Email deliverability checklist for SPF, DKIM, DMARC and cold outreach

SPF is a TXT record on your domain that lists the services allowed to send mail on its behalf. When a message arrives, the receiving server compares the sending source with that list.

• Publish exactly one SPF record per domain. Two records break the check.
• Include every service that sends as your domain, including your mailbox provider and any tool that sends through it.
• Stay within the lookup limit. SPF allows a limited number of DNS lookups, and long chains of includes can quietly exceed it.
• End the record with a clear policy for everything not listed.

DKIM adds a cryptographic signature to each message, checked against a public key you publish in DNS. It shows receivers that the message really came from your domain and was not changed on the way.

• Enable DKIM signing in your Google Workspace or Microsoft 365 admin settings, or with your SMTP provider.
• Use a key length your provider recommends and rotate keys on a schedule.
• Send a test and confirm the header shows a passing DKIM result aligned with your From domain.

DMARC tells receivers what to do when a message fails SPF and DKIM alignment, and where to send reports about it.

• Publish a DMARC record on every sending domain.
• Start with a monitoring policy and a reporting address, read the reports and fix any legitimate source that fails.
• Move to a quarantine or reject policy once reports show only your own sources passing.
• Keep reading reports after you tighten the policy. New tools added later are a common cause of failures.

If you track clicks, links in your emails are rewritten to pass through a tracking address. On a shared tracking domain, your links inherit the reputation of everyone else who uses it. A custom tracking domain, a subdomain of your own set up with a CNAME record, keeps that reputation yours. Many cold emailers also limit tracking on first touches and keep the first email free of links entirely.

Run cold outreach from a closely related domain rather than the one that carries your invoices, support and internal mail. Authenticate it fully, point its website at your main site and give each mailbox a real rep's name. Read more in email warmup explained.

Sudden volume is the fastest way to look like a compromised account.

• Ramp new mailboxes slowly over several weeks before they carry full sequences.
• Set a daily cap per mailbox and keep daily volume steady.
• Spread sending through business hours in the recipient's time zone.
• Add mailboxes for more volume rather than pushing one mailbox harder, and rotate sending across them.
• Pause any mailbox automatically when bounces or complaints rise.

These controls are the core of an email warmup tool, and they belong on by default.

Bounces and complaints come mostly from the list, not the copy.

• Verify every address before it enters a sequence, including syntax, domain, MX and mailbox checks.
• Flag catch-all and role addresses and treat them as risky.
• Re-verify contacts whose last check is old.
• Suppress hard bounces at once and stop retrying soft bounces after a few attempts.
• Honor unsubscribes immediately across every sequence and mailbox.
• Never send to bought lists of unknown origin.

Our guide on how to verify email addresses explains each check, and an email verifier runs them before every campaign.

Filters look at content too, though it matters less than authentication and behavior.

• Write in plain text style, short, with one clear ask.
• Keep links to a minimum, and none in the first email if you can.
• Avoid attachments and heavy images on first touches.
• Use honest subject lines that match the body.
• Personalize from real research, so messages differ from one another rather than repeating one block of text.
• Include a clear unsubscribe link and your physical postal address in the signature.

Deliverability changes week to week, so watch the signals continuously.

• Track sent, delivered, bounced and replied per mailbox, not only per campaign. A problem on one mailbox hides inside a healthy average.
• Watch for spam complaints and treat even a small rise as a reason to pause and investigate.
• Watch for deferrals and blocks in bounce messages, which often name the reason.
• Read DMARC reports for authentication failures.
• Compare replies over time. A falling reply count with steady sends often means mail is landing in spam.
• When a signal turns bad, pause the mailbox, find the cause, fix it and restart lower on the ramp.

• SPF, DKIM and DMARC all pass on a test message.
• Tracking uses your own domain or is off for the first step.
• Each mailbox has a daily cap and a ramp-up state that fits its age.
• The list is freshly verified, with catch-all and role addresses flagged.
• Unsubscribe link and postal address appear in the signature.
• Bounce and complaint signals for each mailbox look clean for the past week.

ColdReach sends only from your own connected Google Workspace, Microsoft 365 or SMTP and IMAP mailboxes, never from its own mail servers. It checks your SPF, DKIM and DMARC setup, ramps volume gradually, rotates across mailboxes, enforces daily caps and pauses a mailbox when bounces or complaints rise. Analytics show sent, delivered, bounced and replied per mailbox. See the details on our email deliverability page and compare connected mailboxes per plan on cold email software pricing.