You can write a perfect cold email — relevant, well-researched, in the buyer's language — and still get zero replies, because it never reached the inbox. It landed in spam, or worse, it was silently dropped before spam. Deliverability is invisible until you know to check it, and for exporters running outreach at volume, it's one of the highest-leverage things to fix.
The short version
SPF, DKIM, and DMARC are three DNS records that tell receiving mail servers (Gmail, Outlook, etc.) "yes, this sender is really who they say they are." Without them, your emails look — to an automated spam filter — indistinguishable from someone spoofing your domain. All three are free to set up (they're just DNS text records), take about 15 minutes if you have access to your domain's DNS settings, and don't require any paid tool.
What each one actually does
SPF (Sender Policy Framework) is a list of servers allowed to send email "as" your domain. It answers: did this email actually come from a server your domain authorized? If you send outreach through a platform, that platform's sending servers need to be included in your SPF record — otherwise every email it sends on your behalf looks unauthorized.
DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to each outgoing email, generated from a private key only your sending platform holds, verified against a public key published in your DNS. It proves the email content wasn't altered in transit and really came from a server holding your private key.
DMARC (Domain-based Message Authentication, Reporting and Conformance) sits on top of both. It tells receiving servers what to do if an email fails SPF or DKIM checks (quarantine it, reject it, or do nothing), and it can send you reports showing who's sending email using your domain — including anyone spoofing it.
Why this matters more for cold outreach than for regular business email
A domain with no history of sending cold email starts with zero reputation. Mailbox providers treat unauthenticated bulk-looking mail from a low-reputation domain with heavy suspicion by default. Missing or misconfigured SPF/DKIM/DMARC is one of the fastest ways to get flagged — and once a domain's reputation drops with a major provider, it can take weeks to recover, even after the emails themselves are compliant.
The most common mistakes
- Multiple SPF records for one domain — DNS only allows one SPF record; having two (e.g., one from your old email provider, one added later for outreach) causes SPF to fail outright for everyone.
- Sending through a new platform without updating SPF — if you switch outreach tools and forget to add the new platform's servers to your SPF record, every email sent through it fails authentication.
- No DMARC record at all — without one, receiving servers have no instruction on what to do with failed messages, and you get no visibility into whether someone else is spoofing your domain.
- Sending cold outreach from a brand-new domain with zero warm-up — even with perfect SPF/DKIM/DMARC, a domain that goes from zero to hundreds of emails a day overnight still triggers volume-based spam filters. Authentication and warm-up are separate problems, both worth solving.
How to check yours
Most DNS providers (Cloudflare, GoDaddy, your registrar) let you view TXT records directly. Free tools like MXToolbox's SPF/DKIM/DMARC checkers will tell you in seconds whether records exist and are valid — this doesn't require any account or paid access. If you're unsure who manages your domain's DNS, that's usually whoever set up your company email (IT, or whoever registered the domain).
WhaleIntro's email health check flags SPF, DKIM, and DMARC issues on your sending domain before you launch an outreach campaign, so you catch a misconfiguration before it burns your domain's reputation rather than after.
Start your 14-day free trial →
FAQ
Do I need all three — SPF, DKIM, and DMARC — or just one?
All three, ideally. SPF and DKIM each authenticate the email differently, and DMARC tells receiving servers what to do when either check fails. Having only one leaves gaps a spam filter can flag.
Will fixing these guarantee my emails land in the inbox?
No — authentication removes one major reason emails get flagged, but deliverability also depends on sending volume, domain age and warm-up, recipient engagement, and content. Think of SPF/DKIM/DMARC as a prerequisite, not a complete fix.
How long does it take for changes to take effect?
DNS changes typically propagate within a few hours, though it can take up to 48 hours in some cases. It's worth checking again a day after making changes before assuming something's wrong.
Can I do this myself without a developer?
Usually yes — it's a matter of adding TXT records in your domain registrar's DNS settings, not writing code. If your company email is managed by an IT provider or agency, they typically handle this in a few minutes if asked.