How to Set Up SPF, DKIM and DMARC for Cold Email (Step by Step)

What SPF, DKIM and DMARC do (in plain English)

Think of an email like a letter. Anyone can write any return address on an envelope. These three records let the receiving post office check whether the letter really came from you.

The key idea is alignment: DMARC only passes if the domain in your visible From address matches the domain that passed SPF or DKIM. That is what stops someone else using your name.

Before you start

• Access to your domain's DNS (where you bought the domain, or Cloudflare, or similar).
• Admin access to your Google Workspace or Microsoft 365 account.
• Ideally, a secondary domain for cold email (for example tryacme.com), so your main domain is never at risk.

Step 1: Set up SPF

SPF is a single TXT record on the root of your domain (host @). There must be only one SPF record per domain; if you use several services, combine them into one.

Host: @
Type: TXT
Value: v=spf1 include:_spf.google.com ~all

Host: @
Type: TXT
Value: v=spf1 include:spf.protection.outlook.com ~all

v=spf1 include:_spf.google.com include:sendgrid.net ~all

~all (soft fail) is the usual choice while you're setting up; -all (hard fail) is stricter. Both are fine once everything that legitimately sends for your domain is listed.

Step 2: Turn on DKIM

Google Workspace

1. Open the Google Admin console and go to Apps → Google Workspace → Gmail → Authenticate email.
2. Select your domain and click Generate new record. Choose a 2048-bit key if your DNS host supports it.
3. Copy the TXT record name (usually google._domainkey) and its long value.
4. Add it to your DNS as a TXT record.
5. Wait for DNS to update (minutes to a few hours), then return to the admin console and click Start authentication.

Microsoft 365

1. Open the Microsoft Defender portal and go to Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM.
2. Select your domain. Microsoft shows two CNAME records, selector1._domainkey and selector2._domainkey.
3. Add both CNAME records to your DNS exactly as shown.
4. Return to the DKIM page and switch signing on for the domain.

Host: selector1._domainkey
Type: CNAME
Value: selector1-yourdomain-com._domainkey.yourtenant.onmicrosoft.com

Step 3: Publish DMARC

Start with a monitoring policy. It doesn't block anything, it just asks receivers to send you reports, and it meets the Google, Yahoo and Microsoft requirements.

Host: _dmarc
Type: TXT
Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com; fo=1

After a few weeks of clean reports showing that your legitimate mail passes, you can move to p=quarantine and eventually p=reject for strong protection against spoofing. For cold email domains, p=none or p=quarantine is common and perfectly acceptable.

Step 4: Test that everything passes

1. Send an email from the mailbox to a personal Gmail address.
2. In Gmail, open it, click ⋮ → Show original.
3. You want to see SPF: PASS, DKIM: PASS and DMARC: PASS.
4. Check that DKIM passed with your domain, not your email provider's.

dig TXT yourdomain.com +short
dig TXT google._domainkey.yourdomain.com +short
dig TXT _dmarc.yourdomain.com +short

The mistakes that break cold email authentication

Bonus: a custom tracking domain

If you track clicks, links get rewritten through a tracking domain. Shared tracking domains are used by thousands of senders, and if one of them spams, everyone's links look suspicious. Point a subdomain you own, such as track.yourdomain.com, at your sending tool with a CNAME so your links carry your own reputation.

How Kaysid helps

Kaysid's Domain health page checks the SPF, DKIM and DMARC records of every domain you send from and tells you, in plain words, what's missing and how to fix it. Because you send from your own Google Workspace, Microsoft 365 or SMTP mailbox, DKIM signs with your domain and DMARC alignment just works.