DeliverabilityAuthentication

SPF, DKIM, DMARC and BIMI: A Plain-English Setup Guide for Cold Email

Nestmarketing Team · · 2 min read

If your cold emails land in spam, the first place to look is not your copy. It is your DNS. Mailbox providers like Gmail and Outlook check four records before they decide whether to trust you.

SPF: who is allowed to send

SPF (Sender Policy Framework) is a TXT record that lists the servers allowed to send email for your domain.

TXT  @  "v=spf1 ip4:203.0.113.10 include:_spf.google.com -all"
  • ip4: your dedicated sending IP
  • include: any service that sends on your behalf
  • -all tells receivers to reject anything not listed

Keep SPF under 10 DNS lookups. Every include: counts, and going over breaks SPF silently.

DKIM: proof the message wasn't changed

DKIM adds a cryptographic signature to every email. Your server signs with a private key; receivers check it against the public key in DNS.

TXT  s1._domainkey  "v=DKIM1; k=rsa; p=MIIBIjANBgkqh..."

Use a 2048-bit key and a unique selector (s1, s2) per sending platform so you can rotate keys without downtime.

DMARC: what to do when checks fail

DMARC ties SPF and DKIM to the domain your recipient actually sees in the From line, and tells providers what to do with failures.

TXT  _dmarc  "v=DMARC1; p=quarantine; rua=mailto:[email protected]; pct=100"

Start at p=none for one or two weeks while you read the reports, then move to quarantine, and finally reject once every legitimate source passes.

BIMI: your logo in the inbox

BIMI shows your brand logo next to your emails in supported inboxes. It needs DMARC at quarantine or reject, plus a square SVG logo in the Tiny PS format.

TXT  default._bimi  "v=BIMI1; l=https://yourbrand.com/logo.svg"

Quick checklist

Record Host Must pass before sending?
SPF @ Yes
DKIM selector._domainkey Yes
DMARC _dmarc Yes (start with p=none)
BIMI default._bimi Optional, builds trust

Authentication gets you through the door. Warm-up and sending discipline keep you there.

Every Nestmarketing setup ships with all four records configured and verified on every sending domain. If you want us to audit yours, book a free consultation.

Related articles