Why SPF, DKIM, and DMARC are Important For Cold Outreach

If you’re sending cold email in 2026, there’s a ~30% chance your email will land in spam. According to a recent study conducted by GlockApps, Gmail spam placement is estimated at ~31% in 2026. That is 30 cold emails per 100 sends.

But here’s one simple authentication that can significantly reduce that number, by setting up SPF, DKIM, and DMARC, three DNS records.

Without SPF, DKIM, and DMARC, your cold emails not only “land in spam” but also many of them will never get delivered. Your emails will often be rejected or bounced, which will impact your cold outreach campaign.

But what exactly are these authentication methods, and how do you set them up? In this article, I’ll explain each authentication in detail plus an actionable 5-min setup to improve your inbox deliverability.

What is SPF?

SPF (Sender Policy Framework) tells the receiving server whether you are sending from an allowed list of softwares, such as Google, Microsoft, Hubspot, Aerosend, etc.

For example, if the email is from Google, the server checks the SPF record to verify whether Google (Gmail) is allowed.

Now there are two things that can happen when a Gmail recipient checks SPF, Pass/Fail:

• When SPF is passed, your email sending provider is authenticated
• When SPF fails, the recipient’s SPF record doesn’t match.

Benefits of Setting up SPF

First Verification Gate
SPF is the first layer of checks that email service providers like Gmail and Outlook use to verify that the sender is sending from an allowed list of softwares.

Mandated by Google and Yahoo
For cold emailers, Gmail and Yahoo have made it mandatory to set up SPF. If SPF fails or is not set up, your cold mail gets rejected or dropped in spam by default.

Protection Against Impersonators
If a spammer forges your domain and blasts junk email, Gmail and Outlook will see that a cold email from “YOU” is behaving badly. As a result, your sender reputation declines and any cold email sent from the domain will land in spam.

SPF lets recipients reject forged mail.

When your entire campaign depends on a handful of domains, this protection is very, very important.

How to set up SPF in 5-minutes?

You don’t need technical understanding to set up SPF. Setting up SPF for Gmail, Outlook, Aerosend, Hubspot is the same. Here’s how you can do it in under 5-minutes:

1. Log into wherever you manage that domain (GoDaddy / Namecheap / Cloudflare, whoever you bought it from).
2. Find DNS settings / DNS records.
3. Look for an existing TXT record whose value starts with v=spf1.

Example, for Google inboxes only, on a fresh domain, the complete record is:

Where,

• v=spf1 > “this is an SPF record”
• include:_spf.google.com > “Google is allowed to send for me”
• ~all > “anything else, treat as suspicious”

1. Save. It can take a few minutes to a few hours to take effect.

How to verify if SPF is successful?

Here are a few 30-second tests to verify whether SPF passes or fails:

Method 1 – Send email to self

1. From the email account, send a normal email to any Gmail address you own.
2. Open that email and click on the three dots (⋮) at the top-right of the email.
3. Click “Show original.”

A page opens with some details. Search for “SPF”.

If it says SPF: PASS, you did it right. Everything’s working.

If it says fail, softfail, or none, it means something’s off. Usually, it means you need to wait a bit longer, or that the TXT record was submitted with the wrong value.

Method 2 – Check it on SPF tester

Go to mail-tester.com. It gives you an email address. Send an email to the address. Click on “check your test score” to see your SPF status.

What is DKIM?

DKIM (DomainKeys Identified Mail) is a secret key assigned to each domain. When you send a cold email, the recipient verifies the secret key from the server; if it matches, the domain and sender are both considered legitimate.

A valid DKIM key tells you two things:

• The email genuinely came from your domain,
• Nobody altered it in transit.

Benefits of Setting up DKIM

Second Verification Check

SPF only checks the sending server. DKIM is the additional security layer that checks the secret key for authentication.

DKIM Stays Intact While Forwarding the Email, SPF Doesn’t

When you forward the email, the sending server changes. It breaks SPF. But DKIM secret key travels with the email and ensures it remains valid and legitimate. During cold outreach, your emails are often forwarded to a colleague who can benefit from the services. DKIM keeps those forwarded emails authenticated instead of silently failing.

