SPF, DKIM, and DMARC

Three small DNS records that tell providers your email really is from you — and keep it out of spam.

What each one does

• SPF lists the servers allowed to send mail for your domain. A receiving provider checks the sending server against that list.
• DKIMattaches a cryptographic signature to every message. The provider verifies it against the public key you publish, proving the mail wasn't altered in transit.
• DMARC tells providers what to do when SPF or DKIM fail — nothing, quarantine, or reject — and completes the chain.

Where to set them up

All three live in your domain's DNS settings, wherever your domain is hosted — your registrar, Cloudflare, Google Admin, or Microsoft 365 admin center. Your mail provider publishes step-by-step values for each: follow theirs, since the exact records depend on who sends your mail.

How ColdPilot uses them

ColdPilot's deliverability check reads your domain's SPF, DKIM, and DMARC records live, along with blacklist listings and your message content, and folds them into a single score. A missing SPF record, a missing DKIM key, or a missing (or monitoring-only) DMARC policy each lower the score — which is why this ten-minute setup pays for itself on every send.

Next

Records in place? Start warming up before you send at volume.