SPF, DKIM and DMARC: the only setup guide cold senders need

Authentication is not a deliverability trick. It is the baseline claim that you are allowed to send on behalf of a domain, and mailbox providers treat a missing or misaligned record as a reason to distrust everything else about the message.

SPF publishes the list of servers permitted to send for your domain. It answers one question — did this message leave an approved server — and nothing else. It breaks on forwarding, which is why it is never enough on its own.

DKIM signs the message with a private key so the receiver can verify, using your published public key, that the headers and body were not altered in transit. Because the signature travels with the message, DKIM survives forwarding where SPF does not.

DMARC ties the two together with alignment: the domain in the visible From header must match the domain that passed SPF or DKIM. This is where most cold email setups fail — the records exist, but they authenticate a sending subdomain that does not align with the From address.

Start every domain at p=none with reporting enabled, read the aggregate reports for a week of real sending, and only then move to quarantine. When zalamails provisions your mailboxes, all three records are written and verified before the first send, so the domain starts from a clean, aligned state.