DNS setup for email deliverability: SPF, DKIM, and DMARC

Before sending cold outreach from a domain, you should have three DNS records in place: SPF, DKIM, and DMARC. These tell receiving mail servers that your emails are legitimate and reduce the chance of landing in spam.

SPF

SPF (Sender Policy Framework) tells receiving servers which mail servers are authorised to send email on behalf of your domain.

Add a TXT record to your domain's DNS with the value your email provider requires. If you are sending via Google Workspace, the record looks like:

v=spf1 include:_spf.google.com ~all

If you are using a custom SMTP provider, use their SPF include string. Contact us at [email protected] if you need help finding the right value for your setup.

DKIM

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to your outgoing emails so receiving servers can verify they have not been tampered with.

DKIM is set up through your email provider. For Google Workspace, go to Google Admin > Apps > Gmail > Authenticate email to generate and publish your DKIM key. For Outlook / Microsoft 365, go to the Microsoft Defender portal to enable DKIM for your domain.

DMARC

DMARC (Domain-based Message Authentication, Reporting, and Conformance) tells receiving servers what to do with emails that fail SPF or DKIM checks.

A minimal DMARC record to start with:

v=DMARC1; p=none; rua=mailto:[email protected]

Start with p=none (monitor only), review any reports, then move to p=quarantine or p=reject once you are confident your legitimate sends are passing.

Checking your setup

Use a free tool like MXToolbox or mail-tester.com to verify your SPF, DKIM, and DMARC records are correctly configured before you begin sending.