Article
SPF, DKIM, DMARC Setup for Cold Email (2026) - Clement
clement.so
Quoted on this wiki
Every place a page here uses this source, in the order the words come in it.
If you’ve just run our SPF/DKIM/DMARC checker and something came back red, this is the guide that walks the fix. If you’re setting up a new sending domain from scratch, this is the order to do it in. “Doing them in the wrong order is the single most common reason a setup that “should work” doesn’t.” This guide covers the full setup for a cold-email sending domain in 2026, with provider-specific instructions for the tools most teams actually use. It’s long. Use the table of contents to jump.
The 30-second mental model: “SPF (Sender Policy Framework) — the list of mail servers allowed to send mail on behalf of your domain. Receivers check the sending server’s IP against this list.” DKIM (DomainKeys Identified Mail) — a cryptographic signature added to every outgoing message, signed with a private key, verified by receivers against the public key you publish in DNS. Proves the message wasn’t altered in transit.
SPF (Sender Policy Framework) — the list of mail servers allowed to send mail on behalf of your domain. Receivers check the sending server’s IP against this list. “DKIM (DomainKeys Identified Mail) — a cryptographic signature added to every outgoing message, signed with a private key, verified by receivers against the public key you publish in DNS. Proves the message wasn’t altered in transit.” DMARC (Domain-based Message Authentication, Reporting & Conformance) — the policy receivers should follow when SPF or DKIM fail, plus a reporting mechanism that tells you who’s sending mail as you (legitimate or otherwise).
DKIM (DomainKeys Identified Mail) — a cryptographic signature added to every outgoing message, signed with a private key, verified by receivers against the public key you publish in DNS. Proves the message wasn’t altered in transit. “DMARC (Domain-based Message Authentication, Reporting & Conformance) — the policy receivers should follow when SPF or DKIM fail, plus a reporting mechanism that tells you who’s sending mail as you (legitimate or otherwise).” You need all three. SPF alone tells receivers who can send; nothing about whether the message is genuine. DKIM alone proves authenticity; nothing about who’s authorised. DMARC ties them together: align with SPF or DKIM, follow the published policy when both fail, and report the result back to the domain owner.
Decide on your sending domain “Send cold from a subdomain, not your apex.” A cold campaign that goes wrong damages the sending subdomain’s reputation, not the apex. Your CEO can still send invoices the next morning.
DMARC (Domain-based Message Authentication, Reporting & Conformance) — the policy receivers should follow when SPF or DKIM fail, plus a reporting mechanism that tells you who’s sending mail as you (legitimate or otherwise). “DMARC ties them together: align with SPF or DKIM, follow the published policy when both fail, and report the result back to the domain owner.” In 2026, the Google + Yahoo February 2024 sender requirements made all three effectively mandatory for any meaningful sending volume. Cold email sits squarely in that bracket.
“Authenticated” results from senders you don’t recognise — investigate. Could be a forgotten internal service, could be spoofing. ““Failed” results — the alignment you need to fix before tightening the policy.” Move to p=quarantine, then p=reject
What’s the difference between DKIM signing and DKIM verification? “Signing happens at the sender — the sending platform takes the message body and selected headers, hashes them, signs the hash with the private key, and adds a DKIM-Signature header. Verification happens at the receiver — they pull the public key from DNS, recompute the hash, and check the signature.” You don’t do anything to verify; receivers do that. Your job as the sender is to make sure (a) the public key is published, (b) the platform is actually signing, and (c) the signature aligns to the From-header domain (for DMARC).
In DKIM signing
p= — the policy. none, quarantine, or reject. “rua= — where to send aggregate (daily summary) reports.” ruf= — where to send forensic (per-failure) reports. Most receivers don’t send these anymore; safe to omit.
Send cold from a subdomain, not your apex. If your company is acme.com, send cold from outreach.acme.com or mail.acme.com. The reasons are reputation isolation and operational sanity: “A cold campaign that goes wrong damages the sending subdomain’s reputation, not the apex.” Subdomains can have their own DKIM keys, their own DMARC policy (sp= controls the parent’s policy for subdomains), and can be retired if reputation gets unrecoverable.
Subdomains can have their own DKIM keys, their own DMARC policy (sp= controls the parent’s policy for subdomains), and can be retired if reputation gets unrecoverable. “The subdomain inherits some of the apex’s age signal but starts with a fresh sending track record.” Inventory every service that sends “from” your domain
A cold campaign that goes wrong damages the sending subdomain’s reputation, not the apex. Your CEO can still send invoices the next morning. “Subdomains can have their own DKIM keys, their own DMARC policy (sp= controls the parent’s policy for subdomains), and can be retired if reputation gets unrecoverable.” The subdomain inherits some of the apex’s age signal but starts with a fresh sending track record.
Inventory every service that sends “from” your domain “Before you touch SPF, list every service that sends email claiming to be your domain:” The cold-email platform you’re setting up
Any internal tools that send notifications “Each one needs to be authorised in SPF and (ideally) DKIM-signing.” Step 1 — Set up SPF
Any internal tools that send notifications “Missing one means legitimate mail starts failing DMARC the moment you turn it on.” Step 1 — Set up SPF
If you’ve just run our SPF/DKIM/DMARC checker and something came back red, this is the guide that walks the fix. If you’re setting up a new sending domain from scratch, this is the order to do it in. “Doing them in the wrong order is the single most common reason a setup that “should work” doesn’t.” This guide covers the full setup for a cold-email sending domain in 2026, with provider-specific instructions for the tools most teams actually use. It’s long. Use the table of contents to jump.
Step 1 — Set up SPF “SPF is a single TXT record on your sending domain.” The parts:
The parts: “v=spf1 — version. Always this.” include: — pulls in another domain’s SPF rules. One per sending service.
SPF (Sender Policy Framework) — the list of mail servers allowed to send mail on behalf of your domain. Receivers check the sending server’s IP against this list. “DKIM (DomainKeys Identified Mail) — a cryptographic signature added to every outgoing message, signed with a private key, verified by receivers against the public key you publish in DNS. Proves the message wasn’t altered in transit.” DMARC (Domain-based Message Authentication, Reporting & Conformance) — the policy receivers should follow when SPF or DKIM fail, plus a reporting mechanism that tells you who’s sending mail as you (legitimate or otherwise).
DKIM (DomainKeys Identified Mail) — a cryptographic signature added to every outgoing message, signed with a private key, verified by receivers against the public key you publish in DNS. Proves the message wasn’t altered in transit. “DMARC (Domain-based Message Authentication, Reporting & Conformance) — the policy receivers should follow when SPF or DKIM fail, plus a reporting mechanism that tells you who’s sending mail as you (legitimate or otherwise).” You need all three. SPF alone tells receivers who can send; nothing about whether the message is genuine. DKIM alone proves authenticity; nothing about who’s authorised. DMARC ties them together: align with SPF or DKIM, follow the published policy when both fail, and report the result back to the domain owner.
DMARC (Domain-based Message Authentication, Reporting & Conformance) — the policy receivers should follow when SPF or DKIM fail, plus a reporting mechanism that tells you who’s sending mail as you (legitimate or otherwise). “DMARC ties them together: align with SPF or DKIM, follow the published policy when both fail, and report the result back to the domain owner.” In 2026, the Google + Yahoo February 2024 sender requirements made all three effectively mandatory for any meaningful sending volume. Cold email sits squarely in that bracket.
Quotes are verbatim and belong to their publishers. Where a quote has been translated, the original wording is kept below it.