Article
SPF, DKIM, DMARC Setup for Cold Email (2026) - Clement
clement.so
Quoted on this wiki
Every place a page here uses this source, in the order the words come in it.
“Authenticated” results from senders you don’t recognise — investigate. Could be a forgotten internal service, could be spoofing. ““Failed” results — the alignment you need to fix before tightening the policy.” Move to p=quarantine, then p=reject
What’s the difference between DKIM signing and DKIM verification? “Signing happens at the sender — the sending platform takes the message body and selected headers, hashes them, signs the hash with the private key, and adds a DKIM-Signature header. Verification happens at the receiver — they pull the public key from DNS, recompute the hash, and check the signature.” You don’t do anything to verify; receivers do that. Your job as the sender is to make sure (a) the public key is published, (b) the platform is actually signing, and (c) the signature aligns to the From-header domain (for DMARC).
In DKIM signing
p= — the policy. none, quarantine, or reject. “rua= — where to send aggregate (daily summary) reports.” ruf= — where to send forensic (per-failure) reports. Most receivers don’t send these anymore; safe to omit.
Run the checker on the sending domain. All four cards (SPF, DKIM, DMARC, MX) should show pass or warn. No fails. “Send a test message. From the sending platform, send a real test email to a Gmail address you control.” Cross-check with mail-tester.com. Send a test message to the address it provides; it scores authentication, content, and several other deliverability signals. 9/10 or above is the target.
Easy retirement. If reputation becomes unrecoverable, retire the subdomain and bring up a new one. You can’t retire your apex. “But it’s still a new sender for reputation purposes; warmup still applies.” DMARC alignment on subdomains is “relaxed” by default — which means SPF or DKIM aligning to the parent domain (acme.com) is enough. That’s usually what you want. Strict alignment (aspf=s or adkim=s) requires the From-header domain to match exactly; rarely needed for cold setups.
Decide on your sending domain “Send cold from a subdomain, not your apex.” A cold campaign that goes wrong damages the sending subdomain’s reputation, not the apex. Your CEO can still send invoices the next morning.
A cold campaign that goes wrong damages the sending subdomain’s reputation, not the apex. Your CEO can still send invoices the next morning. “Subdomains can have their own DKIM keys, their own DMARC policy (sp= controls the parent’s policy for subdomains), and can be retired if reputation gets unrecoverable.” The subdomain inherits some of the apex’s age signal but starts with a fresh sending track record.
Inventory every service that sends “from” your domain “Before you touch SPF, list every service that sends email claiming to be your domain:” The cold-email platform you’re setting up
Any internal tools that send notifications “Each one needs to be authorised in SPF and (ideally) DKIM-signing.” Step 1 — Set up SPF
The 30-second mental model: “SPF (Sender Policy Framework) — the list of mail servers allowed to send mail on behalf of your domain. Receivers check the sending server’s IP against this list.” DKIM (DomainKeys Identified Mail) — a cryptographic signature added to every outgoing message, signed with a private key, verified by receivers against the public key you publish in DNS. Proves the message wasn’t altered in transit.
The parts: “v=spf1 — version. Always this.” include: — pulls in another domain’s SPF rules. One per sending service.
SPF (Sender Policy Framework) — the list of mail servers allowed to send mail on behalf of your domain. Receivers check the sending server’s IP against this list. “DKIM (DomainKeys Identified Mail) — a cryptographic signature added to every outgoing message, signed with a private key, verified by receivers against the public key you publish in DNS. Proves the message wasn’t altered in transit.” DMARC (Domain-based Message Authentication, Reporting & Conformance) — the policy receivers should follow when SPF or DKIM fail, plus a reporting mechanism that tells you who’s sending mail as you (legitimate or otherwise).
DKIM (DomainKeys Identified Mail) — a cryptographic signature added to every outgoing message, signed with a private key, verified by receivers against the public key you publish in DNS. Proves the message wasn’t altered in transit. “DMARC (Domain-based Message Authentication, Reporting & Conformance) — the policy receivers should follow when SPF or DKIM fail, plus a reporting mechanism that tells you who’s sending mail as you (legitimate or otherwise).” You need all three. SPF alone tells receivers who can send; nothing about whether the message is genuine. DKIM alone proves authenticity; nothing about who’s authorised. DMARC ties them together: align with SPF or DKIM, follow the published policy when both fail, and report the result back to the domain owner.
If you’ve just run our SPF/DKIM/DMARC checker and something came back red, this is the guide that walks the fix. If you’re setting up a new sending domain from scratch, this is the order to do it in. “Doing them in the wrong order is the single most common reason a setup that “should work” doesn’t.” This guide covers the full setup for a cold-email sending domain in 2026, with provider-specific instructions for the tools most teams actually use. It’s long. Use the table of contents to jump.
Any internal tools that send notifications “Missing one means legitimate mail starts failing DMARC the moment you turn it on.” Step 1 — Set up SPF