SPF, DKIM, and DMARC

SPF, DKIM, and DMARC are three DNS records that let a receiving mail server confirm an email really came from the domain it claims to. Google, Yahoo, and Microsoft require all three from anyone sending email at volume.

SPF

Sender Policy Framework is a DNS record that lists which servers are allowed to send email for your domain. If an email arrives from a server that isn't on the list, the receiver knows something's off. It's the oldest of the three and the easiest to set up.

DKIM

DomainKeys Identified Mail adds a cryptographic signature to each email, generated with a private key on your sending server and checked against a public key in your DNS. It proves the message wasn't altered in transit and that it came from a server holding your key.

DMARC

Domain-based Message Authentication, Reporting, and Conformance is a policy record that tells receivers what to do when SPF or DKIM fails: nothing, quarantine, or reject. It also asks receivers to send you reports on who's sending as your domain. A DMARC record set to reject is what stops someone else from spoofing you.

Why it matters for cold email

Since early 2024, Google and Yahoo have required SPF, DKIM, and DMARC from bulk senders, and Microsoft followed in 2025. A domain missing any of them starts in the spam folder, no matter how good the email is. Every outreach domain we set up has all three from day one, and we'll show you the records.

An example

A staffing firm's business development emails land in junk at every hiring manager on Outlook. The copy is fine and the list is good. The outreach domain has SPF but no DKIM and no DMARC, because whoever registered it stopped after the first record. Adding the other two and waiting a week fixes it.

Related terms

Email deliverability · Sending domain · Email warmup · Domain reputation

If you want this run for you, see our cold email agency.