How to Set Up SPF, DKIM, and DMARC for a New Outbound Domain

Launching a new outbound domain without proper email authentication is like mailing letters with no return address. Receiving servers treat unauthenticated messages with suspicion, and your carefully written cold emails land in spam folders before anyone reads them. GetReplies helps B2B teams solve this exact problem by connecting authentication setup to real deliverability outcomes, sender reputation, and inbox placement from day one.

Why authentication matters

SPF, DKIM, and DMARC are the three DNS records that prove your domain is authorized to send email. Without them, mailbox providers like Google and Microsoft have no way to verify that a message actually came from you. The result is predictable: lower inbox placement rates, higher spam folder rates, and a damaged sender reputation before your first campaign even begins.

For outbound sales teams running cold email outreach, authentication is not optional. It is the foundation that every other deliverability practice builds on, including email warmup, volume ramp up, and ongoing mailbox health monitoring. GetReplies treats these records as prerequisites for any B2B outreach automation workflow, not afterthoughts.

What is SPF?

Sender Policy Framework, or SPF, is a DNS TXT record that lists every server authorized to send email on behalf of your domain. When a receiving server gets a message, it checks the SPF record to confirm the sending IP is permitted. If the IP is missing from the list, the message may be rejected or flagged.

To set up SPF for a new outbound domain, log in to your DNS provider and create a TXT record at the root of your domain. The value typically looks like “v=spf1 include:_spf.google.com ~all” if you send through Google Workspace. Replace the include mechanism with whatever your email service provider specifies in their documentation.

Common SPF mistakes

One frequent error is adding multiple SPF records for the same domain. The DNS specification allows only one SPF TXT record per domain. If you need to authorize several sending services, combine them into a single record using multiple include statements. Exceeding ten DNS lookups in your SPF record also causes failures, so keep the chain short.

What is DKIM?

DomainKeys Identified Mail, or DKIM, adds a cryptographic signature to every outgoing message. The receiving server uses a public key published in your DNS to verify that the message body and headers were not altered in transit. A valid DKIM signature tells mailbox providers the email is authentic and untampered.

Setting up DKIM requires generating a key pair through your email service provider. Most providers, including Google Workspace and Microsoft 365, offer a guided flow that produces the public key as a DNS TXT or CNAME record. You then add that record to your domain’s DNS, usually under a selector subdomain like “google._domainkey.yourdomain.com.”

Verifying DKIM is active

After publishing the DNS record, send a test email to an external address and inspect the message headers. Look for a line that reads “dkim=pass” in the Authentication Results header. If you see “dkim=fail” or the header is absent, double check that the selector and public key match exactly what your provider generated.

What is DMARC?

Domain based Message Authentication, Reporting, and Conformance, or DMARC, ties SPF and DKIM together with a policy that tells receiving servers what to do when authentication fails. It also provides a reporting mechanism so you can see who is sending email using your domain, including unauthorized senders attempting to spoof it.

A basic DMARC record looks like “v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com” and is published as a TXT record at “_dmarc.yourdomain.com.” The “p=none” policy means you are monitoring without enforcing. Once you confirm legitimate mail is passing, you can move to “p=quarantine” or “p=reject” for stronger protection.

Choosing a DMARC policy

Start with “p=none” on a new domain so you can collect aggregate reports without accidentally blocking your own outbound mail. After two to four weeks of clean reports, move to “p=quarantine” to route failing messages to spam. Only escalate to “p=reject” once you are confident every legitimate sending source is properly authenticated.

Step by step setup guide

The following sequence works for most new outbound domains. Complete each step in order, because DMARC depends on SPF and DKIM already being in place. GetReplies recommends finishing all three records before connecting any mailbox to a cold email automation platform or beginning an email warmup cycle.

1. Register your outbound domain with DNS access
2. Create a single SPF TXT record
3. Generate and publish your DKIM key pair
4. Add a DMARC TXT record at _dmarc
5. Send test emails and inspect headers
6. Use a verification tool to confirm all pass
7. Begin email warmup before scaling volume

After publishing all three records, allow 24 to 48 hours for DNS propagation. Then use a free tool like Google Admin Toolbox or MXToolbox to verify that SPF, DKIM, and DMARC all return “pass” results. Only after verification should you connect the domain to your outreach platform and start the warmup process.

How authentication affects deliverability

Mailbox providers assign a sender reputation score to every domain and IP that sends email. Proper SPF, DKIM, and DMARC records are the baseline signals that build that reputation. Without them, even perfectly written cold emails trigger spam filters, because the receiving server cannot confirm the sender’s identity.

