Email Authentication for Cold Email: MX, SPF, DKIM and DMARC
Every cold email domain needs four DNS records. Together they prove to mailbox providers that your emails really come from you. Without them, Gmail, Yahoo and Outlook will send your emails to spam or reject them.
| Record | What it does | Required? |
|---|---|---|
| MX | Tells the internet which server receives email for your domain | Yes, so you can receive replies |
| SPF | Lists the servers allowed to send email for your domain | Yes |
| DKIM | Adds a digital signature to each email, so receivers can check it wasn't changed or forged | Yes |
| DMARC | Tells receivers what to do with emails that fail SPF or DKIM, and sends you reports | Yes |
If you followed the setup wizard in Google Workspace or Zoho Mail, some of these may already be in place. Read through each page anyway. You need to check every record exists, and you will change your DMARC record over the first few weeks.
Set up all four records for each cold email domain.
What Gmail, Yahoo and Outlook require
These are the main rules for anyone sending lots of email to Gmail, Yahoo and Outlook.com users. Follow them from day one, even when your volume is small:
- SPF and DKIM both set up and passing
- DMARC published, with at least
p=none - Alignment: the domain in your From address matches the domain used by SPF or DKIM. Using Google Workspace or Zoho Mail with your own domain handles this for you.
- Spam complaints below 0.3%, and ideally below 0.1%
- An easy way to unsubscribe (see Write your emails)
Check your records
After adding the records, wait 15 to 30 minutes, then check each domain:
- MXToolbox checks MX, SPF, DKIM and DMARC records
- Google Admin Toolbox Check MX checks Google Workspace domains
- Mail Tester gives a score for a test email sent from one of your inboxes
Fix any errors before you start warming up your inboxes.