To set up SPF, DKIM, and DMARC for cold email, first identify every service that sends mail from your domain, then publish the records your provider gives you and confirm that messages pass authentication. These records do not make cold email welcome by themselves, but they are essential technical proof that legitimate mail is actually coming from your domain.
THE AUTHENTICATION ORDER
Build identity before campaign volume
List every platform that sends from your domain
Before changing DNS, make an inventory of your inbox provider, cold-email platform, CRM, newsletter service, help desk, billing tool, and any other system that uses your From domain. Each legitimate sender may need its own authentication setup.
This inventory prevents a common problem: publishing a correct record for one tool while unintentionally breaking mail from another tool. Keep it as a simple internal document for future changes.
Publish one correct SPF record
SPF is a DNS TXT record that tells receiving servers which services are allowed to send mail for your domain. Your provider will usually give you the exact include value or record to use.
A domain must have one SPF record, not several competing ones. Combine authorized services into the existing record carefully, keep it within the provider’s guidance, and remove services you no longer use.
Enable DKIM in each sending platform
DKIM adds a cryptographic signature to outgoing messages. Most email platforms provide a selector and one or more DNS records; after publishing them, return to the platform and complete its verification step.
Send a real test message after activation. The important check is not simply that a record exists, but that the message reports a passing DKIM result for the domain you are using in the From address.
Add DMARC in monitoring mode first
DMARC uses SPF and DKIM results plus alignment with the visible From domain. Start with a monitoring policy so you can receive reports and identify legitimate senders you may have missed.
Once the reports are understood and all legitimate mail is aligned, move gradually toward a stronger policy. Do not jump to a strict enforcement policy until you know it will not block important business mail.
Treat authentication as the starting line
Authentication establishes identity; it does not fix poor targeting, bounces, complaints, or a misleading message. Send only to relevant segments, use a clear sender identity, and increase volume slowly.
Recheck these records when you change providers, add a new sending domain, or see an unexpected delivery issue. The goal is a stable system, not a one-time technical task.
THE TAKEAWAY
Set up SPF and DKIM for every legitimate sender, begin DMARC in monitoring mode, then tighten the policy only after you understand your reports and sending sources.