Skip to content
Cuppa Leads
All posts
  • cold-email
  • deliverability
  • spf
  • dkim
  • dmarc

SPF, DKIM and DMARC for cold email, explained

What SPF, DKIM and DMARC are, why cold email needs all three, and how to check them before you send. Plain words, no jargon.

The CuppaLeads teamPublished Updated 2 min read

Short answer: SPF, DKIM and DMARC are three DNS records that prove an email really comes from your domain. Cold email that lacks them is more likely to be filtered as spam or rejected outright. Set up all three, then check them before you send your first message.

What each one does

SPF lists which servers may send email for your domain. It is a single TXT record on the domain. If a message arrives from a server that isn't on the list, receivers treat it with suspicion.

DKIM adds a digital signature to every message. The receiving server checks the signature against a public key in your DNS. A valid signature shows the message wasn't changed on its way and really came from you.

DMARC tells receivers what to do when SPF or DKIM fails (nothing, quarantine or reject) and where to send reports. It ties the other two together.

Think of SPF as the guest list, DKIM as the sealed wax stamp, and DMARC as the instruction to the doorman.

How to check yours

  1. Open your domain's DNS records (or your email provider's admin console).
  2. Look for three records: an SPF TXT record starting with v=spf1, a DKIM record on the selector your provider gave you, and a DMARC TXT record on _dmarc starting with v=DMARC1.
  3. Send a test email to an inbox you control and inspect the message headers. They show whether SPF, DKIM and DMARC passed.

If any of the three is missing or failing, fix it before you send.

Other habits that protect deliverability

  • Verify addresses first. Sending to addresses that don't exist causes bounces, which hurt your sender reputation.
  • Pace each mailbox. Gradual, steady sending looks normal. Bursts don't.
  • Include an unsubscribe link, and honour it. Keep a suppression list so nobody who opts out is contacted again.
  • Stop when someone replies. Follow-ups should end on any reply, auto-reply or bounce notice.
  • Send from your own domain and mailboxes, so your reputation is yours.

How CuppaLeads handles this

Cold email in CuppaLeads is sent from your own Google Workspace mailboxes after a one-time setup of about 15 minutes with your Workspace admin. Before launch, CuppaLeads checks SPF, DKIM and DMARC and verifies every address with your own verification key. Each mailbox is paced, every email carries an unsubscribe link, and a suppression list is built in. Follow-ups stop on any reply, auto-reply or bounce.

See the cold email page, the FAQ or start a free trial (30 days).

FAQ

Questions, answered.

Yes. Mailbox providers use them to decide whether an email really comes from the domain it claims. Without them, even a good message is more likely to land in spam or be rejected.

Your DNS records show them. SPF and DMARC are TXT records on your domain, and DKIM is a TXT record on a selector name your email provider gives you. A DNS lookup tool or your email provider's admin console will show whether each one exists and passes.

Yes. For cold email sent from your own Google Workspace mailboxes, CuppaLeads checks SPF, DKIM and DMARC before launch, verifies every address with your own verification key, and paces each mailbox.

A clear sender, a relevant message and an unsubscribe link. CuppaLeads adds an unsubscribe link to every email and keeps a suppression list so people who opt out are not contacted again.

Put your outbound on autopilot.

Connect LinkedIn, load your leads, and let Cuppa do the rest.

Start free trialSee pricing

30-day free trial · Nothing to install