Do I Need SPF, DKIM and DMARC for Cold Email?

What each record does

• SPF lists the servers allowed to send for your domain. Google: "SPF prevents spammers from sending unauthorized messages that appear to be from your domain."

• DKIM signs each message so the receiver can check it came from your domain and wasn't changed.

• DMARC tells the receiver what to do with mail that fails SPF and DKIM, and requires that the domain in the From: header matches the domain that passed.

What the providers require

Sources: Google's sender guidelines, Yahoo's sender requirements and Microsoft's announcement. Google counts a bulk sender as one that sends close to 5,000 messages or more a day to personal Gmail accounts.

Cold email domains usually send far less than 5,000 a day each, but set up all three anyway. Google recommends that you "always set up SPF, DKIM, and DMARC for your domains," and Microsoft says that below 5,000 a day "all senders benefit from these best practices."

What happens without them

Gmail rejects or defers unauthenticated mail with specific codes, listed in its SMTP error reference:

Outlook.com uses 550 5.7.515 for domains that don't meet its authentication level. See Outlook blocking cold email.

For Workspace DNS values and Admin console steps, use Google Workspace SPF, DKIM and DMARC setup.

Setup checklist

1. One SPF record per domain that includes every service that sends for it. Microsoft notes that more than 10 DNS lookups can make SPF fail. The SPF record generator builds it and counts the lookups.

2. DKIM turned on for the sending service, with a 2048-bit key if supported.

3. A DMARC record with at least p=none. Add a reporting address if you want reports. The DMARC record generator writes it.

4. From: address on the same domain that SPF or DKIM authenticates.

5. PTR (reverse DNS) on the sending IPs, which Gmail and Yahoo also require. Your mailbox provider controls this.

6. Send a test message and check the headers for spf=pass, dkim=pass and dmarc=pass. How to read each test and fix a failure is in SPF, DKIM and DMARC test; the email header analyzer reads the headers for you and checks alignment with the From domain.

What authentication doesn't do

Passing SPF, DKIM and DMARC proves who sent the email. It doesn't make the email wanted. Placement still depends on the reputation of the sending IPs and domain, your volume, your list and your copy.

What we recommend at Outreach2day

We set up SPF, DKIM, DMARC and a redirect to your website automatically on every domain, including domains you connect by pointing their nameservers to us. Use separate domains for cold email and keep your main company domain out of it.