Cold Email Authentication Setup Guide

Complete step-by-step guide to setting up SPF, DKIM, and DMARC for cold email tools like Instantly, Smartlead, Email Bison, and Lemlist.

Cold Email Authentication Setup Guide

Cold email requires proper authentication to succeed. This guide walks you through setting up SPF, DKIM, and DMARC specifically for cold email tools like Instantly, Smartlead, Email Bison, Lemlist, and others.

Why Authentication Matters for Cold Email

The Cold Email Challenge

Cold email faces unique obstacles:

  • No prior relationship with recipients
  • Higher spam scrutiny from providers
  • Stricter filtering than transactional email
  • Reputation starts at zero
  • Volume requirements for scale

Without proper authentication:

  • 70% to 90% of emails rejected
  • 5% to 15% inbox placement rate
  • Campaigns fail before they start

With proper authentication:

  • 80% to 95% inbox placement rate
  • 16x to 19x improvement in delivery
  • Campaigns can scale successfully

Pre-Setup Checklist

Domain Strategy

Option 1: Dedicated Subdomain (Recommended)

Benefits:

  • Isolated reputation from main domain
  • Better for cold email
  • Easier to manage
  • Protects main domain

Example:

  • Main domain: yourcompany.com
  • Cold email domain: sales.yourcompany.com or outbound.yourcompany.com

Option 2: Separate Domain

Benefits:

  • Complete isolation
  • No risk to main domain
  • Best for high volume

Considerations:

  • Additional domain cost
  • More management overhead

Tool Selection

Choose your cold email tool:

  • Instantly.ai
  • Smartlead.ai
  • Email Bison
  • Lemlist
  • Outreach.io
  • Reply.io
  • Woodpecker
  • Other: _______________

Step-by-Step Setup

Step 1: Add Domain to Your Cold Email Tool

Process:

  1. Log into your cold email tool dashboard
  2. Navigate to Domain Settings or Email Settings
  3. Click "Add Domain" or "Verify Domain"
  4. Enter your domain (e.g., sales.yourdomain.com)
  5. Follow tool's domain verification process

What You'll Need:

  • Domain name
  • DNS access
  • Email address for verification (if required)

Step 2: Configure SPF Record

Get SPF Include from Tool

Each tool provides an SPF include statement:

Instantly.ai:

include:spf.instantly.ai

Smartlead.ai:

include:spf.smartlead.ai

Email Bison:

include:spf.emailbison.com

Lemlist:

include:spf.lemlist.com

Outreach.io:

include:spf.outreach.io

Reply.io:

include:spf.reply.io

Woodpecker:

include:spf.woodpecker.co

Build Your SPF Record

Single Tool:

v=spf1 include:spf.instantly.ai -all

Multiple Tools:

v=spf1 include:spf.instantly.ai include:spf.smartlead.ai -all

With Other Services:

v=spf1 include:_spf.google.com include:spf.instantly.ai -all

Add to DNS

DNS Record Details:

  • Type: TXT
  • Host: @ or leave blank (root domain)
  • Value: Your complete SPF record
  • TTL: 3600 (1 hour) or default

Important:

  • Only ONE SPF record per domain
  • Keep DNS lookups under 10
  • Use -all for production (not ~all or +all)

Verify SPF Setup

Using MXToolbox:

  1. Go to https://mxtoolbox.com/spf.aspx
  2. Enter your domain
  3. Verify record is detected
  4. Check lookup count

Using MailSentinel:

  1. Add domain to MailSentinel
  2. Run DNS scan
  3. Verify SPF record detected
  4. Check validation status

Step 3: Configure DKIM

Get DKIM Records from Tool

Each tool generates DKIM keys:

Process:

  1. In tool dashboard, find DKIM settings
  2. Tool generates keys automatically
  3. Copy DNS records provided
  4. Records look like:
Host: instantly._domainkey
Type: TXT
Value: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC...

Add DKIM Records to DNS

For Each Tool:

  • Add TXT record with provided hostname
  • Add TXT record with provided value
  • Wait for DNS propagation (15-60 minutes)

Example DNS Records:

Instantly:

Host: instantly._domainkey
Type: TXT
Value: v=DKIM1; k=rsa; p=...

