SPF, DKIM and DMARC: a plain-English checklist for cold email domains
What each DNS authentication record does, how they fit together, and what to check before a new sending domain goes live.
By the SageLift team,
Mailbox providers use authentication to decide whether a message really comes from the domain it claims. For cold email domains, getting these records right is the minimum before you send anything.
MX — where mail for the domain is delivered
MX records point to your mailbox provider (Google Workspace or Microsoft 365). Without them, replies can't reach you and the domain looks unfinished.
SPF — who is allowed to send
SPF is a TXT record listing the services allowed to send for your domain. Keep it to a single SPF record per domain and include only the services you actually use.
DKIM — a signature on every message
DKIM adds a cryptographic signature to outgoing mail. You generate the key in your mailbox provider and publish the public part in DNS, then switch signing on.
DMARC — what to do when checks fail
DMARC tells receivers how to treat mail that fails SPF or DKIM alignment, and where to send reports. Many teams start with a monitoring policy (p=none) and tighten it once reports look clean.
Pre-launch checklist
- MX records point to the correct provider
- Exactly one SPF record, including your mailbox provider
- DKIM key published and signing enabled
- DMARC record published with a reporting address
- Custom tracking domain configured if your sending tool tracks opens or clicks
- Primary company domain kept separate from cold sending
Authentication doesn't guarantee inbox placement, but missing it is one of the most common reasons new domains struggle. If you'd rather not do it yourself, Machine Setup includes it for every domain.