PlaybooksSPF/DKIM/DMARC

SPF, DKIM, and DMARC setup for cold email

The DNS authentication layer is the foundation of cold email deliverability. If SPF, DKIM, or DMARC are misconfigured, nothing else you do matters. Here's how to get it right.

Who this is for

Technical founders, DevOps, or ops leads setting up DNS records for cold email sending domains.

Typical sending volume

Authentication setup is the same regardless of volume. This is step zero for any cold email infrastructure.

Common challenges

  • Set up DNS records following a blog post but emails still fail authentication checks.
  • Not sure whether DMARC should be 'none', 'quarantine', or 'reject' for cold email domains.
  • Multiple sending tools using the same domain with conflicting SPF includes.
  • Emails pass SPF but fail DKIM, or vice versa, and you can't figure out why.

What we cover

  • Complete SPF record design: correct includes, no duplicate entries, staying under the 10-lookup limit.
  • DKIM key generation and rotation for each sending platform connected to the domain.
  • DMARC policy configuration appropriate for cold email (alignment, reporting, enforcement).
  • Verification testing to confirm all three protocols pass before any sending begins.

Infrastructure blueprint

  1. Step 1: Inventory all services that will send email from this domain.
  2. Step 2: Build SPF record with correct includes, staying under 10 DNS lookups.
  3. Step 3: Generate DKIM keys for each sending service and add to DNS as TXT records.
  4. Step 4: Set DMARC record starting with p=none for monitoring, then tighten.
  5. Step 5: Test with Google Admin Toolbox, MXToolbox, or mail-tester.com to verify all pass.

Success metrics

Playbook
  • SPF, DKIM, and DMARC all passing on 100% of test emails.
  • DMARC alignment achieving 'pass' status in DMARC reports.
  • No authentication failures on daily sending within the first 30 days.

Want us to handle the setup? We'll build this infrastructure for you and hand it over production-ready.