Fundamentals
SPF, DKIM and DMARC, explained for outbound teams
What each record does, how they work together, and the most common mistakes that send cold email to spam.
Coldvenue team 5 min read
Email authentication answers one question for the receiving server: is this message really from who it says it is from? Three DNS records answer it together.
SPF: who may send
An SPF record lists the services allowed to send mail for your domain. Keep a single SPF record per domain and stay under the DNS lookup limit.
DKIM: was it changed
DKIM adds a cryptographic signature to each message. Your email provider publishes the public key in DNS; receivers use it to verify the signature.
DMARC: what to do when checks fail
DMARC connects the visible From domain to SPF and DKIM and tells receivers whether to accept, quarantine or reject mail that fails. Start with a monitoring policy, read the reports, then tighten it.
Common mistakes
- Two SPF records on one domain (receivers treat this as an error).
- DKIM enabled in DNS but not turned on in the mailbox provider.
- Jumping straight to a reject policy before checking reports.
- Sending cold email from the company’s primary domain.