SPF, DKIM and DMARC Explained: Setup and Checks for Cold Email

SPF DKIM DMARC: three short DNS records that decide whether Gmail and Outlook trust the domain your cold email comes from. Get them wrong and your emails land in spam or bounce, however good the copy. This guide explains each record in plain English, gives example.com records, walks through setup on Google Workspace and Microsoft 365, and shows how to check the result.

What is the difference between SPF, DKIM and DMARC?

SPF is the guest list: it names the servers allowed to send mail for your domain. DKIM is the wax seal: a cryptographic signature proving the message came from your domain and was not altered. DMARC is the door policy: it checks that SPF or DKIM lines up with the visible From address and tells receivers what to do on failure.

So SPF vs DKIM is a difference of method: SPF checks the sending server, DKIM checks the message itself. SPF vs DMARC is a difference of role: SPF is a check, DMARC is the rule that acts on the checks and sends you reports. DMARC passes when SPF or DKIM passes and the domain it authenticated matches (‘aligns’ with) the domain in the From line. That alignment is where many cold email setups quietly fail. All examples below use example.com. Swap in your own sending domain, and keep it separate from your main company domain.

How do you set up SPF, DKIM and DMARC on Google Workspace (Gmail)?

On Google Workspace you publish three records at your DNS host: an SPF TXT record, a DKIM TXT record generated in the Admin console, and a DMARC TXT record. Add SPF and DKIM first and DMARC about 48 hours later, as Google advises. Only the DKIM key and the switch-on happen inside Google.

Google’s SPF value is v=spf1 include:_spf.google.com ~all, published at the root (@) of the domain. Then follow Google’s DKIM setup steps:

1. In the Admin console go to Menu, Apps, Google Workspace, Gmail, then Authenticate email, and pick your domain.
2. Click Generate new record. Choose a 2,048-bit key (1,024 only if your DNS host cannot store 2,048) and keep the default selector, google.
3. Copy the TXT record name (google._domainkey) and the long value into your DNS host. Some hosts need the value split into quoted chunks; a truncated paste is a frequent cause of failure.
4. Back in the console, click Start authentication. Google says this can take up to 48 hours to start working.
5. Add the DMARC TXT record at _dmarc: v=DMARC1; p=none; rua=mailto:dmarc@example.com.
6. Send a test to a Gmail address, open Show original and look for SPF, DKIM and DMARC all marked PASS.

How do you set up SPF, DKIM and DMARC on Microsoft 365 (Office 365)?

Microsoft 365 works the same way with two differences: SPF uses Microsoft’s include, and DKIM uses two CNAME records instead of one TXT record. You publish the records at your DNS host, then switch DKIM signing on in the Microsoft Defender portal. Microsoft 365 has no editor for the SPF or DMARC records of a custom domain.

For a Microsoft-only domain, Microsoft’s SPF example is v=spf1 include:spf.protection.outlook.com -all. For DKIM, create CNAME records at selector1._domainkey and selector2._domainkey pointing to the exact targets Microsoft shows for your tenant (they end in dkim.mail.microsoft, so copy them, never type them). Then go to Email & collaboration, Policies & rules, Threat policies, Email authentication settings, open the DKIM tab and toggle signing on for the domain. Microsoft supports 1,024-bit and 2,048-bit keys. DMARC is the same TXT record at _dmarc as above. Microsoft recommends -all for its own domains because DKIM and DMARC sit behind it, while Google’s page shows ~all. Both are accepted; ?all is for testing only. Microsoft’s DKIM guide has the click-by-click steps.

What is the SPF 10-lookup limit, and why does it break cold email stacks?

An SPF check may trigger at most 10 DNS lookups. Each include, a, mx, exists and redirect counts as one, and nested includes add more, while ip4 and ip6 entries are free. Go past 10 and SPF returns a permanent error, so mail can fail even though every sender looks listed.

