SPF, DKIM, and DMARC explained simply

SPF, DKIM, and DMARC sound like three technical acronyms that don't concern you. In reality, they determine whether your message reaches the mailbox or ends up in spam. Without them, Gmail and Outlook treat you as an unknown sender who might be impersonating someone else's domain. Let's break them down simply and show you how to set them up.

Three records, three tasks

SPF (Sender Policy Framework) is a list of servers allowed to send mail for your domain. When a message arrives, the receiving server checks your SPF record and verifies whether it was sent by a server on the list. If not, the message looks suspicious.

yourdomain.sk   TXT   v=spf1 include:_spf.yourserver.sk -all

The trailing -all means that anything outside the list should be rejected. That's strict, and it's the right setup for cold email.

DKIM (DomainKeys Identified Mail) adds a digital signature to each message. Your server signs it with a private key, the recipient retrieves the public key from your DNS, and verifies that nobody altered the message in transit and that it really came from you.

selector._domainkey.yourdomain.sk   TXT   v=DKIM1; k=rsa; p=MIGfMA0GCSq...

DMARC (Domain-based Message Authentication) ties SPF and DKIM together and tells the recipient what to do if either one fails. At the same time, it sends you reports on who is actually sending mail for your domain.

_dmarc.yourdomain.sk   TXT   v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.sk

Why you end up in spam without them

Gmail and Yahoo have required valid SPF and DKIM from anyone sending large volumes since 2024, and without a working DMARC, many recipients simply reject you outright. With cold email, it's even more sensitive because you're writing to people who don't know you and don't have you in their contacts. The filter has no reason to give you credit upfront.

• Messages fall into spam or never deliver at all.
• Anyone can misuse your domain and send fraudulent emails in its name.
• You have no visibility into who is actually sending mail for your domain.
• Domain reputation drops and drags down your legitimate campaigns too.

How to set them up step by step

1. Add one SPF TXT record to your domain's DNS with the server you send from. You can't have more than one SPF record at a time.
2. Generate a DKIM key pair on your server and write the public key as a TXT record on selector._domainkey.
3. Add a DMARC record on _dmarc. Start with p=none, watch the reports, and when everything looks good, tighten it to p=quarantine or p=reject.
4. Wait for DNS to propagate and verify the records directly on your domain's authoritative server, not through a cached public tool.

Common mistakes

• Two SPF records at once. Only one applies, and the second breaks authentication entirely.
• SPF ends with ~all or ?all instead of -all, so the filter gets no clear instruction.
• DKIM key too short. Use at least 1024 bits, preferably 2048.
• DMARC stuck in p=none mode forever. That only measures, it doesn't protect.
• Verifying through a tool that reads stale cache. The authoritative server tells the truth.

How we do it

In ColdEmailServer you don't generate these three records by hand. For each domain we create SPF, DKIM, and DMARC, write them, and verify directly on your domain's authoritative server, not by guessing from cache. If something doesn't line up, you see it right away, not when your campaign lands in spam. Setting up domain identity isn't a whole-afternoon project, it's part of adding a domain.