Smartlead:

Host: smartlead._domainkey
Type: TXT
Value: v=DKIM1; k=rsa; p=...

Email Bison:

Host: emailbison._domainkey
Type: TXT
Value: v=DKIM1; k=rsa; p=...

Verify DKIM Setup

In Tool Dashboard:

  • Most tools show verification status
  • Look for green checkmark or "Verified"
  • May take 15-60 minutes to verify

Manual Verification:

  1. Send test email
  2. Check email headers
  3. Look for DKIM-Signature header
  4. Verify signature is valid

Using Online Tools:

  • MXToolbox DKIM checker
  • MailSentinel DNS scan
  • DKIM validator tools

Step 4: Configure DMARC

Get MailSentinel Report Address

  1. Sign up for MailSentinel - Free 14-day trial
  2. Add your domain
  3. Go to Settings → DMARC Configuration
  4. Copy your report address: your-org-id@reports.mailsentinel.io

Create DMARC Record

Starting Policy (Monitoring):

v=DMARC1; p=none; rua=mailto:your-org-id@reports.mailsentinel.io

After Monitoring (Quarantine):

v=DMARC1; p=quarantine; rua=mailto:your-org-id@reports.mailsentinel.io; adkim=r; aspf=r

Full Protection (Reject):

v=DMARC1; p=reject; rua=mailto:your-org-id@reports.mailsentinel.io; ruf=mailto:your-org-id@forensic.mailsentinel.io; adkim=r; aspf=r

Add DMARC Record to DNS

DNS Record Details:

  • Type: TXT
  • Host: _dmarc
  • Value: Your complete DMARC record
  • TTL: 3600 (1 hour) or default

Important:

  • Record must be at _dmarc.yourdomain.com
  • Only ONE DMARC record per domain
  • Start with p=none for monitoring

Verify DMARC Setup

Using MailSentinel:

  1. Run DNS scan
  2. Verify DMARC record detected
  3. Check policy is correct
  4. Wait 24-48 hours for first reports

Using Online Tools:

  • MXToolbox DMARC lookup
  • DMARC analyzer tools
  • DNS checker tools

Tool-Specific Instructions

Instantly.ai

SPF:

  1. Add domain in Instantly dashboard
  2. Copy SPF include: include:spf.instantly.ai
  3. Add to your DNS SPF record

DKIM:

  1. Instantly generates keys automatically
  2. Copy DNS records from dashboard
  3. Add to your DNS
  4. Verify in Instantly (shows verification status)

DMARC:

  1. Set up MailSentinel monitoring
  2. Add DMARC record to DNS
  3. Monitor reports in MailSentinel
  4. Verify Instantly emails pass DMARC

Best Practices:

  • Use dedicated subdomain
  • Monitor DMARC reports weekly
  • Keep spam complaints below 0.3%
  • Warm up domain gradually

Smartlead.ai

SPF:

  1. Add domain in Smartlead dashboard
  2. Get SPF include: include:spf.smartlead.ai
  3. Add to DNS SPF record

DKIM:

  1. Smartlead provides DKIM keys
  2. Copy DNS records
  3. Add to your DNS
  4. Verify in Smartlead dashboard

DMARC:

  1. Configure DMARC monitoring
  2. Add DMARC record
  3. Monitor authentication status

Best Practices:

  • Verify domain ownership
  • Monitor bounce rates
  • Track engagement metrics
  • Maintain list hygiene

Email Bison

SPF:

  1. Domain settings in Email Bison
  2. Add SPF include: include:spf.emailbison.com
  3. Update DNS records

DKIM:

  1. Email Bison generates keys
  2. Copy DNS TXT records
  3. Add to your DNS
  4. Verify setup in dashboard

DMARC:

  1. Set up DMARC monitoring
  2. Configure DMARC policy
  3. Track authentication rates

Best Practices:

  • Use dedicated sending domain
  • Monitor deliverability metrics
  • Follow best practices
  • Maintain good reputation