Mandated by Google and Yahoo

For cold emailers, like SPF, Gmail and Yahoo have made it mandatory to set up DKIM as well. If DKIM is not set up or fails, your cold mail is rejected or dropped into spam by default.

How to set up DKIM

To set up DKIM, you need to generate DKIM first. The whole process will take 5 minutes.

Generating DKIM for Google

1. Go to admin.google.com and sign in with your admin account (the main one that controls the whole thing).
2. On the left menu, click Apps.
3. Click Google Workspace. Click Gmail.
4. Scroll down and click Authenticate email. Pick your domain (aerosend.io) from the dropdown.
5. Click Generate new record.
6. Google now shows you two things on screen:

• a name = google._domainkey (something similar)
• a value = v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1x2v... (a long jumble of letters and numbers)

That’s your DKIM, which Google just generated for you. Copy both.

Now, set up DKIM in 2 minutes:

1. Log into wherever you manage that domain (GoDaddy / Namecheap / Cloudflare, whoever you bought it from).
2. Open DNS record (or DNS, Manage DNS, or DNS Settings).
3. Click Add record.
4. Fill in the boxes like this:

1. Click Save (or “Add record”).
2. Go back to the Google screen where you generated it and click Start authentication.

Major Fails While Setting up DKIM

There are three things that often go wrong while setting up DKIM:

1. Value cut short – Paste the entire long value to the last character. If you miss it, DKIM authentication will fail.
2. Extra spaces – Don’t add spaces before or after the value.
3. Name doubling up – If you type google._domainkey and the box shows google._domainkey.aerosend.io after saving, that’s correct; leave it.

How to verify if DKIM is successful?

The process for verifying whether DKIM records are successfully authenticated is similar to SPF. Here’s how you can do it in 30 seconds:

Method 1 – Send email to self

1. From the email account, send a normal email to any Gmail address you own.
2. Open that email and click on the three dots (⋮) at the top-right of the email.
3. Click “Show original.”

A page opens with some details. Search for “DKIM”.

If it says DKIM: PASS, you did it right. Everything’s working.

Method 2 – Check it on DKIM tester

• Go to mail-tester.com.
• It gives you an email address. Send an email to the address.
• Click on “check your test score” to see your DKIM status.

Here are the three results you’ll see:

What is DMARC?

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is a decision framework that specifies what the recipient should do when both SPF and DKIM fail.

There are three things you can do:

• You can do nothing, and allow the email to pass
• You can send the email directly to spam
• You can block the email entirely

These are the three settings that you can set for your domain.

1. p=none says “do nothing”
2. p=quarantine says “send it to spam”
3. p=reject says “block them entirely”

Benefits of setting up DMARC

1. It is important as a decision maker! SPF and DKIM only check a single piece, but neither of them enforces the rule; what should you do if SPF and DKIM fail?
2. Without DMARC, anyone can impersonate your domain. Therefore, it is necessary to add a decision (quarantine or reject) to prevent scammers’ emails from reaching the inbox.

How to set up DMARC

1. Go to your domain’s DNS settings, just like you did for SPF and DKIM.
2. Add a new record.
3. Fill in the boxes:

1. Save.

Note:

• v=DMARC1 > “this is a DMARC rule”
• p=none > “for now, don’t block anything.”
• rua=mailto:… > “email me reports so I can see who’s sending mail as me.”

Compare your final SPF, DKIM, and DMARC with this:

How to Set up SPF, DKIM and DMARC for Google vs Microsoft Outlook

Cold Emails Still Going to Spam? Here’s Why

Even after setting up SPF, DKIM, and DMARC, the cold emails are still going to spam? SPF, DKIM, and DMARC are validation checks, which are important for authentication. Without them, the server can’t really tell who you are or which software you’re sending from.

