OutreachSheet
Deliverability

How to keep cold email out of spam: SPF, DKIM and DMARC.

Since 1 February 2024, Google requires every sender to authenticate their domain with SPF or DKIM, send over TLS, and keep their spam rate below 0.3%. Senders of more than 5,000 messages a day to Gmail must also set up DMARC and one-click unsubscribe. Meeting the rules is necessary, not sufficient: what you send, and to whom, decides the rest.

Figures and rules on this page come from the official sources linked below, checked on 17 October 2026. They can change without notice, so check the source before relying on them.

Google’s sender requirements (Gmail Help, 17 October 2026)
RequirementAll sendersBulk senders (5,000+ a day to Gmail)
SPF or DKIMRequired (DKIM keys at least 1024 bits)Both SPF and DKIM required
DMARCNot requiredRequired (policy may be “none”); From domain must align
Spam rate in Postmaster ToolsBelow 0.3%; aim for under 0.1%Same
TLS, valid PTR records, RFC 5322 formatRequiredRequired
One-click unsubscribeNot requiredRequired for marketing messages, plus a visible link

What the records do

  • SPF lists the servers allowed to send for your domain.
  • DKIM signs each message so the receiver can check it wasn’t altered and really came from your domain.
  • DMARC tells receivers what to do when SPF or DKIM fails, and sends you reports.

If you send from a Google Workspace address on your own domain, Google’s admin console generates the DKIM key; SPF and DMARC are TXT records you add at your domain registrar.

Habits that matter as much as the records

  • Start slowly on a new domain or mailbox and increase volume gradually.
  • Send plain, personal messages to people with a real reason to hear from you.
  • Clean the list: bounces from guessed or old addresses hurt your reputation.
  • Make opting out easy, and never email someone who asked you to stop.
  • Stay well within daily limits (see Gmail sending limits).

How OutreachSheet helps

Its domain check reads your SPF, DKIM and DMARC records and shows what to fix. It sends plain email from your own account in small, irregular batches during your chosen hours, with no tracking pixel, and keeps a permanent Do Not Contact list. No tool can promise inbox placement.

Sources

Related reading