Set Up Your Business Email for High Deliverability (SPF, DKIM, DMARC)
If you are setting up a new business email domain for cold outreach or bulk sending, you cannot just buy a domain, connect it to Google Workspace, and start emailing people. In 2024, Google and Yahoo introduced strict mandatory sender requirements. In 2026, failing to implement these requirements does not just mean poor deliverability—it means your emails will be hard-rejected before they even reach the spam folder.
This is the definitive, step-by-step guide from an independent deliverability consultant on how to technically set up your business email for 99% inbox placement.
The "Holy Trinity" of Email Authentication
Every bulk email campaign relies on three fundamental DNS records. Think of them as your digital passport, your digital signature, and your border policies.
1. SPF (Sender Policy Framework)
What it is: The "Passport." It is a DNS record that explicitly lists which IP addresses and email servers are allowed to send emails on behalf of your domain. What happens if it's missing: Receiving servers cannot verify if the sender is actually authorized or if they are a spoofing attacker.
2. DKIM (DomainKeys Identified Mail)
What it is: The "Digital Signature." DKIM adds a cryptographic signature to your email headers. The receiving server uses a public key (published in your DNS) to verify that the email was actually sent by you and wasn't altered in transit. What happens if it's missing: Your emails will instantly fail Google and Yahoo's bulk sender requirements.
3. DMARC (Domain-based Message Authentication, Reporting, and Conformance)
What it is: The "Border Policy." Once SPF and DKIM are validated, DMARC tells the receiving server what to do if an email fails those checks. What happens if it's missing: You lose all control over domain spoofing, and major inbox providers will penalize your sender reputation.
Authentication Workflow Diagram
Here is a visual breakdown of how these three protocols work together when you send an email:
- You Send an Email: The email is transmitted to the recipient's receiving server (e.g., Gmail or Microsoft).
- Receiving Server Checks SPF: It verifies if your sending IP address matches the authorized list in your DNS.
- Receiving Server Checks DKIM: It attempts to decrypt the digital signature to ensure the email was not tampered with.
- Evaluate DMARC Policy: If both SPF and DKIM pass, the email proceeds to the inbox. If either fails, the server consults your DMARC policy.
- DMARC Enforcement: If your policy is set to
quarantine, the failed email is sent to the Spam folder. If set toreject, the email is completely blocked.
Step-by-Step Configuration Guide
Let us assume you are using Google Workspace and your domain is hosted on Namecheap or GoDaddy. The principles remain the same for Microsoft 365.
Step 1: Setting up SPF
Go to your DNS settings and add a new TXT record.
- Name/Host:
@ - Value:
v=spf1 include:_spf.google.com ~all - TTL:
3600
Critical Warning: You can only have ONE SPF record per domain. If you are using multiple services (e.g., Google Workspace AND Mailchimp), you must combine them: v=spf1 include:_spf.google.com include:servers.mcsv.net ~all.Step 2: Generating and Setting up DKIM
- Log into your Google Workspace Admin console.
- Go to Apps > Google Workspace > Gmail > Authenticate Email.
- Select your domain and click Generate New Record (use 2048-bit).
- Copy the generated Host name (usually
google._domainkey) and the long string value. - In your DNS settings, add a new TXT record with that Name and Value.
- Go back to Google Workspace and click Start Authentication.
Step 3: Configuring DMARC
You should not enforce a strict DMARC policy until you are 100% certain your legitimate emails are passing SPF and DKIM.
Phase 1: Monitoring (First 2 weeks): Add this TXT record to your DNS:
- Name/Host:
_dmarc - Value:
v=DMARC1; p=none; rua=mailto:reports@yourdomain.com
(Pro Tip: The rua= tag tells receiving servers where to send XML aggregate reports. Because these reports are incredibly hard to read manually, use a free parser like Postmark's DMARC tool to translate the data into visual graphs.)
Phase 2: Quarantine (After you verify reports):
- Value:
v=DMARC1; p=quarantine; rua=mailto:reports@yourdomain.com
Phase 3: Reject (Strict Security):
- Value:
v=DMARC1; p=reject; rua=mailto:reports@yourdomain.com
Step 4: The Advanced Standard (BIMI)
If you operate a large brand, you should look into BIMI (Brand Indicators for Message Identification).
Once your DMARC is set to p=quarantine or p=reject, creating a BIMI record allows you to display your official, trademarked company logo right next to your email in the recipient's inbox (even before they open it). In 2026, having a verified BIMI logo is the ultimate flex of sender authenticity and heavily drives up open rates.
Domain Strategy Guide
Choosing the exact name and extension of your domains is the first step in deliverability. Not all Top-Level Domains (TLDs) are treated equally by Google and Microsoft spam filters.
The Golden Rule of TLDs
Always buy .com, .io, or .co domains. Spam algorithms heavily penalize cheap extensions like .xyz, .info, or .biz because they are frequently abused by mass spammers.
Cousin Domain Naming Conventions
A common mistake is sending cold emails from your primary company domain (e.g., acme.com). If your outreach gets marked as spam, your main domain gets blacklisted, and your CEO's emails to investors go to spam.
The Solution: Use secondary "cousin domains". They look exactly like your real brand but protect your core infrastructure.
| Domain Type | Example | Usage |
|---|---|---|
| Primary HQ | acme.com | DO NOT SEND COLD EMAIL. Use for internal comms and inbound clients. |
| Action Prefix | getacme.com | Excellent for outbound sales teams. |
| Action Prefix | tryacme.com | Excellent for automated sequences. |
| Suffix | acmeapp.com | Great for product-led outreach. |
| Suffix | acmehq.com | Great for executive outreach. |
Each of these cousin domains must have its own SPF, DKIM, and DMARC set up individually.
Check Your Work
Once you have added these records, it can take anywhere from 15 minutes to 24 hours for DNS to propagate.
Use free tools like:
- MXToolbox: Under the "Email Health" section to check SPF, DKIM, and DMARC.
- Mail-Tester.com: Send a test email from your newly configured inbox to get a 10/10 score.
- Google Postmaster Tools: Register your domain here to monitor your reputation directly with Google.
Automating Setup with Dedicated Platforms
If you are dealing with a multi-inbox strategy (say, 10 different cousin domains and 20 sending addresses), manually configuring DNS and tracking DMARC reports is a massive administrative headache.
This is where specialized tools come in. Platforms like Mailshrine simplify this entire process. Rather than digging through complex DNS syntax for every new domain, Mailshrine typically offers guided, semi-automated DNS verification and continuously monitors your inbox health, ensuring your authentication never breaks mid-campaign.
Citations & References
- Reference: Google Workspace Admin Help: Prevent spoofing and spam with DMARC
- Reference: M365 Defender: How SPF, DKIM, and DMARC work together
Written by Elena M., Independent Email Infrastructure Architect. Elena runs a B2B consultancy that helps enterprise sales teams build scalable, un-blockable outbound email infrastructures.
