_dmarc starting at p=none. Then send a test to Gmail and check that SPF, DKIM and DMARC all show PASS.These records tell inbox providers that mail from your domain is really from you. Without them, Gmail, Yahoo and Outlook will junk or reject your cold email.123 It takes about twenty minutes per domain.
Use secondary domains for cold email, never your main one, and repeat these records on each.
Which DNS records does a cold email domain need?
| Record | Host | Value |
|---|---|---|
| MX (Google) | @ | smtp.google.com, priority 1 |
| MX (Microsoft) | @ | Copy the exact value from your Microsoft 365 admin centre |
| SPF (Google) | @ | v=spf1 include:_spf.google.com ~all |
| SPF (Microsoft) | @ | v=spf1 include:spf.protection.outlook.com -all |
| DKIM (Google) | google._domainkey | TXT key from Admin console › Apps › Gmail › Authenticate email (2048-bit) |
| DKIM (Microsoft) | selector1._domainkey and selector2._domainkey | Two CNAMEs, values from the Defender portal’s DKIM tab4 |
| DMARC | _dmarc | v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com |
What’s the most common DNS mistake?
Typing _dmarc.yourdomain.com in the host field. Most DNS panels add the domain automatically, so you end up with _dmarc.yourdomain.com.yourdomain.com. The host is just _dmarc.
What else breaks?
- Two SPF records. A domain may have only one. Merge them into a single record, and keep it under 10 DNS lookups.
- DMARC reports going to another domain. Receivers only send reports to an outside domain if that domain publishes an authorisation record.5 Use an address on the same domain, or a DMARC reporting service.
- Long DKIM keys. Some registrars cap TXT records at 255 characters, so a 2048-bit key has to be split into chunks.
How do I check that it works?
- Run the domain through a free DNS checker such as MXToolbox.
- Send a test email to a Gmail address.
- Open it, choose Show original, and confirm SPF, DKIM and DMARC all read PASS.
When should I tighten DMARC?
DMARC reports arrive as XML files, so send them to a free reader such as Postmark’s DMARC Digests or dmarcian. Once two weeks of reports show almost all your mail passing SPF or DKIM aligned, with no unknown servers sending as you, move from p=none to p=quarantine.
Should I forward the sending domain?
Set a 301 forward from the sending domain to your real website in your registrar or Cloudflare, and make sure the forward works over https. Prospects who type in the domain should land on your site, not a dead page or a browser warning.
Do cold emails need a List-Unsubscribe header?
Gmail and Yahoo require one-click unsubscribe for bulk and marketing mail,12 and most sending tools can add the List-Unsubscribe header even to one-to-one cold email. Turn it on: people who can opt out in one click are less likely to press “spam”. Keep a plain opt-out line in the body too, such as “Not relevant? Reply ‘no’ and I won’t follow up.”
Common questions
Do I need SPF, DKIM and DMARC for cold email?
Yes. Gmail and Yahoo have required them for bulk senders since February 2024 and Outlook since May 2025, and Gmail began rejecting non-compliant mail from November 2025. Business filters judge you on the same signals, so set them up on every sending domain.
What DMARC policy should I use for cold email?
Start with p=none so you receive reports without blocking anything. Once two weeks of reports show your mail passing SPF or DKIM aligned, with no unknown senders, move to p=quarantine.
Is DKIM for Microsoft 365 a TXT record?
No. Microsoft 365 uses two CNAME records, selector1._domainkey and selector2._domainkey, with values you copy from the DKIM tab in the Microsoft Defender portal. Google Workspace uses a single TXT record at google._domainkey.
Keep reading
Sources
- Google: Email sender guidelines. support.google.com
- Yahoo: Sender best practices. senders.yahooinc.com
- Microsoft: Outlook requirements for high-volume senders, 2025. techcommunity.microsoft.com
- Microsoft Learn: Set up DKIM for Microsoft 365. learn.microsoft.com
- dmarcian: External destination verification. dmarcian.com