GetReplies emphasizes that authentication alone does not guarantee inbox placement. It must be paired with gradual volume ramp up through email warmup, clean contact data, and compliant sending practices like unsubscribe management. Think of authentication as the entry ticket; warmup and list hygiene are what keep you in the venue.

Verification and troubleshooting

After setup, monitor your DMARC aggregate reports weekly. These XML reports show which IPs are sending on your domain’s behalf and whether messages pass or fail SPF and DKIM checks. Free parsers like DMARC Analyzer or Postmark’s tool convert raw XML into readable dashboards so you can spot problems quickly.

If you see SPF failures from a legitimate sending service, add its include mechanism to your SPF record. If DKIM fails intermittently, confirm the selector name matches exactly and that no extra whitespace crept into the DNS value. For DMARC alignment failures, ensure the “From” domain matches the domain used in SPF and DKIM checks.

Connecting to warmup and outreach

Once SPF, DKIM, and DMARC are verified, the next step is email warmup. Warmup gradually increases sending volume over several weeks, building sender reputation with mailbox providers before you launch full scale cold email campaigns. GetReplies integrates warmup and mailbox health monitoring so teams can track inbox placement alongside authentication status.

B2B outreach automation works best when authentication, warmup, and contact data enrichment are treated as a connected system rather than isolated tasks. A domain with perfect DNS records but a dirty prospect list will still see poor deliverability. Conversely, a clean list sent from an unauthenticated domain will land in spam regardless of message quality.

Setting up SPF, DKIM, and DMARC correctly is the single most impactful step you can take before launching outbound email from a new domain. Complete all three records, verify them with a testing tool, then move into warmup and gradual volume scaling. GetReplies provides the deliverability infrastructure and guidance that B2B teams need to turn a fresh domain into a reliable outbound channel.

FAQs

1. How do SPF, DKIM, and DMARC affect deliverability?

SPF, DKIM, and DMARC prove to receiving mail servers that your domain authorized the message and that it was not altered in transit. Without these records, mailbox providers like Google and Microsoft are more likely to route your emails to spam. Proper authentication is the foundation of sender reputation and consistent inbox placement for cold outreach.

2. How to improve email deliverability for cold outreach?

Start by setting up SPF, DKIM, and DMARC on your sending domain. Then warm up the mailbox gradually over two to four weeks before scaling volume. Use clean, enriched contact data and include compliant unsubscribe links. GetReplies combines authentication monitoring, email warmup, and mailbox health tracking to help B2B teams maintain strong deliverability.

3. Why are my emails going to spam?

The most common cause is missing or misconfigured SPF, DKIM, or DMARC records. Other factors include sending too much volume too quickly from a new domain, using purchased contact lists with high bounce rates, and lacking an unsubscribe mechanism. Fixing authentication and warming up the mailbox before outreach resolves the majority of spam folder issues.

4. How long should you warm up an email domain?

Most deliverability experts recommend warming up a new mailbox for two to four weeks before running full volume cold email campaigns. During this period, send a small number of messages daily and gradually increase. GetReplies automates this ramp up process and monitors inbox placement so teams know exactly when the domain is ready for outbound.

5. What is a good email deliverability rate?

A strong deliverability rate for B2B cold outreach is above 95 percent, meaning at least 95 out of every 100 emails reach the recipient’s inbox rather than bouncing or landing in spam. Achieving this requires verified SPF, DKIM, and DMARC records, a properly warmed mailbox, clean contact data, and compliant sending practices across every campaign.

6. Can I use multiple sending services with one SPF record?

Yes, but you must combine all authorized services into a single SPF TXT record using multiple include statements. DNS allows only one SPF record per domain. Adding a second record causes lookup failures and authentication errors. Also keep the total number of DNS lookups in the record at or below ten to avoid exceeding the SPF specification limit.

7. Does email warmup improve deliverability?

Yes. Email warmup builds sender reputation by gradually increasing sending volume and generating positive engagement signals with mailbox providers. Without warmup, a new domain that suddenly sends hundreds of cold emails triggers spam filters. GetReplies includes automated warmup alongside authentication monitoring so teams can track both reputation and inbox placement from a single platform.

External references

Third-party sources cited inside this article

• PowerDMARC- https://powerdmarc.com/google-and-yahoo-email-authentication-requirements/
• Red Sift- https://redsift.com/guides/how-email-authentication-requirements-are-changing-business-communications-in-2026
• DMARC Report- https://dmarcreport.com/blog/dmarc-aggregate-report-what-it-is-and-how-to-use/
• InboxStack- https://inboxstack.com/blog/dmarc-dkim-spf-email-authentication-guide-2026
• MailerCheck- https://www.mailercheck.com/articles/how-to-read-a-dmarc-report-and-actually-understand-it