Cold email deliverability setup

Why SPF, DKIM, and DMARC decide whether you land

Mailbox providers like Gmail and Outlook do not take your word for who you are. They check three things, and since early 2024 Google and Yahoo require all of them from anyone sending at volume. Get them right and you are a known sender; get them wrong and you are filtered before a human ever sees the subject line.

• SPF (Sender Policy Framework) is a TXT record listing which servers are allowed to send mail for your domain. The receiver checks the sending server against that list. You may have only one SPF record per domain, so if one already exists you merge into it rather than adding a second.
• DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every message, using a private key your provider holds and a public key you publish in DNS. The receiver verifies the signature, so it can tell the message was not forged or altered in transit. The key comes from your provider, which is why no honest tool can generate it for you.
• DMARC (Domain-based Message Authentication, Reporting and Conformance) ties the two together. It tells receivers what to do when SPF or DKIM fail, and where to send reports so you can see who is sending as you. It is the record that turns SPF and DKIM from advisory into enforced.

Start DMARC at p=none, then tighten

The single most common mistake is jumping straight to p=reject. Start at p=none: this enforces nothing but collects aggregate reports at the address you set in rua, so you can see every source sending as your domain, including ones you forgot about. Once SPF and DKIM pass cleanly for a week or two, move to p=quarantine (failures go to spam), and finally p=reject (failures are blocked outright). The pct tag lets you apply an enforcing policy to a slice of mail first, for example 25 percent, before turning it up to 100. The builder above sets all of this from your inputs.

Use a separate sending domain, always

Never run cold outreach from your main brand domain. If a campaign draws spam complaints, the reputation damage follows the domain, and you do not want your invoices and customer replies landing in spam because of a cold campaign. The standard pattern is a lookalike domain bought just for outreach, for example get-acme.com or acme-mail.com, with a redirect to your real site. You authenticate that domain with the records above, warm it, and if it ever gets burned you retire it without touching your primary domain.

Warm up before you send for real

A brand new domain that suddenly sends hundreds of cold emails looks exactly like a spammer, because that is what spammers do. Warmup means starting with a trickle and ramping volume gradually over several weeks, while generating positive signals: opens, replies, and messages moved out of spam. The schedule above is deliberately conservative. The exact numbers matter less than the shape: slow, steady, and responsive to your bounce and complaint rates. The moment bounces climb past a few percent, stop and clean your list before going further.

Words filters punish

Content filtering is weaker than it used to be, but a cold first touch stuffed with classic spam language still hurts you. The scanner above flags the usual offenders, the urgency, the money talk, the all-caps promises. Treat it as guidance, not law: one or two flagged words in context is fine, a pile of them in a first email is a filtering risk. The reliable pattern for cold mail is short, plain text, one clear ask, and almost no links.

About BIMI

BIMI shows your logo next to your messages in supporting inboxes, which lifts trust and open rates. It is optional and it comes last: it only takes effect once your DMARC policy is at quarantine or reject, and most inboxes that display the logo also require a paid Verified Mark Certificate. Set up SPF, DKIM, DMARC, and your warmup first; come back to BIMI when enforcement is in place and the budget makes sense.

Where automated warmup fits

The DNS records here you publish once and rarely touch again. The ongoing work, warming each mailbox daily, rotating sends across mailboxes and domains, and watching deliverability metrics, is repetitive and easy to get wrong by hand. That is the job dedicated cold-email platforms do, and it is the honest reason this page links to them. They sit on top of the authenticated domains you build here; they do not replace this setup.

Privacy

The SPF, DKIM, DMARC, and BIMI strings and the spam-word scan are all generated in your browser. Your email draft never leaves the page. The only time anything is sent is when you choose to unlock the full 30-day schedule with your email, which uses a double opt-in and also sets up a free change-watch on your sending domain so you are alerted if its homepage changes.