SPF, DKIM and DMARC Explained: Stop Your Cold Emails From Dying in Spam

What do SPF, DKIM and DMARC actually do?

Picture Gmail, Outlook and Yahoo as one very strict mail room. Before any message reaches a desk, the clerk checks identity, integrity and your fallback orders.

Swipe to see more →

That's the whole system. You wrote a sharp email to a tight list, and none of it matters if the mail room can't confirm it came from you.

Why did this suddenly get serious?

Because Gmail and Yahoo now enforce real rules. Google's Email sender guidelines define a bulk sender as roughly 5,000 or more messages a day to personal Gmail accounts. Bulk senders must authenticate with SPF and DKIM and publish a DMARC record, with a policy of at least p=none. Google asks senders to keep spam complaint rates below 0.1% and says rates of 0.3% or higher seriously hurt delivery. Yahoo's Sender Hub sets the same 0.3% ceiling.

Do the math on 0.3%: that's three complaints per thousand emails. Not a lot of room. For the full picture on that number, see spam complaint rate for cold email.

The play: how do you set up and check authentication?

Your job isn't to edit DNS. Your job is to know whether you pass, and to hand the fix to the right person with clear instructions.

1. List every tool that sends email as your domain. Your email provider, your sequencing tool, your newsletter tool, any tool that sends on your behalf. This list is the input for everything else.
2. Make sure SPF covers all of them in one record. One SPF record per domain, listing every sending service. Two SPF records cause failures. So does a record that needs too many DNS lookups to check, which is easy to hit when every tool adds its own include, so ask whoever manages DNS to confirm you're under the limit. Pick the Stack covers the sending layer.
3. Turn on DKIM in every sending tool. Each tool gives you a key to publish in DNS, so it signs with your domain instead of its own. Forget one tool and its mail arrives with no seal your domain vouches for. DMARC only passes when SPF or DKIM passes for the same domain that appears in your From address, which is why the tool's own signature isn't enough.
4. Publish DMARC at p=none with a reporting address. It meets the Gmail and Yahoo minimum, doesn't change how receivers handle your mail, and the reports show you who is sending as your domain.
5. Run the two-minute Gmail check (below) and fix anything that fails before your next campaign.
6. Tighten DMARC once reports are clean. When the reports show only your legitimate senders, move to quarantine.

How do I check if my domain passes in two minutes?

Free, no tools needed:

1. From the inbox you prospect with, send a test message to a personal Gmail account.
2. Open it in Gmail and click the three-dot menu next to reply.
3. Click "Show original."
4. Read the SPF, DKIM and DMARC lines at the top. You want PASS on all three, and the domain shown next to SPF or DKIM should be yours, not your sending tool's.
5. See a FAIL? Capture it and forward it to the person who owns your DNS.

Three passes means your foundation is solid. If you still have a deliverability problem, look at list quality, volume or content next. Why cold emails go to spam walks through those causes, and an inbox placement test shows where your mail actually lands.

Worked example: what does a common failure look like?

Illustrative example.

A five-rep team adds a new sequencing tool on Monday and starts sending that afternoon. Copy is unchanged, lists are unchanged, but replies dry up within a week.

The rep who runs the Gmail check sees this in "Show original":

• SPF: FAIL
• DKIM: PASS, but for the sending tool's domain, not the company's
• DMARC: FAIL

The new tool was never added to SPF, and the company's DKIM key for it was never published, so the tool signed with its own domain. Neither check matched the company's From address, so DMARC failed and every email it sent looked like someone impersonating the company. The fix took the IT contact 20 minutes: add the tool to the existing SPF record and publish the DKIM key the tool provides, so it signs as the company. The next check showed three passes.

The lesson: authentication breaks when the stack changes, not when the copy changes. Update SPF and DKIM before any new tool's first send.

What are the most common authentication mistakes?

• Adding a sending tool without updating SPF and DKIM. The most common failure by far. Make it a checklist item for every new tool.
• Two SPF records on one domain. Merge them into one.
• No DMARC at all. It's the bulk-sender minimum, and without it you have no reports on who is sending as you.
• Jumping straight to p=reject. If one legitimate tool isn't set up yet, you block your own mail. Start at none, read the reports, then tighten.
• Treating authentication as a one-time task. Re-run the Gmail check whenever the stack changes, and check your spam rate monthly in Google Postmaster Tools (it only shows data once you send a meaningful daily volume to Gmail).
• Blaming the copy first. Running order: prove who you are (authentication), clean the list, and only then polish the words, starting with how to write cold emails that actually work. Brilliant copy doesn't help a message the mail room won't let in.

Try it: Once authentication passes, the next question is capacity. The Outbound Calculator shows how many inboxes and sending domains your volume needs.