SPF, DKIM, DMARC: get your domain ready before you send
Three DNS records weigh on whether your emails reach the inbox. What they do, how to set them up for Google Workspace, and why to use a separate sending domain.
A perfect prospecting email is no use if it ends up in spam. Before your first send, put three DNS records in place on the domain that sends: SPF, DKIM and DMARC. Since February 2024, Gmail and Yahoo have required SPF or DKIM from every sender, and all three from bulk senders (more than 5,000 messages a day to Gmail); mail that isn’t authenticated may be rejected or sent to spam.
SPF: who is allowed to send
SPF is a TXT record at the root of the domain that lists the servers allowed to send on its behalf. For Google Workspace:
v=spf1 include:_spf.google.com ~all
A domain must have only one SPF record: if you use several sending services, add their include: entries to the same record, without going over ten DNS lookups.
DKIM: the signature
DKIM signs each email with a private key; the recipient verifies the signature with the public key published in your DNS. In the Google Workspace admin console (Apps › Google Workspace › Gmail › Authenticate email), generate a 2048-bit key, publish the suggested TXT record at google._domainkey, then click “Start authentication”.
DMARC: the policy, and the reports
DMARC tells recipients what to do with an email that fails SPF and DKIM, and where to send reports. You start in monitoring mode:
_dmarc TXT v=DMARC1; p=none; rua=mailto:dmarc@your-domain.com
Once the reports have been clean for a few weeks, move to p=quarantine, then to p=reject. Gmail asks bulk senders for at least p=none, and for the domain of the From address to match the one authenticated by SPF or DKIM.
A separate sending domain
Sending reputation is built domain by domain. Prospecting from your main domain means risking your invoices and customer emails landing in spam the day a campaign goes badly. Common practice: a similar domain reserved for prospecting (for example, a variation of your name), with its own SPF, DKIM and DMARC, and a website that redirects to the main one.
Warming up
A new domain or mailbox has no history. Start with a few dozen emails per day and per mailbox, spaced out, then increase gradually over several weeks while watching bounces and replies. Google also asks you to keep your reported spam rate below 0.3%.
Check it
Send an email to a test Gmail address, open it, then choose “Show original”: SPF, DKIM and DMARC should all display PASS. Coldlyne checks these records before a sequence can launch, and sets the pace of the warm-up itself.
And unsubscribing
For regular sending, Gmail and Yahoo also require a one-click unsubscribe, through the List-Unsubscribe and List-Unsubscribe-Post headers (RFC 8058), processed within two days. It’s what the CNIL asks for anyway: someone who no longer wants your emails must be able to say so in one move.