You can write the perfect cold email, but if your domain authentication is missing, most of it will never be seen. Mailbox providers like Gmail and Outlook check three DNS records before deciding where your email lands. Here is what each one does, in plain English.
SPF: Who Is Allowed to Send for You
SPF (Sender Policy Framework) is a DNS record that lists which servers are allowed to send email on behalf of your domain. Without it, anyone can spoof your address — and providers know it. Add your email provider’s SPF include to your domain’s TXT record and you are covered.
DKIM: Your Digital Signature
DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to every email you send. The receiving server verifies it against a public key in your DNS. If the signature checks out, the email is provably from you and was not tampered with in transit.
DMARC: Your Enforcement Policy
DMARC tells providers what to do when SPF or DKIM checks fail: do nothing, quarantine, or reject. Start with "p=none" to collect reports, then move to "p=quarantine" once your setup is clean. Skipping DMARC is the most common reason new sending domains land in spam.
Quick Checklist
SPF record published, DKIM key generated and added, DMARC at p=none or stricter, and a custom tracking domain so link clicks don’t get flagged. Verify all three with a free DNS checker before your first campaign.
Keep Your Bounce Rate Under 2%
Authentication gets you through the door, but list quality keeps you there. Verify every list before sending, remove role-based addresses, and never buy scraped databases. A single campaign with a 5% bounce rate can undo weeks of careful warmup.
Start Sending Safely
Connect your inbox and let our AI handle deliverability and personalization.
Start Free Trial