliverability fixes.

---

The 5 Most Common Domain Setup Mistakes (And How to Fix Them)

Domain DNS analysis shows 67 percent of domains have at least one critical issue. Here are the five that show up most often in cold email setups.

1. Multiple SPF Records

As covered above, 23 percent of senders have this problem. Go into your DNS right now and search for all TXT records on your sending domain. If you see two records starting with v=spf1, delete one and merge all the include: statements into a single record.

2. Skipping DKIM for Your Sending Tools

A lot of teams set up DKIM for Google Workspace or Microsoft 365 and then forget to set it up separately for their cold email sending platform. Every tool that sends email on your behalf needs its own DKIM key added to your DNS. Check your sending platform's setup documentation and confirm the DKIM record is live.

3. Staying on p=none Forever

Setting DMARC to p=none and never moving forward means you are collecting data but not using it. Receiving servers see a domain with no enforcement policy and treat it accordingly. Set a calendar reminder to review your DMARC reports after 30 days and move to p=quarantine. Then p=reject after another 30 days if everything looks clean.

4. Sending Cold Email from Your Main Domain

Covered in the section above. The 31 percent inbox placement gap is real. Register a sending domain, set it up properly, and protect your primary domain's reputation.

5. Skipping Domain Warm-Up

New domains have zero sending history. Mailbox providers do not trust them. Properly warmed domains achieve 87 percent inbox placement. Unwarmed new domains land in the inbox only 12 percent of the time. Rushing the warm-up process causes 23 percent more spam placements in the first month.

The minimum warm-up period is 21 to 30 days. Start at 5 to 10 emails per day in week one, increase gradually to 30 to 50 per day by week three. Use a warm-up tool to do this automatically. Do not skip it.

---

Tools to Check and Monitor Your Domain Authentication

Getting the setup right is step one. Monitoring it over time is step two. These are the tools worth using.

MXToolbox

Free. Checks SPF, DKIM, DMARC, blacklists, and DNS health in one place. Run every domain you send from through MXToolbox before launching a campaign. It will flag multiple SPF records, missing DKIM, missing DMARC, and blacklist hits immediately. Start at mxtoolbox.com.

MailReach

Warm-up tool with inbox placement monitoring. It sends warm-up emails from a network of real inboxes, positive engagement signals are returned, and you can see your actual inbox placement rate over time. Good for ongoing monitoring after initial setup.

Instantly

If you are already using Instantly for cold email, the built-in warm-up network handles automated warm-up for every connected domain. Set it and leave it running in the background throughout your campaigns. It maintains reputation while you are actively sending.

EasyDMARC

DMARC aggregate reports are delivered as XML files that are almost unreadable without a parser. EasyDMARC converts them into clean dashboards showing which sources are passing and failing authentication. Essential if you are running DMARC at any enforcement level.

Prospeo

Email verification before you send. Every bounce hurts your sender reputation. The benchmark data shows bounce rate should stay under 2 percent, and the Gmail spam rate ceiling is 0.3 percent. Verify your list with Prospeo before launching any campaign to remove invalid addresses before they become bounces.

---

The Quick Setup Checklist

Here is the exact order of operations from domain purchase to first campaign send.

1. Register your sending domain. Use a variation of your primary domain. Not your main domain.
2. Point DNS to your email hosting. Connect it to Google Workspace, Microsoft 365, or your email hosting provider.
3. Add your SPF record. One TXT record, one v=spf1 line, all sending tools included. Verify in MXToolbox.
4. Add DKIM for every sending tool. Your email host and your cold email platform both need separate DKIM records. Get the keys from each platform and add them to DNS.
5. Add DMARC at p=none. Include a rua address to receive reports. Connect to EasyDMARC to read them.
6. Run MXToolbox on the full domain. Confirm SPF passes, DKIM passes, DMARC is present, no blacklist hits.
7. Connect to warm-up tool. Start automated warm-up at 5 to 10 emails per day.
8. Warm for 21 to 30 days. Do not send any cold outreach during this period. Let the warm-up run.
9. Review DMARC reports after 30 days. Confirm all legitimate sends are passing. Move to p=quarantine.
10. Launch campaigns at controlled volume. Start at 30 to 50 emails per day per domain. Scale up gradually. Monitor bounce rate (keep under 2%) and open rates against the 27.7% industry benchmark. Move DMARC to p=reject once you are confident in your setup.

Repeat this process for every new sending domain you add to your stack.

---

Get the Free Cold Email Domain Setup Checklist