Cold email stacks hit the limit because every tool that sends as your domain adds an include: Google Workspace, a CRM, an invoicing app, a newsletter tool, a helpdesk. Two more rules cause trouble. Only one SPF record is allowed per domain, so merge the includes into one record instead of adding a second. And one stray character (a trailing full stop, a space after include:, an equals sign instead of a colon) breaks the whole record. Fixes, in order: remove services you no longer use; move bulk tools to a subdomain, which gets its own 10-lookup budget; replace an include with fixed ip4 ranges only when the vendor publishes stable ones, and review them regularly. Microsoft advises against flattening its own include because its addresses change. The model DESENO uses sidesteps most of this: a dedicated sending domain carries one provider and nothing else.

Which DMARC policy should a cold email domain use?

Start at p=none with a report address, then move to quarantine and finally reject only after the reports show every legitimate sender passing. Google’s bulk-sender rules accept p=none, and Google advises beginning there. For a domain used only for cold email, p=none for the first weeks is normal.

The path, using Microsoft’s rollout steps: p=none while you read the aggregate reports; p=quarantine with pct raised through 10, 25, 50, 75 and 100; then p=reject. Reports (the rua address) arrive as daily XML files from receivers. Send them to a dedicated mailbox, not a person’s inbox, and use a DMARC report reader because raw XML is unreadable. Watch alignment. A tool that sends through its own servers can pass SPF and DKIM for its own domain and still fail DMARC for yours, so set up custom DKIM at the tool; if it sends through your Google Workspace mailbox, Google signs with your domain and alignment holds. Enforce the main company domain last, and only after every system that sends as you (CRM, invoicing, website forms) is covered. BIMI, which shows your logo beside mail in some inboxes, needs an enforced DMARC policy and is not needed for cold email.

How do you do an SPF DKIM DMARC check?

Send a test email to a Gmail address, open the message, choose Show original and read the SPF, DKIM and DMARC lines: all three should say PASS. Then confirm the records themselves with a DNS lookup tool such as MXToolbox or the Google Admin Toolbox, or with a dig command.

Three commands cover it: dig TXT example.com +short for SPF, dig TXT google._domainkey.example.com +short for DKIM, and dig TXT _dmarc.example.com +short for DMARC. On Microsoft 365, check dig CNAME selector1._domainkey.example.com +short instead. Check every sending domain, not just the main one, and check again whenever you add a tool that sends as you. Authentication passing is not the same as inbox placement, so follow it with seed tests and Postmaster Tools as covered in our email deliverability testing guide, and let a new domain ramp up as described in our email warm-up guide. In DESENO’s own setup, every sending domain is authenticated before the roughly 14-day warm-up begins.

What do Google, Yahoo and Microsoft require from cold email senders?

From February 2024 Google and Yahoo expect bulk senders to authenticate with SPF, DKIM and DMARC, offer one-click unsubscribe and keep spam complaints under 0.3%. Google’s bulk threshold is 5,000 or more messages a day to Gmail. Outlook.com applied similar rules from May 2025. A small cold sender sits below those lines but is judged on the same signals.

Google’s email sender guidelines ask you to keep the spam rate in Postmaster Tools below 0.10% and never reach 0.30%. Our reading: authentication is the entry ticket, not the prize. It proves you are who you say you are; it does not prove the mail is wanted. Unverified lists, link-heavy copy and sudden volume decide the rest. And here is one more reason for separate sending domains: a reputation or DMARC problem on a cold email domain never touches the domain your invoices come from.

Authentication does not get you into the inbox. It gets you into the room where your list, your copy and your volume are judged. Without it, you are never even in the room.— Murtaza Udaypurwala, DESENO

The bottom line

SPF names who may send, DKIM proves the message is yours and DMARC sets the rule and sends the reports. Publish all three on every sending domain, keep one SPF record under 10 lookups, start DMARC at p=none, and test with Show original before you warm up or send. Then spend your effort on the list and the copy, because authentication only gets you a fair hearing. If you would rather not run DNS, mailboxes and monitoring yourself, DESENO’s B2B email outreach for manufacturers sets up separate authenticated sending domains for you. For the wider picture, start with email marketing.