How to Set Up SPF, DKIM, and DMARC for Cold Email Outreach

Your cold email has a good subject line, a real reason to reach out, and a list built from public business data — but half of it lands in spam anyway. That is not a copy problem. It is an authentication problem: your sending domain has never told Gmail, Outlook, or Yahoo that the mail is really from you. ExtractData turns zipcode searches into structured business lead lists with phone, address, and contact fields, and that list only pays off if the emails you send from it actually reach an inbox.

What are SPF, DKIM, and DMARC?

SPF, DKIM, and DMARC are three DNS text records that work together to prove an email is genuinely from your domain, was not altered in transit, and tell a receiving mail server what to do if it fails those checks. Each one covers a different gap, and none of them alone stops spoofing on its own.

None of the three replaces the others. SPF without DKIM breaks the moment a message is forwarded. DKIM without SPF still lets someone send from a server you never authorized. DMARC is the policy layer that sits on top of both and tells a receiving server what to do with a message that fails.

How do I set up SPF for my sending domain?

SPF is one TXT record listing every server and third-party service allowed to send mail as your domain. You publish it once at the domain root, then add a new entry any time you add a new sending tool.

1. List every service that sends mail as your domain — your mail server, your CRM, your marketing platform.
2. Write one TXT record starting with v=spf1 and an include: mechanism for each service.
3. End the record with ~all (soft fail) while you test, then switch to -all once every sender checks out.
4. Publish the record at your domain's root, not on a subdomain you are not sending from.
5. Send a real test message and check the headers for spf=pass.

SPF alone breaks when a message is forwarded, because the receiving server sees the forwarder's IP address instead of yours. That is one of the main reasons SPF needs DKIM alongside it — DKIM travels with the message instead of depending on which server relayed it.

How do I set up DKIM so cold email passes authentication?

DKIM adds a digital signature to each outgoing message, generated from a private key your mail server holds and checked against a public key published in your DNS. You turn it on per sending domain and per selector, and most mail platforms and CRMs generate the key pair for you and give you the DNS record to publish.

DKIM signs the message body and headers with a private key, so the signature becomes invalid if either one changes in transit. That is what makes it more reliable than SPF for messages that pass through a forwarder or a mailing list — the signature travels with the message itself instead of depending on the sending IP.

Once the DKIM record is published, send a real test message and confirm dkim=pass in the received headers before you consider it done. A record that looks correct in DNS but has not been tested against a real send is not verified.

How do I roll out a DMARC policy without blocking my own mail?

You start a DMARC record at p=none, which only requests reports and blocks nothing, then move to p=quarantine and finally p=reject once your reports show every legitimate sender passing. Jumping straight to p=reject is how teams accidentally block their own newsletter or CRM notifications.

1. Publish p=none with a rua= reporting address and watch the aggregate reports for two to four weeks.
2. Fix any legitimate sender that shows up failing SPF or DKIM alignment.
3. Move to p=quarantine; pct=25 and raise the percentage gradually as reports stay clean.
4. Move to p=reject once nothing legitimate is failing.

A DMARC record with p=none does not block or quarantine anything on its own; it only turns on reporting so you can see who is sending as your domain before you tighten the policy. Google requires anyone sending more than 5,000 messages a day to Gmail addresses to publish SPF, DKIM, and a DMARC record, according to Google's bulk sender guidelines, and it reads those same DMARC reports to catch anyone spoofing your domain.

Why do authenticated emails still land in spam?

Passing SPF, DKIM, and DMARC keeps you out of the automatic spoofing filters, but spam placement past that point is decided by engagement and sending behavior. A brand-new domain that suddenly sends five hundred cold emails in one morning looks like a spam operation even with perfect authentication.

• Ramp sending volume gradually on a new domain or subdomain instead of mailing your full list on day one.
• Watch bounce and complaint rates — high bounces on a fresh domain are one of the fastest ways to burn its reputation.
• Keep a consistent sending pattern; large, irregular bursts read as automated abuse.
• Use a dedicated sending subdomain for cold outreach so a bad week does not touch your main domain's reputation.

How does list quality fit into deliverability?

Authentication protects your domain's reputation, but a list full of dead phone numbers, closed businesses, and guessed email addresses damages that same reputation just as fast, through bounces and spam complaints. The fastest way to protect a new sending domain is to only mail contacts you can verify came from a real, currently operating business, the same way you would verify business data before importing it into a CRM.

This is the point where a manually built spreadsheet gets expensive to trust. ExtractData cross-references Google Places and Yelp listings so a business on your list is more likely to still be open, not a closed storefront still sitting on the map from three years ago, and the Pro and Agency plans add an enrichment pass that checks contact details before they ever reach your outreach tool. You can compare the Free, Pro, and Agency plans to see which verification level fits your sending volume.

Is this worth the setup time if I only send a few hundred emails a week?

Yes, and the actual work is smaller than it sounds. Publishing SPF, DKIM, and a DMARC record is three DNS entries you add once; the ongoing part is watching DMARC reports for a few weeks after each change, not a recurring task. The volume where authentication matters most is not your total send count — it is whether a receiving server has ever seen your domain send mail before, which is true for every new domain regardless of size.

The bottom line

Set up SPF, DKIM, and DMARC in that order, watch DMARC reports for two to four weeks before tightening the policy from p=none to p=reject, and treat your lead list itself as a deliverability input rather than just a target list. If you are building outreach lists from public business data, create a free ExtractData account and run your first zip-code search — it takes a couple of minutes and shows you what a verified contact list looks like before you touch a single DNS record.

Frequently asked questions

Reviewed by the ExtractData Team — lead-generation and business-data guidance, updated September 2026.