But if your cold emails are still landing in spam, here are the probable reasons:

1. Burnt Domains

It is a common cause of cold emails landing in spam. Over time, your sending reputation takes a hit due to people marking you as spam, low reply rates, emails bouncing, etc. Google picks up these signals and starts sending your emails directly into spam.

You can easily diagnose this if your cold email service provider offers domain monitoring. You can pause the campaign, run warmup, validate the lead list again, and start sending again. But if you are not monitoring and your domains are burnt, your next cold email will definitely land in spam, with or without SPF, DKIM, and DMARC set up.

2. No Warmup, or Not Enough

Sending 50+ cold emails/day from a fresh domain looks suspicious. Therefore, many cold email service providers suggest running a warmup. Through warmup you can mimic real person behavior, engaging in back-and-forth email exchange. It is important for inbox placement.

But if you don’t or warm up too little and start sending in volume, Google will penalize your domains. Even with flawless DNS configuration, your emails will land in spam.

3. Low Engagement Signals

Cold email is engagement-poor by nature! Gmail watches what recipients do. If nobody is opening or replying, or people are deleting without reading, hitting spam, Gmail evaluates everything. Low open and reply rates, or frequent spam marks, affect a domain’s placement, and your cold emails will land in spam.

4. Spammy Content

Apart from weak warmup or engagement signals, Gmail also penalizes spammy content. It could be words, links, image-heavy texts, HTML, attachments, etc. Here are a few examples of spam triggers in cold email:

1. Words such as free, guarantee, act now, $$$, etc.
2. Too many or shortened URLs (bit.ly) links
3. Image-heavy emails, such as a single big image or HTML that consists of a few images
4. Attachments in a cold email, such as PDFs, images, .wav, etc.
5. Misleading subject lines such as “Save $500 on Your Credit Card Bill” and then the email talks about plumbing services

5. Automate Sending Patterns

Sending at volume too fast from one inbox is not human behavior. Gmail flags these sending patterns, such as identical messages, the same timing, etc., as spam.

6. Poor Lead List

It is important to verify your lead list before sending cold email. Because invalid addresses cause bounces, which quickly affect your domain reputation. If that happens often, your domain will get blacklisted, and all your cold emails will end up in spam.

7. Blacklisted Domains

Spamming activities, such as sending in volume from a fresh account by attaching PDFs or adding links, can get your domain blacklisted. If that happens, your cold outreach campaign will suffer as all your emails will land in spam.

Here’s how to check if your domain is blacklisted or not:

1. Go to mxtoolbox.com/blacklists.aspx (or just go to mxtoolbox.com and click Blacklists)
2. Type in your domain (aerosend.io)
3. Hit Check

It scans your domain against numerous blacklists.

If it shows “green”, it means your domain is safe. If it shows “red”, your domain is blacklisted.

How to improve inbox placement beyond SPF, DKIM and DMARC

Here’s how you can make sure that your cold emails land only in the inbox:

1. Warmup with Premium Pools

Warmup isn’t a two/three-week one-time job. During cold outreach, there are multiple spam marks, no opens, and hardly 1% replies! Therefore, ongoing warmup is important.

And warming up your inboxes with a pool that is not full of cold emailers is equally important. Here’s the warmup strategy you can follow to fully warmup your inboxes:

• 2-3 weeks
• Slowly ramp up
• 50-75 warmup emails/day
• 40% reply rate

2. High-Quality Infrastructure

You need infrastructure that is reliable and ensures your emails land in the inbox.

It should include Google inboxes or a dedicated IP provider, such as Aerosend. In 2026, these two consistently offer high inbox placement.

But Google’s inbox performance largely depends on the inbox providers.

Aerosend offers dedicated IPs, a published inbox/domain ratio, a 2/3-week warmup, domain monitoring, etc.

3. Segmented Lead List

You need to segment your lead list by your offer. For Example: if you sell SEO services, you cannot just email all Series A founders.

You need to divide your list based on:

1. Size of the company
2. Whether they are doing SEO or not (Current blogs)

So, someone already writing 10 blogs a day vs someone who has never done SEO falls under the same segment and will receive the same communication.

