Cold Email Deliverability Checklist: SPF, DKIM and DMARC

Understand each one so you can fix it when it breaks:

• SPF (Sender Policy Framework): a DNS record listing the mail servers and services allowed to send on behalf of your domain. Receiving servers check the sending server against it.
• DKIM (DomainKeys Identified Mail): your sending service signs each message with a private key, and receivers verify the signature using a public key you publish in DNS. It shows the message wasn't altered and came from an authorized sender.
• DMARC (Domain-based Message Authentication, Reporting and Conformance): a policy that requires SPF or DKIM to pass and align with the visible From domain, and says what receivers should do with failures: nothing, quarantine or reject. It also sends aggregate reports.

Alignment is the part people miss. The domain in your From address has to match the domain that passes SPF or DKIM, otherwise DMARC fails even when the other two pass.

Work through this list for each sending domain:

1. List every service that sends email from the domain, including your mailbox provider and any sending or outreach tools.
2. Publish one SPF record that includes all of them. A domain can have only one SPF record, and multiple records make SPF fail.
3. Turn on DKIM in your mailbox provider and in each sending tool, then add the public keys they give you as DNS records.
4. Publish a DMARC record starting in monitoring mode, with a policy of none and an address for reports.
5. Send tests to accounts at several providers and read the message headers to confirm SPF, DKIM and DMARC show as pass.
6. Review the DMARC reports for a few weeks, fix any legitimate sender that fails, then tighten the policy step by step.
7. Recheck after any change to your sending tools, since adding a service can break SPF.

These are the usual culprits when tests fail:

• Two SPF records. Combine them into one.
• Too many lookups. SPF allows a limited number of DNS lookups, and including many services can exceed it. Remove services you no longer use.
• Wrong record type or host name. DKIM and DMARC records sit on specific host names, and a typo means receivers never find them.
• DNS provider quirks, such as automatically adding the domain name to the host field, or splitting long DKIM keys incorrectly.
• Old tools still listed. Sending services you canceled can stay in SPF and create risk.
• No DMARC record at all, which some large providers treat as a warning sign.
• Changes not yet propagated. Records can take time to be visible everywhere, so recheck before assuming they're wrong.

Authentication proves who you are. It doesn't prove you're worth reading. Once it passes, look at:

• List quality: verify addresses and remove role accounts and known bounces. High bounce rates damage reputation quickly.
• Volume and pacing: keep daily sending per mailbox modest and steady, as covered in how many cold emails per day per inbox.
• Domain history: a new domain needs warm-up, described in warming up a new domain.
• Content: avoid spammy wording, many links or images and misleading subject lines.
• Unsubscribe and identity: include your company details and an easy way to opt out.
• Provider requirements: large mailbox providers publish sender requirements, including authentication and low complaint rates, and the Google and Yahoo bulk sender requirements guide covers how they apply to cold outreach. Check current wording on their sites.

Even once a delivered email turns into an opportunity, the average B2B new-logo win rate is 19 percent¹, so most won't close. Reaching the inbox is only the first step, but without it none of the rest can happen.

Set a monthly routine, using the cold email deliverability audit checklist as a template:

• Recheck SPF, DKIM and DMARC after any tool change.
• Read the DMARC reports for unknown senders.
• Send placement tests to seed addresses at major providers.
• Review bounce and complaint patterns by domain and mailbox.

Tools can help. MailReach fits teams that want to warm up inboxes and watch spam scores continuously. InboxAlly fits teams with a domain whose placement has slipped and needs repair using seed lists. Neither replaces correct DNS records, so fix authentication first. Compare them in InboxAlly vs MailReach vs Warmup Inbox.