EmailKingSPF, DKIM & DMARC Setup Guide — The 3 Records Cold Email Lives On
The best copywriting in the world cannot beat a spam filter. Since Gmail and Yahoo began requiring authentication for bulk senders, SPF, DKIM and DMARC stopped being optional — they are the entry ticket. The good news: it comes down to adding three DNS records, once.
SPF — the name tag for your sending servers
SPF (Sender Policy Framework) is a DNS TXT record that declares which servers are allowed to send mail on behalf of your domain. Collect the include values of every service you send from (Google Workspace, your sending tool) into a single record. One SPF record per domain — and stay under the 10 DNS lookup limit, or checks start failing.
DKIM — the digital signature against tampering
DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to each message header, proving it was not altered in transit. Generate the key in your sending service's admin console and add it to DNS as a CNAME/TXT record. Use a 2048-bit key where offered.
DMARC — the policy for mail that fails
DMARC tells receiving servers what to do with mail that fails SPF/DKIM checks: none, quarantine, or reject. Start at p=none, watch the aggregate reports, and only tighten to quarantine and then reject once all legitimate mail passes. If you're a bulk sender (Google's line is roughly 5,000+ messages a day to Gmail addresses), Gmail requires a DMARC record — mail that doesn't meet the requirements can be rejected or sent to spam.
After setup: verify first, send second
Even with perfect authentication, sending to dead addresses raises your bounce rate and burns domain reputation. The widely used safety line is a bounce rate under 2% — verifying your list before sending matters as much as authentication. EmailKing checks syntax and DNS MX records at extraction time and flags placeholder addresses, which weeds out domains that can't receive mail before you send. It doesn't test whether each individual mailbox exists, so keep suppressing any address that bounces.
Frequently Asked Questions
Can I set up just one of SPF, DKIM and DMARC?
Not if you send in volume. Gmail and Yahoo require all three from bulk senders (smaller senders still need at least SPF or DKIM). DMARC in particular only passes when SPF or DKIM aligns with your From domain.
How do I check my setup is correct?
Send yourself a test email and open Gmail's 'Show original' — SPF, DKIM and DMARC should all read PASS. EmailKing's free Domain Health Checker also shows whether your SPF and DMARC records are published (check DKIM with the test email, since its selector varies by provider). Also set a DMARC report address (rua) and watch the aggregate reports, which usually arrive daily.
I have a fresh domain — can I start sending at volume right away?
Not recommended. Warm a fresh domain up for 2–4 weeks, ramping volume gradually. Use that time to verify your list and sharpen targeting.
For a deeper dive, see the Complete Cold Email Guide, Part 3.
Next Steps
Every outreach motion starts with a clean lead list. EmailKing pulls the emails a website publishes and checks each one's syntax and mail server (MX) on the spot — the free plan (25 URLs/mo) is enough to start today.