How to Set Up Email Deliverability for Cold Email: SPF, DKIM, DMARC Guide (2026)

Yananai A. Chiwuta · Reviewed by Celine Sky · · 7 min read Last updated February 2026
Cover Image

TL;DR

Contents

You can write the best cold email of your career and it still won't matter if it lands in spam.

Email deliverability SPF DKIM DMARC — those four terms are the difference between your outbound sequence hitting an inbox and hitting a spam folder. Google and Microsoft tightened spam filtering significantly in 2024 and 2025. What used to be "optional best practice" is now baseline infrastructure. Skip any of these and your cold email campaigns are dead before they start.

We manage deliverability across dozens of sending domains for client campaigns. Domain warming alone takes 4–6 weeks. SPF, DKIM, and DMARC configuration takes 30 minutes per domain — but one mistake can permanently damage sender reputation. This guide walks through every step, with the specific DNS records, warming schedule, and sending limits we use.

Why Email Deliverability Breaks Cold Email Campaigns

Deliverability isn't a feature. It's infrastructure.

Most cold email failures get blamed on copy. "The subject line didn't work." "The CTA was wrong." "We need to personalise more." These adjustments matter — but they matter zero if the email never reaches the inbox.

Here's what happens when deliverability is misconfigured:

No SPF record: Gmail and Outlook can't verify that your sending service is authorised to send on behalf of your domain. Result: emails go to spam or get rejected.

No DKIM record: Your emails aren't cryptographically signed. Receiving mail servers can't verify the email wasn't altered in transit. Result: lower trust score, higher spam probability.

No DMARC record: You've told mailbox providers nothing about how to handle emails that fail SPF or DKIM. Result: inconsistent delivery, no reporting, and potential domain spoofing.

No domain warming: You bought a new domain yesterday and tried to send 200 emails today. Result: the domain is flagged instantly. Reputation score drops to near-zero. Recovery takes weeks.

These aren't edge cases. They're the default outcome when deliverability isn't set up properly. And once your domain reputation is damaged, it takes much longer to repair than it took to break.

SPF, DKIM, and DMARC: What Each Record Does for Deliverability

SPF (Sender Policy Framework)

SPF tells receiving mail servers which sending services are authorised to send from your domain. It's a DNS TXT record that lists approved senders.

Without SPF, anyone can claim to send from your domain. With SPF, only services you've explicitly authorised can send — and emails from unauthorised senders get flagged or rejected.

DKIM (DomainKeys Identified Mail)

DKIM adds a cryptographic signature to every email you send. The receiving server checks this signature against a public key in your DNS records. If the signature matches, the email is verified as authentic and unaltered.

Think of it as a digital seal. Without it, mail servers have no way to verify the email actually came from you and wasn't modified along the way.

DMARC (Domain-based Message Authentication, Reporting, and Conformance)

DMARC ties SPF and DKIM together and tells receiving servers what to do when authentication fails. It also provides reporting — you get data on who is sending from your domain and whether those sends pass or fail authentication.

Without DMARC, SPF and DKIM exist but there's no policy telling servers how to act on the results. With DMARC, you control whether failed emails are delivered, quarantined, or rejected.

Step-by-Step: Setting Up SPF, DKIM, and DMARC for Cold Email

Step 1: Set up SPF

Add a DNS TXT record to your sending domain:

Host: @
Type: TXT
Value: v=spf1 include:_spf.google.com include:sendgrid.net ~all

Replace include:sendgrid.net with the SPF include for your actual sending service. Smartlead and Instantly both provide their specific SPF include records in their setup docs.

Rules:

Step 2: Set up DKIM

DKIM setup varies by email provider. The general process:

  1. Go to your sending platform (Google Workspace, Smartlead, etc.)
  2. Find the DKIM settings — it will generate a public key
  3. Add that public key as a DNS TXT record
Host: google._domainkey (or the selector your provider gives you)
Type: TXT
Value: v=DKIM1; k=rsa; p=[your public key string]

You need a separate DKIM record for each sending service. Google Workspace gets one. Smartlead gets another.

Step 3: Set up DMARC

Add a DNS TXT record:

Host: _dmarc
Type: TXT
Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com; pct=100

Start with p=none — this monitors without enforcing. You'll receive aggregate reports on who is sending from your domain and whether they pass SPF/DKIM.

After 2–4 weeks of monitoring (and once you're confident all legitimate senders are properly configured), move to p=quarantine and eventually p=reject.

Step 4: Verify everything

Use these tools to verify your DNS records:

Send a test email to a Gmail account and check headers. Look for spf=pass, dkim=pass, and dmarc=pass in the authentication results.

