Deliverability
SPF, DKIM and DMARC for Cold Email
A practical explanation of the three core email authentication mechanisms and how they work together.
SPF authorizes sending infrastructure, DKIM signs messages so recipients can verify integrity, and DMARC tells receivers how to evaluate aligned SPF/DKIM results and where to send reports. Configure all three before scaling outreach.
What each record does
SPF is a DNS TXT record listing systems allowed to send for a domain. DKIM adds a cryptographic signature whose public key is published in DNS. DMARC checks whether the authenticated domain aligns with the visible From domain and publishes a policy.
Passing SPF alone is not the same as passing DMARC: alignment matters. Forwarding can also break SPF while an intact DKIM signature continues to authenticate the message.
Roll out carefully
Inventory every legitimate sender before tightening policy. Start DMARC reporting, inspect unknown sources and correct alignment; then move toward enforcement based on evidence.
- Keep one valid SPF record per domain.
- Rotate and protect DKIM keys.
- Send DMARC aggregate reports to a monitored address.
- Test each connected provider independently.
Authentication is necessary, not sufficient
Correct DNS does not make unwanted email wanted and cannot guarantee inbox placement. Targeting, complaints, bounce handling and volume patterns still matter.
Official sources
Provider limits and policies can change. These official pages were reviewed on 2026-09-14.
Put it into practice
Run measured outreach with mailbox-level control.
MailQV connects sender rotation, sequences, contacts and campaign signals without claiming guaranteed inbox placement.