SPF, DKIM and DMARC for Cold Email
Updated 2026-10-27 · Mail Pro by Client Portal
SPF lists the servers allowed to send for a domain, DKIM signs each message so it cannot be altered in transit, and DMARC tells receivers what to do when either check fails. For cold email, publish all three on the sending domain, align them with the visible From address, and start DMARC with a monitoring policy before moving to enforcement.
Three records, three jobs
SPF is a DNS record that lists which servers may send mail claiming to be your domain. If a message comes from a server that is not on the list, SPF fails. DKIM adds a cryptographic signature to each message using a private key; the matching public key sits in DNS, and a receiver uses it to confirm the message was authorised and not changed. DMARC ties the two together and adds a policy for failures, plus a place to receive reports.
None of the three makes an email interesting, but together they answer a basic question every receiving provider asks: did this domain really send this message? Cold email from an unauthenticated domain is treated as suspicious by default.
Publish SPF without breaking what already sends
SPF is a single TXT record on the domain and it has a lookup limit. If the domain already sends through a website, a CRM or Google Workspace, the record may exist. Add your cold email provider to the existing record rather than creating a second SPF record, because two records cause a permanent error.
Keep the record short. Every include directive costs a DNS lookup, and providers stop evaluating after ten. If the domain is new and dedicated to cold email, the record can be simple: authorise the sending servers you actually use and nothing else.
Sign with DKIM on every sending path
DKIM keys are generated per provider or per mailbox. When you connect Gmail, Outlook or a custom SMTP account, the provider either signs automatically or gives you CNAME records to add. Publish those records, wait for propagation, then send a test message and inspect the headers to confirm a DKIM signature is present and passes.
The common mistake is signing with a subdomain that does not align with the From domain. Receivers then see a valid signature from a domain that is not the one in the email, which weakens trust and can fail DMARC alignment.
Roll out DMARC in two stages
Start with a monitoring policy, p=none, and a reporting address. Read the reports for a week or two: they show which servers send for the domain and which messages fail. Fix the gaps, then move to a quarantine policy, then to reject once you are confident that every legitimate sender is authenticated.
For a dedicated cold email domain, this sequence is manageable because there are few senders. For your main brand domain, it is essential to inventory every tool that sends invoices, password resets and notifications before enforcing reject.
- Confirm SPF passes for each sending provider.
- Confirm DKIM aligns with the From domain.
- Confirm DMARC passes and reports arrive.
- Re-check after adding or removing a provider.
- Never publish two SPF records for one domain.
Check the result from outside
Your own mail client may show a message as fine while the receiving provider sees a failure. Use a deliverability checker or a test send to an external mailbox and read the authentication results in the headers. Mail Pro reports SPF, DKIM and DMARC status for connected senders on Growth and Business, which makes a missing record visible before a campaign runs.
Keep the deliverability checklist nearby and re-run authentication checks whenever you add a sending account. If you are deciding between mailbox types, dedicated sending domain explains where each one signs and who controls the records.
A clean setup in one page
The domain has one SPF record listing the servers that send. Each sending path has a DKIM key whose domain aligns with the From address. DMARC exists, first in monitoring mode and later in enforcement, with a reporting address someone reads. The tracking subdomain is authenticated too. Nothing else is needed for authentication, and once it is in place you can stop thinking about it until a provider changes.
| Plan | Price | What you get |
|---|---|---|
| Starter | $29/month | Up to 10,000 emails a month, 1 team member |
| Growth | $99/month | Unlimited emails, up to 3 team members, meeting scheduler and AI auto-reply |
| Business | $199/month | Unlimited emails and team members, outreach tasks, team reports and a custom tracking domain |
| Lifetime | $100 one-time | Unlimited emails, contacts, sending accounts, warm-up, inbox and follow-ups |
Prices published on www.mailspro.uk. SPF, DKIM and DMARC checks are part of Growth and Business; Starter includes warm-up and verification.
What this will not do
- Authentication proves the domain sent the message; it does not prove the recipient wants it.
- A DMARC reject policy on a domain with unknown senders can block legitimate invoices and password resets.
- DNS changes propagate at different speeds, so a record can look correct on one resolver and missing on another.
Questions people ask
- Can I use one DKIM key for several domains?
- Each sending domain should have its own key and selector. Sharing keys across domains makes rotation harder and can break alignment when one domain is reconfigured.
- Do I need DMARC to send cold email?
- You do not need it to send, but major providers increasingly expect it, and its absence weakens trust. A monitoring record is quick to add and gives you visibility into failures.
- Why does SPF fail when my provider is listed?
- Common causes are a second SPF record, an include that exceeds the lookup limit, or a sending server that is not covered by the include. Check the raw headers of a test message to see the evaluated result.
- Does Mail Pro set up DNS records for me?
- It reports whether SPF, DKIM and DMARC pass for connected senders, but DNS is controlled where the domain is hosted. You or your DNS provider must publish the records the sending service gives you.
Related reading
Put this into practice today
Mail Pro gives you unlimited sending accounts, warm-up, multi-step sequences and one inbox for every reply. Start with the 30-minute free trial, no card required.
Published price: $29, $99 or $199 a month, or $100 once for lifetime.