Domain Warming: The 4–6 Week Schedule That Protects Your Reputation

Even with perfect DNS configuration, a new sending domain can't handle volume on day one. Domain warming builds reputation gradually.

The warming schedule we use

Week Daily send volume Activity
Week 1 5–10 per day Warm-up emails only (automated via Smartlead)
Week 2 10–20 per day Mix of warm-up + light campaign sends
Week 3 20–35 per day Campaign sends begin at low volume
Week 4 35–50 per day Increasing toward full capacity
Week 5–6 50–75 per day Full campaign volume (domain dependent)

What warming actually does

Smartlead (and Instantly) have built-in warming features. They send automated emails from your inbox to a network of inboxes, which open and reply to those emails. This simulates real conversation behaviour and builds sender reputation with mailbox providers.

The rules:

What happens if you skip warming

Your domain reputation starts at neutral. If you immediately send 200 cold emails, mailbox providers see a new domain sending high volume with no history. They interpret this as spam behaviour. Your domain reputation drops. Your emails go to spam. Recovering from this takes 4–8 weeks of consistent low-volume sending — longer than warming it properly would have taken.

Rushing warming is the most common deliverability mistake in B2B outbound.

Sending Limits and Inbox Rotation for B2B Cold Email

Daily sending limits

Setup Max cold emails per day
Single inbox, single domain 30–50
3 inboxes, 1 domain 90–150
5 inboxes across 3 domains 150–250
10 inboxes across 5 domains 300–500

The rule: never exceed 50 cold emails per inbox per day. Period. Exceeding this triggers volume-based spam filtering faster than anything else.

Inbox rotation

Smartlead and Instantly both handle inbox rotation automatically. You connect multiple inboxes, and the platform distributes sends across them. This keeps per-inbox volume low while maintaining total campaign volume.

Rotation best practice:

How to Check Your Email Deliverability Score

Run these checks before launching any campaign:

1. Mail Tester (mail-tester.com) Send a test email to the address they provide. You'll get a score out of 10. Aim for 9+ before sending campaigns.

2. MXToolbox Enter your sending domain and check SPF, DKIM, and DMARC records. Green checks across all three means configuration is correct.

3. Google Postmaster Tools If you're sending to Gmail addresses (you are — it's B2B), Google Postmaster shows your domain reputation, spam rate, and authentication results. Set this up on every sending domain.

4. Inbox placement test Send 10 test emails to different providers (Gmail, Outlook, Yahoo). Check whether they land in inbox, promotions, or spam. If any land in spam, stop and troubleshoot before launching.

Email Deliverability Checklist — Download Free

SPF, DKIM, DMARC records. Domain warming schedule. Per-inbox sending limits. DNS verification steps. The full checklist, formatted as a one-page reference for your next domain setup.

Download the Deliverability Checklist →

FAQ: Email Deliverability for B2B Cold Email

What does SPF DKIM DMARC mean for cold email?

SPF verifies which services can send from your domain. DKIM adds a cryptographic signature to verify email authenticity. DMARC ties them together and tells receiving servers what to do when authentication fails. Together, they're the authentication layer that determines whether your cold emails reach inboxes or spam folders. All three are required for reliable cold email deliverability in 2026.

How long does domain warming take for cold email?

Plan for 4–6 weeks. Week one starts at 5–10 sends per day using automated warming tools. Volume increases gradually until you reach 50–75 cold emails per inbox per day by weeks five to six. Rushing this schedule damages domain reputation more than it saves time.

How many cold emails can I send per day?

Maximum 50 cold emails per inbox per day. To increase total volume, add more inboxes and sending domains. Five inboxes across three domains can handle 150–250 cold emails per day while staying under per-inbox limits. Smartlead and Instantly handle the inbox rotation automatically.

Should I send cold email from my main company domain?

No. Use dedicated sending domains for cold outbound (e.g., getacme.com instead of acme.com). If your cold email domain gets flagged, your primary business email remains unaffected. Set up separate SPF, DKIM, and DMARC records on each sending domain.

#b2b-saas#outboundsales#email#deliverability#spf
Yananai A. Chiwuta

Yananai A. Chiwuta

Author

Yananai Chiwuta is a Go-To-Market Architect and founder of Forma Nôrden. He builds signal-based outbound systems for B2B SaaS companies scaling from $500K to $20M ARR, and authors The GTM Moat. Previously founded and exited FunnelVision.
Celine Sky

Celine Sky

Reviewer

Celine ensures technical accuracy and strategic alignment across all Forma Nôrden playbooks and resources.

Related Articles