Therefore, make sure 95% of your lead list are people you can actually sell to. It is something most cold emailers fail to do, as they have their lead list at 50% (based on 300M emails).

4. Verified Lead List

Sending cold email to an unverified list is very risky. You don’t know whether the email ID exists. If it doesn’t, the email will bounce, and if that happens often, your overall cold email campaign is a disaster.

It is important to verify your lead list before sending cold email. Here’s how you can do that:

1. Regular Verification – Add your CSV to MillionVerifier, and it will show you the number of valid emails (Good), risky (Catch-all), and non-existent (Bad).

2. Catch-all Verification – Sometimes, when you send a cold email, the email is delivered, but the email ID doesn’t exist. Companies create catch-all email addresses that collect all messages sent to invalid addresses. But after 15-20 days, it marks the cold emails as spam. With Catchallverifier, you can identify these invalid email addresses and create a healthy lead list.

5. Short + Valuable Copy

Your cold copy doesn’t need to sound like a 5-min monologue. Even if you write, “I can help you improve your inbox placement by building fully customizable cold email infra”, that will suffice.

Write the copy that people actually want to read and act. No one cares if you were given an award or are the best cold email outreach company with 95% inbox placement.

General Rule of Thumb: write less than 100 words and clearly state an offer. No buzzwords, “BUY NOW”, links, attachments, nothing!

6. Domain Burn Alerts

You need to constantly monitor your domains. Check their performance proactively; don’t wait for the reply rate to dry up! With domain burn alerts, you can check which domains are experiencing low inbox placement, pause the campaign, diagnose the issue, and replace those domains on the spot.

Trust Aerosend For Cold Outreach Is a GOOD Idea, Why?

Setting up SPF, DKIM, and DMARC is a hassle! One mistake, and your SPF/DKIM fails. Imagine doing it for 100+ domains; it takes too much time, energy, and mental space.

Therefore, many cold email outreach infrastructure providers offer ‘Done-For-You’ setup. They set up your SPF, DKIM, and DMARC within 24 hours, then leave you to run a warmup through your sequencer.

But Aerosend not only sets up your SPF, DKIM, and DMARC, but also runs the warmup through WarmupInbox and helps with lead lists, copy, etc. Basically helping you set up your cold outreach campaign and then managing the deliverability.

Frequently Asked Questions on SPF, DKIM, and DMARC

How to generate DKIM for a Microsoft account?

Here’s how you can generate DKIM for a Microsoft account:

• Sign in to the Microsoft 365 admin/security center
• Search the top search bar for “DKIM”
• Open the DKIM settings and pick your domain
• It shows you the two records to copy.
• Paste both into your domain’s DNS.
• Come back and flip the domain to “Enable” / “On.”

Does DMARC require SPF and DKIM?

Yes! DMARC has no checks of its own. Without SPF and DKIM results, DMARC has nothing to judge.

How to verify that SPF, DKIM, and DMARC are properly set up and enabled?

The fastest way to know if SPF, DKIM, and DMARC are properly set up and enabled is:

1. Send a test email from your sending domain to your personal Gmail account.
2. Open it, click ⋮ (three dots), “Show original”.
3. Read the summary box at the top:

If, SPF: PASS, DKIM: PASS, DMARC: PASS, all three PASS = properly set up and enabled.

If any of them fail, you’ve to set it up properly again.

How do I turn on DMARC?

Before turning on DMARC, make sure SPF and DKIM are already set up and passing. After that, you can:

1. Go to your DNS host.
2. Create a new TXT record:

• Type: TXT
• Host/Name: _dmarc (this creates _dmarc.yourdomain.com)
• Value: start safe, v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

What that says:

• v=DMARC1 > this is a DMARC record
• p=none > monitor only, block nothing (this is the safe “on” position)
• rua=mailto:… > send reports here (use an inbox you actually check)

1. Save. DMARC is now on. Usually takes minutes to ~48h to reflect.
2. Verify with a DMARC checker like MXToolbox.