Cold email deliverability: set up SPF, DKIM and DMARC, then send slower than you think

Step 01: Check the three records you already have

Run these three lookups (swap in your domain). nslookup ships with Windows, macOS and Linux; 8.8.8.8 asks Google's public DNS, which is what most receivers see.

nslookup -type=TXT yourdomain.com 8.8.8.8
nslookup -type=TXT google._domainkey.yourdomain.com 8.8.8.8
nslookup -type=TXT _dmarc.yourdomain.com 8.8.8.8

You want exactly one TXT record starting v=spf1, one DKIM key at your provider's selector (google is the default on Google Workspace), and one record starting v=DMARC1.

Our real records, looked up on Oct 25 2026 at 11:10 AM ET. The DKIM key is shortened for width; we measured it at 2048 bits.

Step 02: Publish exactly one SPF record

SPF lists the servers allowed to send as your domain. Ours is one line, because Google is our only sender:

v=spf1 include:_spf.google.com ~all

Two rules from the SPF standard, RFC 7208, cause most failures:

• One record only. A domain must not publish more than one SPF record. If you add a newsletter tool, add its include: to the existing line instead of creating a second record.
• 10 DNS lookups maximum. Every include, a, mx and redirect counts. Stack enough tools and SPF returns a permanent error, which counts as a fail.

~all (soft fail) is the usual ending while you are still adding services. DMARC, in step 4, is where the strict policy lives.

Step 03: Turn on DKIM with a 2048-bit key

DKIM signs every message so the receiver can check it really came from your domain and was not altered. On Google Workspace, per Google's setup page:

1. In the Google Admin console go to Menu > Apps > Google Workspace > Gmail > Authenticate email.
2. Pick your domain, choose a 2048-bit key (1024 only if your DNS host cannot take long records) and keep the default google selector.
3. Add the generated TXT record at your DNS host. Google says it can take up to 48 hours to start working.
4. Come back and click Start authentication. The status should change to "Authenticating email with DKIM".

Test by sending to someone else's Gmail account; Google notes you cannot verify DKIM by emailing yourself. Open the received message's full header and look for a DKIM pass for your domain.

Step 04: Publish DMARC, start gentle, then tighten

DMARC tells receivers what to do when a message fails SPF and DKIM, and it requires that the domain that passed matches the one in your From address (alignment). Start in monitor mode with reports:

_dmarc.yourdomain.com  TXT  "v=DMARC1; p=none; rua=mailto:you@yourdomain.com"

Gmail and Yahoo accept p=none for bulk senders. Once a couple of weeks of reports show only your real senders passing, move to p=quarantine, which is where ours sits (pct=100, relaxed alignment). p=reject is the strictest setting; switch to it only when you are sure no legitimate tool sends as your domain unsigned.

Step 05: Warm up: send far below the published limit

Google publishes 2,000 messages a day per Workspace user and 3,000 external recipients. Treat those as the ceiling for an aged, trusted account, not a target for a new domain. Google does not publish a warm-up schedule, so this is the pace we run since the block:

• Every email is one-to-one. Written for one person, about their own recent work, plain text, one link.
• A hard daily cap for the whole domain, enforced in code, not by memory: ours started at 30 and is now 100, across every address and every agent.
• At least 3 minutes between sends, spread across the working day instead of a morning burst.
• Real addresses only. We never guess an address; a guessed address is a bounce, and bounces drag down reputation.

Our logged one-to-one sends per day (UTC dates). Not every send is in this file: the Oct 15 burst alone was 40 to 60 emails, and other agents kept separate logs some days. Source: our pitches.json, pulled Oct 25 2026.

Step 06: Watch spam rate and bounces, and stop on any warning

• Google Postmaster Tools shows your domain's spam rate and reputation once you send enough volume to Gmail. Google's line: stay under 0.1%, never reach 0.3%. Above 0.3%, Google says delivery support and mitigations are unavailable.
• Bounces: read every one. A burst of bounces means a bad list, and the fix is fewer, verified addresses.
• Unsubscribes: marketing and subscribed mail must offer one-click unsubscribe once you are a bulk sender (Gmail and Yahoo), and Yahoo wants opt-outs honored within 2 days. Even below that line, honor every "please stop" forever.
• Banners: the moment Gmail shows a sending limit or suspicious activity warning, stop every sender on the domain for the day. A lockout lasts up to 24 hours; a burned domain lasts much longer.