SPF, DKIM and DMARC: The 15-Minute Setup I Use for Every New Sending Domain

Every cold email campaign I run starts the same way: before a single email goes out, the sending domain gets three DNS records. SPF, DKIM and DMARC. Skip them and your emails land in spam no matter how good the copy is. Get them right and you’ve removed the most common reason outbound fails.

This is the exact checklist I use for every new sending domain. It takes about 15 minutes per domain once you’ve done it twice, and it works the same whether your DNS is at Cloudflare, Spaceship, Namecheap or Hostinger.

Why these three records matter now

Since February 2024, Google and Yahoo require bulk senders to authenticate their mail. In practice, inbox providers now treat unauthenticated email from a new domain as suspicious by default. The three records answer three different questions a receiving server asks:

Record	The question it answers	Where it lives
SPF	Is this server allowed to send for this domain?	TXT on the root (@)
DKIM	Was this email signed by the domain and left unchanged?	TXT or CNAME on selector._domainkey
DMARC	What should happen if SPF or DKIM fails, and who gets the reports?	TXT on _dmarc

Before you start, one rule: never run cold email from your main company domain. Buy one or two similar domains (for example getyourcompany.com), point them to your main website, and send from those. If something goes wrong, your main domain’s reputation stays safe.

Step 1: SPF (3 minutes)

SPF is a single TXT record that lists who is allowed to send email for your domain. Add it at the root of the domain, usually shown as @ in your DNS panel.

For Google Workspace:

Type:  TXT
Host:  @
Value: v=spf1 include:_spf.google.com ~all

For Microsoft 365:

Type:  TXT
Host:  @
Value: v=spf1 include:spf.protection.outlook.com ~all

Two things to know:

• One SPF record per domain. If you use more than one service, combine them into one line, for example v=spf1 include:_spf.google.com include:sendgrid.net ~all.
• ~all versus -all. ~all (soft fail) is the safer default while you set things up. Move to -all later if you’re sure the record lists every service that sends for you.

Step 2: DKIM (5 minutes, plus waiting)

DKIM adds a digital signature to every email. The receiving server checks the signature against a public key you publish in DNS. Unlike SPF, the key is generated inside your email provider, so you copy it from there.

Google Workspace:

1. Open the Google Admin console and go to Apps → Google Workspace → Gmail → Authenticate email.
2. Select the domain and click Generate new record. Choose a 2048-bit key and keep the default selector, google.
3. Add the record to DNS as a TXT record with the host google._domainkey and the long value Google gives you.
4. Go back to the Admin console and click Start authentication.

If the Generate button doesn’t appear yet, the mailbox is too new. Google can take a day or two after you create the account before DKIM is available. Set up SPF and DMARC now and come back for this step.

Microsoft 365: Microsoft uses two CNAME records instead of a TXT record, with the hosts selector1._domainkey and selector2._domainkey. The exact values are shown in the Microsoft Defender portal under Email authentication settings → DKIM. Add both, then switch DKIM signing on for the domain.

If you use a mailbox provider like Zapmail, these records are usually created for you. Check them anyway with the tests in Step 4. “Set up automatically” doesn’t always mean “set up correctly”.

Step 3: DMARC (2 minutes)

DMARC tells receiving servers what to do when an email fails SPF or DKIM, and where to send reports. Add it as a TXT record on _dmarc:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Start with p=none. It changes nothing about delivery, but it starts the reports flowing, so you can see who is sending as your domain. Once a few weeks of reports look clean, move to p=quarantine.

The rua address receives daily XML reports. They’re hard to read raw, so point them to a free DMARC report tool, or to a separate inbox you check once a week.

Step 4: Test before you send anything

DNS changes can take from a few minutes to a few hours to spread. Once they have, run three checks:

1. Look up the records. MXToolbox has free SPF, DKIM and DMARC lookups. Each one should return your record with no errors.
2. Read the headers of a real email. Send an email from the new domain to a Gmail address, open it, then click ⋮ → Show original. You want to see SPF: PASS, DKIM: PASS and DMARC: PASS.
3. Score the whole setup. Send one email to the address that mail-tester.com gives you. It checks authentication, blacklists and content in one go.

Only when all three pass does the domain go into warmup.

The two mistakes I see most often

1. Two SPF records on the same domain

This happens when you add a new tool and paste its SPF record next to the existing one. The domain then has two TXT records that start with v=spf1, and receiving servers treat SPF as broken. Nothing looks wrong in your DNS panel, but emails quietly start failing. The fix is to merge them into one record.

2. Starting DMARC at p=reject

It feels safer to start strict. On a fresh setup, though, one forgotten service (a CRM, a calendar tool, an invoicing app) fails authentication, and its emails get rejected without anyone noticing. Start at p=none, read the reports, then tighten.

My 15-minute checklist

• Sending domain is separate from the main domain and redirects to the main website
• One SPF record on @ that includes your email provider
• DKIM generated in the provider, published in DNS, and switched on
• DMARC on _dmarc starting at p=none with a report address
• MXToolbox lookups show no errors
• Gmail “Show original” shows SPF, DKIM and DMARC all PASS
• mail-tester.com score checked before warmup starts

Authentication won’t fix a weak list or a bad offer. It does make sure that when your email is good, it actually reaches the inbox. If you’d rather have this handled for you, from domains to booked meetings, that’s what my 30-day outbound pilot covers.