To set up SPF, DKIM and DMARC for cold email on a Google Workspace domain, you add three DNS records at the company that hosts your domain's DNS: an SPF record that names Google as an allowed sender, a DKIM record that Google generates for you in the Admin console, and a basic DMARC record that starts in monitoring mode. Then you send a test message and confirm all three show PASS.

Each step is short. The only slow part is waiting for DNS to update. If you want the background on why mailbox providers care, why cold email lands in spam, mechanically covers it. This guide is the hands-on version.

What the three records do

All three exist so a receiving server can check that mail claiming to be from your domain really is.

SPF is a list of the servers allowed to send mail for your domain. It lives in a DNS TXT record. The receiving server looks at which server delivered the message and checks whether it is on your list.

DKIM adds a digital signature to each message. Your sending system signs the message with a private key, and you publish the matching public key in DNS. The receiving server fetches the public key and verifies the signature, which shows that the message came from a system you authorized and wasn't changed along the way.

DMARC ties them together. It is a policy record that says what to do with mail that fails, and it requires that the domain checked by SPF or DKIM matches the domain in the visible From address. It also gives you a way to receive reports about who is sending mail as your domain.

One piece of context. In 2024 Google began enforcing authentication rules for senders. Anyone sending to personal Gmail accounts is expected to have SPF or DKIM in place. Bulk senders, meaning those who send about 5,000 or more messages a day to Gmail addresses, must have SPF, DKIM and DMARC, offer one-click unsubscribe on marketing mail, and keep their spam complaint rate under 0.3 percent. A small business sending 30 cold emails a day isn't a bulk sender, but setting up all three records is cheap, takes under an hour, and avoids a reason for any provider to distrust you.

If you send from a plain @gmail.com address, there is nothing to set up. Google controls the DNS for gmail.com and handles authentication. This guide is for a business domain on Google Workspace.

Check what you have now

Before adding anything, find out what exists. Fernhill Roofing uses fernhillroofing.example with Google Workspace. Dan, who manages the domain, runs two quick checks.

First, Google's free Admin Toolbox has a tool called CheckMX that looks up your domain's mail records and flags problems. Second, from any computer he can run nslookup -type=txt fernhillroofing.example (on Windows or Mac) and look for a line starting with v=spf1. If he finds one, he reads it and edits it later, since a domain may have only one SPF record. Two separate SPF records is a common mistake and causes SPF to fail outright.

For DMARC he looks up _dmarc.fernhillroofing.example the same way. For DKIM, the Admin console tells him the status, as we'll see below.

Set up SPF

Sign in at the company where the domain's DNS is managed. That might be your registrar, Cloudflare, or whoever you pointed the nameservers to. If you aren't sure, look up who hosts your DNS with a WHOIS or nameserver lookup.

If there's no existing SPF record, add a TXT record on the root of the domain (the host is often shown as @ or left blank) with this value:

v=spf1 include:_spf.google.com ~all

That says: Google's mail servers are allowed to send for this domain; for anything else, treat it with suspicion (the ~all means soft fail). If you already have an SPF record because another service sends mail for you, such as an invoicing tool, don't create a second one. Add Google's include to the same record, for example:

v=spf1 include:_spf.google.com include:mail.invoicetool.example ~all

SPF also has a limit of 10 DNS lookups in total. Each include counts, and so do nested ones. If you stack many services in one record, you can go past the limit and SPF breaks. Keep the list short.

Turn on DKIM in Google Workspace

This one needs an administrator account. In the Google Admin console, go to Apps, then Google Workspace, then Gmail, then Authenticate email. Choose your domain, and select Generate new record. Keep the default settings (a 2048-bit key and the selector name google) unless your DNS host rejects a key that long.

Google then shows you a TXT record. The host name looks like google._domainkey and the value is a long string beginning with v=DKIM1. Copy both exactly and add them as a TXT record at your DNS host. Some DNS hosts append your domain name automatically, so if you enter the full name you can end up with it doubled. Enter just google._domainkey if that is what your host expects.

DNS changes can take anywhere from a few minutes to a day or two to spread. Once they have, go back to Authenticate email and select Start authentication. The status should change to authenticating email. Until you do this step, messages from your domain aren't signed with your own domain's key, which means DKIM can't line up with your From address for DMARC.

Add a basic DMARC record

Add a TXT record with the host _dmarc and a value like this:

v=DMARC1; p=none; rua=mailto:dmarc-reports@fernhillroofing.example

The p=none part is the policy. It tells receivers to take no action on failures but to send you reports. That's the safe starting point because it can't cause legitimate mail to be rejected. The rua address is where daily summary reports go. They are XML files that most people never read by hand, so use a mailbox you rarely check or a free report-reader service.

After a few weeks, if the reports show only your own legitimate senders and all are passing, you can tighten the policy to p=quarantine, which sends failures to spam, and later p=reject, which blocks them. For cold email from a small business, p=none or p=quarantine is plenty. Don't jump to reject without reading the reports, because a forgotten invoicing tool could get blocked.

Send a test and read the headers

Send a message from your Workspace address to a personal Gmail account. Open it in the receiving account, click the three dots, and choose Show original. At the top, Google lists the results:

  • SPF: PASS, with the sending address and the domain.
  • DKIM: PASS, with a d= value that matches your domain.
  • DMARC: PASS.

If DKIM shows PASS but the domain after d= is something other than yours, the signature isn't aligned, and you need to finish turning DKIM on. If SPF fails, check for a duplicate record or a typo. Test a second time from a different sending device if you can, to be sure nothing hidden is routing mail through another service.

This test only checks that your records work. It doesn't promise inbox placement, which also depends on your sending history, list quality and volume. See how to warm up a Gmail account for cold email for that side.

What to do if you use a custom domain

Everything above already assumes a custom business domain on Workspace. Two further cases come up. If your cold email goes out from a separate domain or subdomain, repeat all three steps for it, because each sending domain needs its own records. The trade-offs of doing that are discussed in can you send cold email from your main business domain.

If your mail is hosted somewhere other than Google, the idea is the same but the steps differ. Your provider's help pages will show the SPF include and where to generate the DKIM key. Don't copy Google's values into a domain that isn't sending through Google.

Rocketship sends through your own Gmail account, so the records you set up above are the ones that matter. Set them once, check them with the test in the last step, and every message it sends on your behalf carries them. See the Rocketship connector for Claude and the AI workers for how it runs. For the rest of the cold-email basics, read how to send cold email that is not spam.

Authentication is dull to set up and costly to skip. Rocketship finds the buyers, emails them from your own Gmail, follows up, and books the meeting on its own. Plans that get you customers start at $24.99 a month (Launch), and every monthly plan starts with a 7-day free trial, card required.