SPF, DKIM & DMARC Setup Guide for Cold Email (2026)

You built a beautiful email sequence. You loaded 500 leads. You hit send. And... crickets. 15% open rate. Your emails are going straight to spam.

The problem isn't your copy. It's your DNS. If SPF, DKIM, and DMARC aren't configured correctly, email providers flag you before your prospect even sees your subject line.

Here's how to fix it — permanently.

What Are SPF, DKIM, and DMARC?

Think of them as three layers of email ID verification:

All three work together. Missing one is like locking two doors but leaving the third wide open.

Step 1: Set Up SPF

SPF (Sender Policy Framework) tells the world which mail servers are authorized to send email on behalf of your domain.

How to Add an SPF Record

1. Go to your DNS provider (Cloudflare, Namecheap, GoDaddy, etc.)
2. Add a TXT record for your root domain
3. The value depends on your email provider

Common SPF Records

Google Workspace:

v=spf1 include:_spf.google.com ~all

Google Workspace + Saleshandy:

v=spf1 include:_spf.google.com include:_spf.saleshandy.com ~all

Microsoft 365:

v=spf1 include:spf.protection.outlook.com ~all

SPF Lookup Limit

SPF allows a maximum of 10 DNS lookups. Each include: counts as one (plus any nested lookups inside it). Google's include alone uses 4-5 lookups. If you exceed 10, your SPF silently fails.

Check your count: Use MXToolbox SPF Checker to verify.

Step 2: Set Up DKIM

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every email you send. The receiving server checks this signature against a public key in your DNS.

For Google Workspace

1. Go to Google Admin Console → Apps → Google Workspace → Gmail → Authenticate Email
2. Click Generate New Record
3. Select your domain, keep the prefix as google
4. Copy the DKIM value (a long string starting with v=DKIM1;)
5. Add a TXT record in your DNS:
   • Name: google._domainkey
   • Value: the string Google gave you
6. Wait 24-48 hours for DNS propagation
7. Go back to Google Admin and click Start Authentication

For Saleshandy (or similar sending tools)

Most cold email tools provide their own DKIM records. Check your tool's documentation — they'll give you a CNAME or TXT record to add. For Saleshandy specifically:

1. Go to Settings → Email Accounts → Select account → Authentication
2. Copy the DKIM CNAME record
3. Add it to your DNS

Step 3: Set Up DMARC

DMARC (Domain-based Message Authentication, Reporting & Conformance) ties SPF and DKIM together and tells receiving servers what to do when checks fail.

The DMARC Record

Add a TXT record in your DNS:

• Name: _dmarc
• Value: (see below)

Start with Monitoring Mode

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; pct=100

This tells servers: "Don't reject anything yet, but send me reports about failures." Run this for 2-4 weeks to identify legitimate senders you might have missed in SPF.

Then Tighten to Quarantine

v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; pct=100

After confirming all legitimate email passes SPF/DKIM, switch to quarantine. Failed emails go to spam instead of inbox.

Finally: Reject

v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com; pct=100

The nuclear option. Failed emails get bounced entirely. Only do this once you're 100% confident your DNS is correct.

The Complete DNS Checklist

How to Verify Everything Works

Quick Test: Send to mail-tester.com

1. Go to mail-tester.com
2. Copy the test email address
3. Send an email from your cold email account
4. Check your score — aim for 9/10 or higher

DNS Verification Tools

• SPF: MXToolbox SPF Check
• DKIM: MXToolbox DKIM Check
• DMARC: MXToolbox DMARC Check
• Everything: LearnDMARC.com (visual flowchart)

Command-Line Verification

# Check SPF
dig TXT yourdomain.com | grep spf

# Check DKIM
dig TXT google._domainkey.yourdomain.com

# Check DMARC
dig TXT _dmarc.yourdomain.com

# Check MX
dig MX yourdomain.com

Common Mistakes That Kill Deliverability

1. Multiple SPF records — Only one TXT record starting with v=spf1 per domain. Combine providers into one record.
2. Forgetting the sending tool's SPF include — Google's SPF only covers Gmail. Your cold email tool sends from different servers.
3. Not waiting for DKIM propagation — DKIM records can take up to 48 hours. Don't start sending before they're live.
4. DMARC set to reject on Day 1 — Start with p=none, graduate to p=quarantine, then p=reject.
5. Using your main domain for cold email — Always use a separate sending domain. If it gets burned, your main domain stays clean.
6. Skipping custom tracking domain — Default tracking domains are shared and often blacklisted. Use a custom subdomain.

Sending Domain Strategy for Cold Email

Never send cold email from your primary business domain. Here's the right setup:

• Primary domain: yourbusiness.com — for website, inbound, transactional email only
• Sending domain 1: getyourbusiness.com — for cold outreach
• Sending domain 2: tryyourbusiness.com — backup sending domain
• Tracking domain: track.getyourbusiness.com — custom link/open tracking

Cost: ~$12/year per domain. Cheap insurance against reputation damage.

Key Takeaways

• SPF + DKIM + DMARC = mandatory. Missing any one of them is like leaving a door unlocked.
• One SPF record, max 10 lookups. Combine all providers into a single TXT record.
• DKIM for every sender. Your email provider AND your cold email tool each need their own DKIM keys.
• DMARC starts at p=none. Monitor first, enforce later.
• Separate domains for cold email. Protect your primary domain at all costs.
• Verify with MXToolbox and mail-tester.com. Don't guess — check.

Set this up once, correctly, and you'll never wonder why your emails are going to spam again.