How to set up SPF, DKIM and DMARC for cold email
The exact SPF, DKIM and DMARC records for a cold email domain on Google Workspace or Microsoft 365, the order to add them, and the mistakes that break them.
For a cold email domain you need three DNS records: one SPF record that lists every service sending as that domain, a DKIM key published by the mailbox provider (2048-bit where it offers one), and a DMARC record at _dmarc.yourdomain.com that starts at p=none with reports switched on. Add them before the first email goes out, check that a test message shows PASS on all three, and only then start the warm-up. Below are the exact records for Google Workspace and Microsoft 365, the order to add them in, and the mistakes that break them quietly.
Why this is no longer optional
Since February 2024 Gmail has required every sender to pass SPF or DKIM, and anyone sending 5,000 or more messages a day to personal Gmail accounts to have SPF, DKIM and a DMARC record, with the From domain aligned to one of them (Gmail sender guidelines). Yahoo set the same bar (Yahoo sender best practices). In May 2025 Microsoft started rejecting mail to Outlook.com, Hotmail and Live from high-volume domains that fail these checks (Microsoft Defender for Office 365 blog).
- messages a day to Gmail that put you under the bulk sender rules
- 5,000
- spam complaint rate Gmail asks senders never to reach
- 0.3%
A cold domain sending 30 emails a day is nowhere near 5,000. That doesn't let you off. The thresholds decide when a provider rejects you outright; below them, missing authentication is one more reason to file you in spam. And a brand-new domain with no history has no other reasons in its favor.
The three records, in plain words
| Record | Where it lives | What it proves | What breaks it |
|---|---|---|---|
| SPF | TXT on the domain itself | This server is allowed to send for the domain | Two SPF records, more than 10 DNS lookups |
| DKIM | TXT at selector._domainkey | The message wasn't changed and the domain signed it | Signing turned off in the sending tool, key too short |
| DMARC | TXT at _dmarc | What to do when SPF and DKIM fail, and where to send reports | No alignment with the From domain |
DMARC is the one people misread. It doesn't check anything new. It looks at SPF and DKIM and asks whether at least one of them passed for the same domain as the From address. A message can pass SPF for your sending tool's domain and still fail DMARC because the From line says yourdomain.com. That's what alignment means, and it's why DKIM matters more than SPF for cold email: DKIM signed with your own domain survives forwarding and almost any sending setup.
Records for Google Workspace and Microsoft 365
Say your outreach domain is getacme.com and the mailboxes live in Google Workspace.
SPF, one TXT record on getacme.com:
v=spf1 include:_spf.google.com ~all
On Microsoft 365 it's include:spf.protection.outlook.com instead. If a second service also sends as this domain, add its include to the same record. Never create a second record that starts with v=spf1: two of them is a permanent error, and receivers treat it as no SPF at all (RFC 7208).
DKIM, generated by the provider. In the Google Admin console go to Apps → Google Workspace → Gmail → Authenticate email, generate a 2048-bit key, publish the TXT record it shows at google._domainkey.getacme.com, wait for DNS, then press "Start authentication" (Google DKIM setup). Publishing the record alone does nothing until that button is pressed; this is the most common reason DKIM shows "none" in headers. Microsoft 365 uses two CNAME records, selector1._domainkey and selector2._domainkey, and a switch in the Defender portal. The DKIM standard requires keys of at least 1024 bits and recommends 2048 (RFC 8301).
DMARC, one TXT record at _dmarc.getacme.com:
v=DMARC1; p=none; rua=mailto:dmarc@getacme.com; adkim=r; aspf=r
p=none means "deliver as usual, but send me reports". rua is where the daily aggregate reports go; point it at a mailbox you'll actually open or at a free report parser. Relaxed alignment (r) lets mail.getacme.com count as getacme.com, which is what you want (Google DMARC setup).
The order that avoids surprises
Setting up a new cold email domain
- Day 0: buy the domain, add MXUse a separate domain from your main one, so a bad week of outreach can't touch invoices and support mail.
- Day 0: SPFOne record, every sending service included, ~all at the end.
- Day 1: DKIMGenerate a 2048-bit key, publish it, and turn signing on in the admin panel.
- Day 1: DMARC at p=noneWith a rua address, so you see who sends as your domain.
- Day 2: testSend to a Gmail address, open Show original, and check SPF, DKIM and DMARC all say PASS.
- Day 2 onward: warm upOnly now start sending, slowly.
- Week 3 to 4: tightenIf reports show only your own services, move DMARC to p=quarantine.
Two notes on that list. Point the outreach domain's website at your main site with a redirect, so a prospect who types it in lands somewhere real. And if you use a tracking domain for opens or links, set it up as a CNAME on the outreach domain; a shared tracking domain from your tool carries every other customer's reputation.
How long the warm-up itself should take is a separate question; we covered it in How long to warm up a new email domain.
Mistakes that break authentication quietly
- A sending tool that doesn't sign with your DKIM. If a sequencer sends through its own servers, it needs its own DKIM setup for your domain. Connect mailboxes by OAuth or SMTP through your provider instead, and the provider signs.
- Too many SPF includes. Each
includecosts DNS lookups, and nested ones count too. Past 10, SPF fails for every message. Remove services you stopped using. +allat the end of SPF. It means "anyone may send as me". Use~all.- Jumping to
p=rejecton day one. If one service was forgotten, its mail disappears and nobody tells you. Read two weeks of reports first. - Checking only once. DNS gets edited months later by someone adding a newsletter tool. Re-check headers after any change.
The quickest health check is still the one in your inbox: send a message to yourself on Gmail, open "Show original", and read the three lines at the top. Three PASS results mean the plumbing is done.
After the records are right
Authentication gets you in the door; it doesn't keep you there. Complaint rate, bounces and the pace of sending decide the rest. Watch Google Postmaster Tools once volume shows up there, keep each mailbox at a steady daily number, and stop a mailbox the day a provider pushes back.
That last part is where Nitrino helps. It writes campaigns from your own mailboxes, and each mailbox gets a health level that reads its DNS records and its bounces; a broken mail setup stops the mailbox from writing to new people until it's fixed, and anything weaker slows it down. Mailboxes connected by password are warmed up and spam-tested on their own.
Whatever you send with, do the records first. Fifteen minutes in DNS settings is cheaper than a domain that starts its life in spam.
