SPF, DKIM and DMARC for cold email: exact records and checks

Updated 17 October 2026 · 7 min read

Short answer

Every cold email domain needs three DNS TXT records: one SPF record that authorises your mail provider (for Google Workspace v=spf1 include:_spf.google.com ~all), a DKIM public key generated in your provider's admin console, and a DMARC record at _dmarc.yourdomain.com such as v=DMARC1; p=none; rua=mailto:reports@yourdomain.com. Gmail, Yahoo and Outlook.com require all three for high-volume senders, and DMARC only passes when the From domain aligns with the SPF or DKIM domain. Check them by sending a test email and reading the Authentication-Results header.

What each record does

Record	Where it lives	What it proves
SPF	TXT on the domain itself (@)	Which servers are allowed to send mail for the domain
DKIM	TXT (Google) or CNAME (Microsoft) at <selector>._domainkey	The message was signed by the domain and not changed in transit
DMARC	TXT at _dmarc	What receivers should do when SPF/DKIM fail, and where to send reports; requires alignment with the From domain

You also need MX records so the domain can receive replies, and usually a provider verification TXT record. Without MX, replies bounce and the domain looks less like a real business.

Exact records for Google Workspace

SPF

Type: TXT
Host: @
Value: v=spf1 include:_spf.google.com ~all

If you also send from another service on the same domain, add its include to the same record, for example v=spf1 include:_spf.google.com include:servers.example.net ~all. For dedicated cold email domains, keep it to the mail provider only.

DKIM

In the Google Admin console go to Apps → Google Workspace → Gmail → Authenticate email, choose the domain, generate a 2048-bit key with the default selector google, publish it, then click Start authentication. The record looks like this (the key is shortened here):

Type: TXT
Host: google._domainkey
Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...

DMARC

Type: TXT
Host: _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

MX (to receive replies)

Type: MX
Host: @
Priority: 1
Value: smtp.google.com

Exact records for Microsoft 365

SPF
Type: TXT
Host: @
Value: v=spf1 include:spf.protection.outlook.com -all

DKIM
Type: CNAME  Host: selector1._domainkey  Value: (shown in the Microsoft Defender portal)
Type: CNAME  Host: selector2._domainkey  Value: (shown in the Microsoft Defender portal)

DMARC
Type: TXT
Host: _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

Microsoft publishes DKIM as two CNAME records that point to keys Microsoft hosts and rotates. Copy the exact values from the DKIM page in the Microsoft Defender portal, then turn signing on for the domain.

Which DMARC policy to use for cold email

Policy	Meaning	When to use
p=none	Monitor only; receivers deliver as normal	New cold email domains; this meets Google, Yahoo and Microsoft minimums
p=quarantine	Failing mail goes to spam	After reports show all your legitimate mail passes
p=reject	Failing mail is refused	Strongest protection against spoofing; use once you are confident

A stricter policy does not make your own mail land in the inbox more often; it stops other people spoofing your domain. On a secondary sending domain, p=none with reports is a reasonable start, and moving to quarantine once everything passes adds protection.

Set them up step by step

1
Add MX and verification records
Add the provider's MX record(s) and domain verification TXT record, and verify the domain in the admin console.
2
Publish one SPF record
Add a single TXT record at @ starting with v=spf1 that includes your mail provider. Delete any older SPF record instead of adding a second one.
3
Generate and publish DKIM
Generate a 2048-bit key (Google) or the selector CNAMEs (Microsoft), publish them, wait for DNS to update, then turn on signing in the console.
4
Publish DMARC
Add a TXT record at _dmarc with v=DMARC1; p=none; and a rua address that can receive aggregate reports.
5
Test with a real message
Send an email to a Gmail address, open it, choose Show original, and confirm SPF, DKIM and DMARC all say PASS.

Common mistakes

Two SPF records. SPF allows one record per domain; two records cause a permanent error and SPF fails. Merge them.
More than 10 DNS lookups in SPF. Each include, a, mx and redirect counts toward a limit of 10; beyond it SPF fails. Keep sending domains simple.
DKIM published but not switched on. In Google Workspace you must click Start authentication after the record is live.
DMARC at the wrong host. It must be at _dmarc.yourdomain.com, not the root.
No alignment. DMARC passes only if the domain in the From address matches the SPF (Return-Path) domain or the DKIM signing domain. Sending through a tool that signs with its own domain can break this.
Line breaks or quotes copied into the value, or the domain name added twice by the DNS host (e.g. _dmarc.yourdomain.com.yourdomain.com).
Missing MX, so replies to your cold emails bounce.

How to check your records

Message headers: in Gmail open a received test message, choose Show original, and read the SPF, DKIM and DMARC lines.
DNS lookup: run nslookup -type=txt yourdomain.com and nslookup -type=txt _dmarc.yourdomain.com (or dig TXT) to see exactly what is published.
Google Admin Toolbox Check MX shows missing or broken records for a domain.
DMARC aggregate reports sent to your rua address show which sources pass and fail over time.

Authentication is a requirement, not a guarantee. Passing SPF, DKIM and DMARC removes a reason to filter your email; list quality, volume and complaint rates still decide inbox placement.

ReplyDak publishes MX, SPF, DKIM, DMARC and verification records on Cloudflare automatically for every domain it sets up.

Domains, DNS, Google Workspace mailboxes and warmup. From $2.69 per mailbox ($35 for 10).

Get started Check domain availability

FAQ

Do I need DMARC for cold email?

Yes. Google and Yahoo require DMARC for senders of 5,000+ messages a day, Microsoft requires it for high-volume senders to Outlook.com, and it is cheap to add. A record with p=none meets the minimum.

Should I use ~all or -all in SPF?

Both are valid. Google's documented Workspace record uses ~all (soft fail). With DMARC in place, receivers rely on DMARC for the final decision, so the difference is small for most senders.

Can I have two SPF records?

No. A domain must have only one SPF record. If you need to authorise several services, put all their include: mechanisms in the same record.

Does p=reject improve deliverability?

Not directly. DMARC policy tells receivers what to do with mail that fails authentication, which protects your domain from spoofing. Your own authenticated mail is judged on reputation and engagement either way.

How long do DNS changes take?

Usually minutes on hosts like Cloudflare, but changes can take up to the record's TTL (and occasionally up to 48 hours) to be seen everywhere.