Lemlist

SPF:

v=spf1 include:spf.lemlist.com -all

DKIM:

  1. Lemlist provides DKIM setup
  2. Add DNS records
  3. Verify configuration

DMARC:

  1. Set up DMARC monitoring
  2. Configure policy
  3. Track results

Outreach.io

SPF:

v=spf1 include:spf.outreach.io -all

DKIM:

  • Provided by Outreach
  • Add DNS records
  • Verify in dashboard

DMARC:

  • Configure separately
  • Monitor with MailSentinel

Reply.io

SPF:

v=spf1 include:spf.reply.io -all

DKIM:

  • Provided by Reply
  • Add DNS records
  • Verify setup

DMARC:

  • Configure separately
  • Monitor authentication

Woodpecker

SPF:

v=spf1 include:spf.woodpecker.co -all

DKIM:

  • Provided by Woodpecker
  • Add DNS records
  • Verify configuration

DMARC:

  • Configure separately
  • Monitor with MailSentinel

Verification Checklist

After setup, verify everything is working:

  • SPF record published and valid
  • DKIM records published and verified
  • DMARC record published
  • Tool shows domain verified
  • Test email sent successfully
  • Authentication headers present
  • DMARC passes in test email
  • MailSentinel receiving reports
  • No errors in tool dashboard
  • DNS propagation complete

Common Issues & Solutions

Issue: SPF Record Not Detected

Symptoms:

  • Tool shows SPF not configured
  • MXToolbox doesn't find record

Solutions:

  1. Wait 15-60 minutes for DNS propagation
  2. Verify record is at root domain (@)
  3. Check for typos in record
  4. Ensure only one SPF record exists
  5. Verify DNS provider saved correctly

Issue: DKIM Not Signing

Symptoms:

  • No DKIM signature in headers
  • Tool shows DKIM not verified

Solutions:

  1. Verify DNS records are published correctly
  2. Check selector matches tool's expectation
  3. Wait for DNS propagation
  4. Verify key format is correct
  5. Check tool's verification status

Issue: DMARC Failing

Symptoms:

  • DMARC reports show failures
  • Emails going to spam

Solutions:

  1. Verify SPF alignment
  2. Verify DKIM alignment
  3. Check From: domain matches
  4. Review DMARC reports for details
  5. Fix underlying SPF/DKIM issues

Issue: Tool Not Sending

Symptoms:

  • Emails not sending from tool
  • Authentication errors

Solutions:

  1. Verify domain is verified in tool
  2. Check SPF includes tool
  3. Verify DKIM is configured
  4. Check for DNS errors
  5. Contact tool support

Best Practices for Cold Email

1. Domain Warmup

Schedule:

  • Week 1: 10-20 emails/day
  • Week 2: 30-50 emails/day
  • Week 3: 75-100 emails/day
  • Week 4: 150-200 emails/day
  • Week 5+: Gradually increase

With Authentication:

  • Faster warmup possible
  • Better initial reputation
  • Higher success rates

2. List Quality

Requirements:

  • Valid email addresses only
  • No purchased lists
  • Regular list cleaning
  • Double opt-in preferred

Impact:

  • High bounce rates hurt reputation
  • Invalid addresses trigger filters
  • Poor lists = authentication failures

3. Content Quality

Best Practices:

  • Personalized messages
  • Relevant content
  • Clear value proposition
  • Professional tone
  • Avoid spam triggers

4. Monitoring

Key Metrics:

  • DMARC pass rate (target: 95%+)
  • Inbox placement (target: 80%+)
  • Open rate (target: 20%+)
  • Reply rate (target: 5%+)
  • Spam complaints (must be <0.3%)

Tools:

  • MailSentinel for DMARC
  • Google Postmaster for Gmail
  • Microsoft SNDS for Outlook
  • Tool analytics

Next Steps

After setting up authentication:

  1. Monitor DMARC Reports - Track authentication status
  2. Set Up Alerts - Get notified of issues
  3. Review Best Practices - Optimize your setup
  4. Troubleshoot Issues - Fix any problems

Additional Resources

Start Monitoring Your Cold Email Authentication →