If your cold emails are landing in spam, there is a high probability that your email authentication records are missing, misconfigured, or incomplete.
SPF, DKIM, and DMARC are the three DNS records that tell receiving email servers "this email came from a legitimate, authorized sender." Without all three correctly configured, even the most compelling cold email can end up in the promotions tab or spam folder - regardless of how clean your list is or how good your copy is.
This guide walks through exactly what each record does and gives you the precise DNS values to set for both Google Workspace and Microsoft 365 sending domains.
What Each Record Does (Plain English)
SPF (Sender Policy Framework)
SPF is a list of authorized mail servers for your domain. When someone receives an email from hello@yourdomain.com, their email server looks up the SPF record for yourdomain.com and checks: "Is the server that sent this email on the authorized list?" If not, the email fails SPF authentication.
DKIM (DomainKeys Identified Mail) DKIM adds a cryptographic signature to every email you send. The recipient's server uses a public key stored in your DNS to verify the signature. If the signature validates, it proves the email has not been tampered with in transit and it genuinely came from your domain.
DMARC (Domain-based Message Authentication Reporting and Conformance)
DMARC is the policy layer on top of SPF and DKIM. It tells receiving email servers what to do when an email fails SPF or DKIM: should they deliver it anyway (none), put it in spam (quarantine), or reject it outright (reject)? DMARC also sends you reports of authentication failures so you can monitor whether someone is spoofing your domain.
Before You Begin
You will need:
- Access to your domain's DNS settings (via your registrar: Namecheap, GoDaddy, Cloudflare, etc.)
- An active Google Workspace or Microsoft 365 account connected to your sending domain
- About 20-30 minutes for the DNS changes to take effect (can take up to 48 hours to fully propagate)
Step 1: Configure SPF
Add the following TXT record to your domain's DNS. You add it at the root level (@) or the bare domain.
For Google Workspace:
| Record Type | Host / Name | Value |
|---|---|---|
| TXT | @ (or blank) | v=spf1 include:_spf.google.com ~all |
For Microsoft 365:
| Record Type | Host / Name | Value |
|---|---|---|
| TXT | @ (or blank) | v=spf1 include:spf.protection.outlook.com ~all |
If you send from both Google and Microsoft on the same domain (rare but possible):
v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all
Important: You can only have one SPF record per domain. If you have multiple sending services (e.g., Google Workspace plus a transactional email provider like Sendgrid), combine them into a single SPF record with multiple
include:statements.
Verify it's working:
After adding the record, wait 30 minutes and then use MXToolbox's SPF Checker to verify the record is live and valid.
Step 2: Configure DKIM
DKIM requires a private key to be generated inside your email provider, and a corresponding public key to be published in your DNS.
For Google Workspace:
- Go to your Google Workspace Admin Console (
admin.google.com) - Navigate to Apps > Google Workspace > Gmail > Authenticate email
- Select your domain
- Click Generate new record
- Choose key length 2048-bit (recommended)
- Google will display a TXT record to add to your DNS
The record will look like this:
| Record Type | Host / Name | Value |
|---|---|---|
| TXT | google._domainkey | v=DKIM1; k=rsa; p=[very long string of characters] |
Copy the exact value Google provides and paste it into your DNS.
For Microsoft 365:
- Go to your Microsoft 365 Defender portal (
security.microsoft.com) - Navigate to Email & Collaboration > Policies & Rules > Threat Policies > Email Authentication Settings
- Select DKIM and find your domain
- Click Create DKIM keys
- Microsoft will provide two CNAME records to add to your DNS
| Record Type | Host / Name | Value |
|---|---|---|
| CNAME | selector1._domainkey | selector1-yourdomain-com._domainkey.yourtenant.onmicrosoft.com |
| CNAME | selector2._domainkey | selector2-yourdomain-com._domainkey.yourtenant.onmicrosoft.com |
After adding the DNS records, return to the Defender portal and toggle DKIM to Enabled.
Step 3: Configure DMARC
Add the following TXT record. This goes at _dmarc.yourdomain.com.
| Record Type | Host / Name | Value |
|---|---|---|
| TXT | _dmarc | v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com |
Breaking down the DMARC record:
v=DMARC1- declares this as a DMARC record (required)p=quarantine- tells receivers to send failing emails to spam (recommended starting policy)rua=mailto:dmarc@yourdomain.com- sends aggregate reports of authentication failures to this address so you can monitor spoofing attempts
DMARC Policy Levels:
| Policy | What it does | When to use |
|---|---|---|
| p=none | Monitor only, no action taken on failures | When first setting up, to monitor before enforcing |
| p=quarantine | Send failing emails to spam | Once you have verified SPF and DKIM are working correctly |
| p=reject | Reject failing emails outright | Once you have full confidence in your authentication setup |
Start with p=quarantine for cold email sending domains. You can escalate to p=reject once you have monitored the DMARC reports for a few weeks and confirmed legitimate mail is passing authentication.
Step 4: Verify All Three Records Together
After adding all three DNS records, wait at least 30 minutes for propagation and then run a full authentication check.
Free tools to verify:
- Mail-Tester.com - Send a test email to the provided address and get a full deliverability score (aim for 9/10 or higher)
- MXToolbox Email Health - Checks SPF, DKIM, DMARC, blacklists, and MX records in one report
- Google Admin Toolbox - Specific to Google Workspace sending domains
Common Errors and How to Fix Them
"SPF too many DNS lookups" error:
SPF records can only have up to 10 DNS lookups. If you have many include: statements, you may exceed this limit. Use a tool like EasyDMARC's SPF Flattener to consolidate your record.
DKIM signature not validating: Usually caused by your DNS provider auto-adding your domain to the CNAME or TXT value, creating a duplicate. Make sure the value is entered exactly as your email provider specifies, without adding your domain name to the end.
DMARC reports showing SPF failures: If your SPF record is correct but emails are failing SPF authentication in DMARC reports, it often means emails are being sent through a relay or third-party service that is not included in your SPF record. Check whether you use any newsletter or CRM tools that send email on your behalf and add their include statements.
What to Expect After Setup
With SPF, DKIM, and DMARC all correctly configured, you should see:
- A significant reduction in emails landing in spam or promotions tabs
- Better open rates across your campaigns within 1-2 weeks as email providers assign positive reputation to authenticated senders
- DMARC reports arriving at your designated inbox showing authentication results for all emails sent from your domain
If you have correctly set up all three records and your cold emails are still landing in spam, the issue is more likely list quality (high bounce rate), sending volume (exceeding safe inbox limits), or content (spam trigger words in subject lines or body). These are separate issues from authentication.
Running This at Scale With Multiple Domains
If you are managing cold email for multiple clients or running campaigns from multiple sending domains, you need to repeat this process for every domain. This quickly becomes a meaningful time investment.
InvokeIQ's domain management panel validates SPF, DKIM, and DMARC automatically when you connect a new sending domain, flagging any missing or misconfigured records before you start your first campaign. It also monitors ongoing authentication status across all connected domains.
Connect your first sending domain in InvokeIQ and get your authentication validated in under 5 minutes.
Tags
Get the weekly brief
Enjoyed this article?
One email per week with the best cold email strategies, templates, and deliverability tips.