SPF, DKIM and DMARC explained (for cold email)

Quick answer

SPF, DKIM and DMARC are the three email authentication standards that prove your mail is really from you. SPF is a DNS record listing which servers may send for your domain. DKIM adds a cryptographic signature that proves the message was authorized by your domain and not altered in transit. DMARC is a policy that tells receivers what to do when SPF or DKIM fail, and where to send reports, relying on those checks aligning with your domain. For cold email you need all three configured and verified before you send, or mailbox providers filter or reject you.

What is SPF?

SPF, which stands for Sender Policy Framework, is a DNS TXT record that lists the servers and services allowed to send email on behalf of your domain.

When a receiving server gets a message claiming to be from your domain, it looks up your SPF record and checks whether the server that sent it is on the approved list. If the sending server is listed, SPF passes. If not, it fails. In practice this means every tool you legitimately send from, your mail provider and any sending platform, needs to be included in the record.

SPF on its own has limits. It checks the sending server, not the message itself, and it can break when mail is forwarded. That is why it is one leg of three, not the whole answer.

What is DKIM?

DKIM, which stands for DomainKeys Identified Mail, adds a cryptographic signature to the headers of every message you send.

Your domain holds a private key and publishes the matching public key in DNS. When you send, your mail server signs the message with the private key. The receiving server fetches your public key and uses it to verify two things: that the message was authorized by your domain, and that key parts of it were not altered in transit. If the signature checks out, DKIM passes.

Unlike SPF, DKIM verifies the message rather than just the sending server, and the signature survives forwarding, which is why it is the more robust of the two checks.

What is DMARC?

DMARC, which stands for Domain-based Message Authentication, Reporting and Conformance, is a DNS policy that sits on top of SPF and DKIM.

It does two jobs. First, it tells receivers what to do with a message that fails authentication, using one of three policies:

• none: take no special action, just monitor and report. Useful while you confirm everything is set up correctly.
• quarantine: treat failing mail as suspicious, typically sending it to spam.
• reject: refuse failing mail outright, so it is never delivered.

Second, DMARC lets you receive reports showing who is sending email as your domain, which surfaces both misconfigured tools of your own and anyone spoofing you.

The key detail is alignment. DMARC does not just ask whether SPF or DKIM passed; it checks that the domain they passed for matches the domain in the visible From address. A message can pass SPF or DKIM for some other domain and still fail DMARC if it is not aligned with yours.

How do SPF, DKIM and DMARC work together?

Think of them as a chain. SPF and DKIM each provide a way to verify the mail. DMARC decides what the verification means and what to do when it fails, and insists the verified domain lines up with the domain the recipient sees.

Passing all three tells a mailbox provider that your mail is authenticated and consistent, which is the baseline of trust before reputation and engagement even come into play. How those later layers build on this foundation is covered in the email deliverability guide.

Why does cold email need all three?

Mailbox providers now expect authentication as the price of entry for any domain sending meaningful volume. A sending domain without SPF, DKIM and DMARC looks like exactly the kind of unverified sender that spam filters are built to catch, so it gets filtered or rejected before copy or targeting matter at all.

Authentication is necessary but not sufficient. It gets you to the starting line; it does not guarantee the inbox. You still need to warm the domain up and build reputation, which is why these records should be in place before warm-up begins. See how to warm up a sending domain, and for everything that still sends authenticated mail to spam, why cold emails go to spam and how to avoid the spam folder.

Where Enablemnt fits

Authentication is fiddly. It means editing DNS records, getting every sending tool into SPF, publishing DKIM keys, and setting a DMARC policy you can safely tighten, then verifying all of it actually passes with alignment. One typo and your mail quietly fails. It is a one-time setup that most founders would rather not learn by trial and error.

Enablemnt handles it as part of the build. As your embedded RevOps and outbound team, we set up SPF, DKIM and DMARC on your sending domains, warm them up, and confirm inbox placement before launch, all inside a fixed 14-day sprint. You get authenticated, warmed domains ready to send, and you own the setup.

If you would rather have authentication done right than debug DNS at launch, tell us about your startup and we will map it out on a short call.

Filed under Outbound & cold email. Written by Enablemnt AI.