If you send cold email from a domain with no SPF, DKIM and DMARC records, Gmail and Microsoft have no way to confirm the mail really came from you, and they treat it accordingly. Most product-brand founders skip this step because it sounds technical. It is three DNS records, and you can set them up in an afternoon. This guide walks through SPF, DKIM and DMARC in plain English: what each one does, how to set it up for a cold email domain, how to check it worked, and the mistakes that quietly undo the whole thing.
Authentication is the price of entry, not a deliverability strategy on its own. Once it is in place, the rest of cold email deliverability — warm-up, volume, list quality — decides whether your buyer emails actually land.
What SPF, DKIM and DMARC actually do
Think of it as three questions a receiving mail server asks about every message.
- SPF answers "is this server allowed to send for this domain?" You publish a list of the mail services permitted to send on your behalf (Google Workspace, Microsoft 365, an outreach tool with its own servers). If a message arrives from a server not on the list, SPF fails.
- DKIM answers "does this message carry the domain's signature, and was it altered in transit?" Your mail provider signs each outgoing message with a private key. The matching public key sits in your DNS. The receiver checks the signature.
- DMARC answers "what should I do if SPF or DKIM fails, and who do I tell?" It is a policy record. It tells receivers whether to deliver, quarantine or reject unauthenticated mail claiming to be from you, and where to send reports.
SPF and DKIM are the proof. DMARC is the rulebook that makes the proof mean something. Gmail and Yahoo both now expect all three from anyone sending meaningful volume, and Microsoft has moved the same way, so this is no longer optional for outreach.
Before you start: use a separate sending domain
Do not run cold outreach from the domain your store, your Amazon brand registry and your customer service run on. If outreach damages that domain's standing, every order confirmation and every customer reply is affected too.
Buy a close variant instead. If your brand is at acmesnacks.com, something like acmesnacks.co, tryacmesnacks.com or acmesnacks-wholesale.com works. Set up the sending domain with its own mailboxes, redirect the root to your main site so a buyer who clicks through lands somewhere real, and do all three records on that domain. The full process is in how to warm up a cold email domain; authentication is step one of it.
Everything below assumes you have a Google Workspace or Microsoft 365 mailbox on that new domain and access to its DNS, either at the registrar where you bought it or at your DNS host.
Step 1: SPF
SPF is a single TXT record at the root of your domain. It lists every service allowed to send mail for the domain and ends with an instruction for what to do with everyone else.
A typical record for a domain that sends only through Google Workspace looks like this:
v=spf1 include:_spf.google.com ~all
For Microsoft 365 the include points at Microsoft's SPF domain instead; your provider's setup page gives you the exact string. If you send through a cold email tool that uses its own servers rather than your mailbox, that tool has its own include to add. Most modern outreach tools send through your Google or Microsoft mailbox, in which case Google's or Microsoft's include is all you need.
Three rules:
- One SPF record per domain. Two TXT records starting with v=spf1 is an automatic fail. If a record already exists, edit it; do not add a second.
- Keep the lookup count down. Each include triggers DNS lookups, and there is a hard cap of ten. A domain that sends through one provider will never hit it; a domain with five marketing tools bolted on can.
- End with ~all or -all. The tilde version is a soft fail, the dash version a hard fail. Use ~all while you are setting up and switch to -all once you are confident everything that sends for you is listed.
Step 2: DKIM
DKIM is generated inside your mail provider, not typed by hand. In Google Workspace it lives in the admin console under the Gmail settings, in the section for authenticating email; in Microsoft 365 it is in the security or Exchange admin area. The provider gives you a hostname (a selector, something like google._domainkey) and a long text value that is the public key. You add that as a TXT or CNAME record exactly as shown, wait for DNS to propagate, then click the button in the admin console to start signing.
Choose a 2048-bit key if you are offered the choice. The record value is long and will often be split into several strings by your DNS host; that is normal. The two mistakes people make are copying the value with a stray space, and forgetting to go back to the admin console and turn signing on after adding the record. The record alone does nothing until signing is enabled.
If your outreach tool sends from its own infrastructure, it will need its own DKIM selector as well. Tools that send through your mailbox generally do not.
Step 3: DMARC
DMARC is one more TXT record, at the hostname _dmarc on your domain. A sensible starting record looks like this:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
Broken down: p=none means "monitor only, do not reject anything yet." The rua address is where receivers send aggregate reports about mail claiming to be from your domain. Start at none, watch the reports for a week or two to confirm all your legitimate mail passes, then tighten to p=quarantine and eventually p=reject.
Do not skip straight to reject on day one. If something you forgot about (a store notification, a support tool, an invoicing app) sends from the same domain without proper alignment, reject will quietly bin it. For a fresh dedicated outreach domain that risk is small, but the habit is worth keeping.
The reports arrive as XML attachments that are unreadable by hand. A free DMARC report viewer turns them into a simple table of sending sources and pass results. That is all you need.
Check that it worked
Do not trust the green tick in your admin console alone. Verify from the outside:
- Send a test message to a personal Gmail address, open it, choose "show original," and read the three lines near the top. You want SPF, DKIM and DMARC all showing PASS.
- Use a mail tester site that gives you a temporary address to send to and then grades the message. It shows authentication results and often flags related problems like a missing reverse DNS entry or a blacklist hit.
- Look up the records directly with any DNS lookup tool: the TXT at your root for SPF, the selector hostname for DKIM, and the _dmarc hostname for DMARC.
DNS changes can take anywhere from minutes to a day to propagate. If a check fails right after you add a record, wait an hour and try again before changing anything.
The mistakes that undo it
In our experience these are the ones that come up again and again:
- Authenticating the root domain but sending from a subdomain, or vice versa. DMARC checks alignment: the domain in the From address must match the domain SPF and DKIM validated. Set up records on the exact domain your mailboxes use.
- Adding a second SPF record because a tool's setup guide says "add this SPF record." Merge the include into your existing record instead.
- Leaving DMARC at p=none forever. None is a monitoring mode. Receivers give more credit to domains with an enforced policy.
- Forgetting the sending tool. If you switch outreach tools and the new one sends from its own servers, it needs its own include and DKIM selector, or everything fails at once.
- Treating authentication as done. Records get broken by a DNS host migration, a website rebuild or a well-meaning developer. Re-check them every few months and whenever replies suddenly dry up.
What authentication does and does not fix
Passing SPF, DKIM and DMARC means receivers know the mail is genuinely from you. It does not mean they want it. A perfectly authenticated domain that sends hundreds of emails a day to unverified addresses will still be filtered, because bounces and complaints drive domain reputation far more than any DNS record.
So the order of operations for a product brand starting wholesale outreach is: dedicated domain, all three records, a few weeks of warm-up, a verified buyer list, and daily volume comfortably inside Gmail's sending limits. Authentication is the foundation the rest stands on.
Getting the DNS right is a one-off job; the harder ongoing work is finding the right distributors and retail buyers for your product and making sure each address is real before you send. WholesalePilot does that part — it finds the buyers, verifies every email and sends the outreach in your name from a properly authenticated setup, so the afternoon you spend on records is never wasted on bounces.
Authentication does not get you into the inbox. It gets you considered for it.
Paste your product link and see which buyers would receive that mail — the buyer preview is free.