Cold email deliverability problems almost always trace back to authentication records being missing, misconfigured, or set up correctly but never followed by proper domain warm-up. This is the technical companion to my email list cleaning guide — a perfectly authenticated domain sending to a dirty list still lands in spam.
What each record actually does
- SPF (Sender Policy Framework) — a DNS record listing which mail servers are authorized to send email on behalf of your domain, letting receiving servers reject mail claiming to be from you but sent from an unauthorized server.
- DKIM (DomainKeys Identified Mail) — attaches a cryptographic signature to outgoing mail that receiving servers verify against a public key in your DNS, confirming the message wasn't altered in transit and genuinely originated from an authorized sender.
- DMARC (Domain-based Message Authentication, Reporting and Conformance) — tells receiving servers what to do when a message fails SPF or DKIM (quarantine, reject, or do nothing), and provides reporting on authentication failures.
Setup sequence that avoids self-inflicted problems
- Set up SPF first, listing every legitimate sending source (email platform, CRM, transactional email service) — missing a source here causes that platform's mail to fail authentication.
- Set up DKIM through each sending platform's provided instructions; most tools generate the DNS record to add directly.
- Publish DMARC starting at
p=none— monitoring mode only, which reports failures without blocking any mail, so misconfigurations surface in reports rather than as silently dropped email. - Review DMARC reports for 2–4 weeks, fix any legitimate sending source that's failing, then progressively tighten the policy to
p=quarantineand eventuallyp=rejectonce confident every legitimate source passes.
| Record | Purpose | Common Mistake |
|---|---|---|
| SPF | Authorizes sending servers | Forgetting to include a third-party sending tool |
| DKIM | Cryptographically signs outgoing mail | Not rotating or properly publishing the public key |
| DMARC | Sets enforcement policy and reporting | Jumping straight to p=reject before confirming all sources pass |
Why perfect records still aren't enough
Authentication records prove a message is legitimately from your domain — they don't prove the domain has a good sending reputation yet. A new or recently reconfigured domain still needs a gradual warm-up: starting at low daily send volume, sending to genuinely engaged recipients first, and increasing volume over 2–4 weeks. Skipping warm-up and sending at full cold-email volume on day one, even with flawless SPF/DKIM/DMARC, commonly triggers spam filtering that has nothing to do with authentication and everything to do with an unproven sending pattern.
Signs authentication, not warm-up, is the actual problem
Check DMARC aggregate reports first — if legitimate mail is failing SPF or DKIM alignment there, that's a configuration issue to fix directly. If authentication is passing cleanly but deliverability is still poor, the problem is almost always reputation, volume, or list quality rather than the DNS records themselves.
FAQ
Do I need SPF, DKIM, and DMARC all set up, or just one?
All three, ideally — SPF and DKIM each authenticate mail in different ways and catch different failure modes, while DMARC ties them together by telling receiving servers what to do when either check fails and provides visibility through reporting; relying on only one leaves a real authentication gap.
- Each record addresses a different part of email authentication; none substitutes for the others.
- DMARC without SPF or DKIM configured properly underneath it has nothing meaningful to enforce.
Why is my email still going to spam even with SPF, DKIM, and DMARC set up correctly?
Authentication records prove a message legitimately comes from your domain, but they don't establish sending reputation on their own — a new or reconfigured domain still needs gradual volume warm-up, and list quality issues (high bounce or spam-complaint rates) will tank deliverability regardless of how clean the authentication setup is.
- Domain warm-up and list quality are separate problems from authentication configuration.
- Sending at full volume on a new domain, even with perfect records, commonly triggers spam filtering.