How to Set Up SPF, DKIM, and DMARC for Cold Email in 2026: A Developer's Guide

If you're building a SaaS and plan to send emails to users — whether transactional, marketing, or outbound — email authentication is non-negotiable. Without proper SPF, DKIM, and DMARC records, your emails will land in spam or get rejected entirely.

Here's a practical, no-fluff guide to setting all three up correctly.

Why This Matters

Email providers like Gmail and Outlook use authentication records to decide whether your email is legitimate. If you skip this step:

• Your emails go to spam
• Your domain reputation drops
• Automated systems may block your domain entirely

This applies whether you're sending 10 emails or 10,000.

1. SPF (Sender Policy Framework)

SPF tells receiving servers which IP addresses are allowed to send email on behalf of your domain.

Setup

Add a TXT record to your domain's DNS:

v=spf1 include:_spf.google.com include:sendgrid.net ~all

Replace the include: values with your actual email providers. Common ones:

Common Mistakes

• Having multiple SPF records (only one is allowed per domain)
• Using +all instead of ~all or -all
• Exceeding the 10 DNS lookup limit

2. DKIM (DomainKeys Identified Mail)

DKIM adds a cryptographic signature to your outgoing emails. The receiving server checks this signature against a public key in your DNS.

Setup

Your email provider generates a DKIM key pair. You add the public key as a TXT record:

selector._domainkey.yourdomain.com TXT "v=DKIM1; k=rsa; p=MIIBIjANBg..."

Most providers (Google Workspace, SendGrid, etc.) walk you through this in their dashboard. The key thing is to make sure the selector matches what your provider expects.

Verification

Send a test email to a Gmail account and check the email headers. Look for:

dkim=pass header.d=yourdomain.com

3. DMARC (Domain-based Message Authentication, Reporting & Conformance)

DMARC ties SPF and DKIM together and tells receiving servers what to do when authentication fails.

Setup

Add a TXT record at _dmarc.yourdomain.com:

v=DMARC1; p=none; rua=mailto:[email protected]; pct=100

Policy Levels

Start with p=none to collect reports, then gradually move to quarantine and eventually reject once you're confident your legitimate emails are passing.

Verification Tools

Use these free tools to check your setup:

• MXToolbox — check SPF, DKIM, DMARC records
• Google Admin Toolbox — check MX records
• mail-tester.com — send a test email and get a score

Real-World Impact

Proper email authentication directly affects whether your emails reach inboxes. If you're building outbound features or any kind of email-sending functionality, this is foundational infrastructure.

I built ColdMailAI to help founders write better cold emails, and the number one question that comes up is deliverability. The answer almost always starts with "Did you set up SPF, DKIM, and DMARC?"

Quick Checklist

• [ ] One SPF record with all sending sources
• [ ] DKIM enabled for each sending service
• [ ] DMARC record starting with p=none
• [ ] Test email headers showing pass for all three
• [ ] Monitor DMARC reports for 2-4 weeks before tightening policy

If you're launching a product that sends email, get authentication right from day one. It's much harder to fix a damaged domain reputation than to set it up correctly from the start.

Questions? Drop them in the comments — happy to help debug specific setups.