SPF, DKIM and DMARC Setup for Cold Email Deliverability

SPF, DKIM and DMARC are three DNS records that prove your sending domain is allowed to send the mail that carries its name, and they strongly influence whether cold email reaches the inbox. Since 2024, Gmail and Yahoo have required bulk senders to use all three. This guide shows the records to publish for a custom domain on Google Workspace, which is the setup you would use when Novpha sends outreach from your connected Gmail.

Key takeaways

• SPF lists who may send for your domain, DKIM signs each message, and DMARC tells receivers what to do when checks fail.
• Publish one SPF record per domain; for Google Workspace it is v=spf1 include:_spf.google.com ~all, plus any other services that send for you.
• Start DMARC at p=none to collect reports, then tighten to quarantine and reject once legitimate mail passes consistently.
• If you send from a personal @gmail.com address, Google authenticates gmail.com for you and there are no records for you to publish.

What do you need before setup?

All three records live as TXT records with your domain registrar or DNS host, not inside your email client. Novpha sends outreach from the Gmail inbox you connect, so the records need to authenticate the domain that inbox belongs to. Novpha does not publish these records for you; you or your domain administrator add them.

Gather these before touching any DNS settings:

• Login access to your domain registrar or DNS host.
• The exact sending domain, plus any subdomain you use for outreach.
• A list of every service that sends mail on the domain's behalf, such as Google Workspace, your newsletter tool or your help desk.
• Admin access to the Google Admin console, which you need for DKIM.

What happens if you skip this step?

Unauthenticated mail is far more likely to be filtered or rejected, especially from a newer domain. Bulk senders that skip authentication can see their mail rejected outright by Gmail and Yahoo, and even at lower volumes it puts every cold email at a disadvantage before anyone reads the subject line.

How do you set up SPF correctly?

SPF lists every service allowed to send mail for your domain, written as one TXT record on the root domain. For Google Workspace, the record is v=spf1 include:_spf.google.com ~all. If other services also send for your domain, add their include: entries to that same record instead of creating a second one.

1. Sign in to your DNS host and open the TXT records for your root sending domain.
2. Check whether an SPF record (one starting with v=spf1) already exists. If it does, edit it rather than adding another.
3. Include every service that sends for you. For Google Workspace, that is include:_spf.google.com.
4. End the record with ~all (soft fail) or -all (hard fail) so unlisted senders fail the check.
5. Save the record and allow time for DNS propagation before testing.

Why can there be only one SPF record?

Two separate SPF records on the same domain cause SPF to fail. Combine every sender into a single record, and keep it under the limit of 10 DNS lookups, which large include chains can exceed.

What happens if you leave a sender out?

Mail from any service missing from the record fails SPF on arrival. For a domain running active outreach, one forgotten sender can drag down deliverability for everything else on that domain.

How do you publish a DKIM key?

DKIM adds a cryptographic signature to each message, which lets receiving servers confirm the mail came from your domain and was not altered in transit. For Google Workspace:

1. In the Google Admin console, go to Apps, then Google Workspace, then Gmail, then Authenticate email.
2. Select your domain and generate a new 2048-bit DKIM key.
3. Copy the TXT record value Google provides. With the default selector, the record name is google._domainkey.
4. Create a TXT record at google._domainkey in your DNS zone and paste in the full value, which begins with v=DKIM1; k=rsa; p=.
5. Save the record and allow time for DNS propagation.
6. Return to the Admin console and click Start authentication so Google begins signing your mail.
7. Send a test message and check the headers to confirm DKIM passes.

Does DKIM alone fix deliverability?

No. DKIM works together with SPF and DMARC, and authentication is only the foundation. Sending volume, list quality and the content of your messages still decide whether mail is welcomed. If your domain is new, follow our email warm-up guide once the records are in place.

Which DMARC policy should you choose?

DMARC tells receiving servers what to do with mail that fails SPF and DKIM alignment, and sends you reports on what is passing and failing. Publish it as a TXT record at _dmarc.yourdomain.com. A safe starting record is v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com, which delivers mail normally while sending aggregate reports to the address you choose.

Should you start with none, quarantine or reject?

Start with none so you can read reports without risking lost mail. Move to quarantine once reports show every legitimate sender passing SPF and DKIM, and reserve reject for domains where you are confident nothing legitimate is failing.

What mistakes hurt deliverability after setup?

Correct records solve only part of the problem. These mistakes undo the benefit:

• Treating authentication as a one-time task. Add every new sending service to SPF and DKIM as you adopt it, and keep reading DMARC reports.
• Ramping volume too fast. A new, fully authenticated domain still needs to build reputation gradually. Use a daily cap to keep sending steady.
• Letting follow-ups run through a deliverability drop. If bounces or spam placement rise, pause and diagnose before more mail goes out.
• Confusing authentication with compliance. Passing SPF, DKIM and DMARC does not satisfy anti-spam law. The sender remains responsible for CAN-SPAM in the United States, including accurate sender details and a working opt-out, and for CASL in Canada, which is consent-based with a conspicuous publication exception for some published business addresses. This is general information, not legal advice.

FAQ