SPF, DKIM and DMARC for Recruiters: Cold Email Deliverability Basics

If your outreach emails keep landing in spam, the first thing to check is whether your domain is set up with SPF, DKIM and DMARC. These are three DNS records that prove an email really came from you. Without them, Gmail and Yahoo have little reason to trust you, and no amount of clever copywriting fixes that.

You don't need to be technical to get this right. You need about an hour, access to wherever your domain is managed, and a willingness to copy a few lines of text carefully.

What are SPF, DKIM and DMARC?

Think of them as three checks a receiving mail server runs on every message.

• SPF is a list of the servers allowed to send email for your domain. If a message arrives from a server that isn't on the list, it looks suspicious.
• DKIM is a digital signature added to each email. It shows the message wasn't altered on the way and that your domain authorised it.
• DMARC tells receivers what to do when SPF or DKIM checks fail, and sends you reports. It also requires the domain in your visible "From" address to line up (be "aligned") with the domain that passed SPF or DKIM.

Do I actually need all three?

Google's published sender requirements say all senders to personal Gmail accounts must set up SPF or DKIM, keep spam complaint rates reported in Postmaster Tools below 0.3%, and use valid forward and reverse DNS and TLS. Anyone sending 5,000 or more messages a day to Gmail must also use DKIM, publish a DMARC policy, align their From domain, and offer one-click unsubscribe on marketing mail.

Yahoo's sender guidance is similar: SPF or DKIM at a minimum for everyone, and for bulk senders both, plus a DMARC policy of at least "p=none". The page I read doesn't give a numeric threshold for what counts as bulk.

A recruiter sending a few dozen emails a day is nowhere near 5,000. But my advice is to set up all three anyway. It's free, it takes an hour, and it removes the most common reason a new sending address gets treated as suspect.

How do I set them up?

Here's the order I'd do it in. Exact screens differ by email provider and domain host, so follow your provider's own help pages for the specifics.

1. Find where your DNS is managed. It's usually your domain registrar or Cloudflare. This is where you'll add records.
2. Add SPF. It's one TXT record. For Google Workspace it typically looks like `v=spf1 include:_spf.google.com ~all`. Use the value your email provider gives you. If you send from more than one service, they all go into the same single record.
3. Turn on DKIM. Your email provider generates a key. You paste it into a DNS record, then switch signing on in the provider's admin panel.
4. Add DMARC. Start in monitoring mode so nothing gets blocked while you check things: `v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com`. The "rua" address receives summary reports.
5. Test it. Send an email to a Gmail address you control, open the message, choose "Show original", and look for SPF, DKIM and DMARC all showing PASS. Google also offers a free Admin Toolbox that checks a domain's records.

What are the common mistakes?

• Two SPF records. A domain must not publish more than one. The standard (see RFC 7208) says multiple records that would match cause problems. Merge them into one.
• Too many lookups. The same standard limits SPF to 10 DNS-querying terms. Stacking up "include:" lines for every tool you've ever tried can push you over, and then SPF fails outright.
• Never checking DMARC reports. "p=none" only monitors. It's a sensible start, but it isn't protection until you've reviewed who sends as your domain and tightened the policy.
• Sending from a different domain than the one you authenticated. If a tool sends on your behalf, make sure it signs with DKIM for your domain.

Is there more to deliverability than authentication?

Yes, and this is the part people skip. Authentication gets you through the door. What happens next depends on how recipients react.

Keep spam complaints well under Google's 0.3% line. Send only to people who plausibly hire for the roles you place. Write plain, human emails with one clear ask. Add a simple way to opt out. Ramp volume up gradually on a new mailbox rather than going from zero to hundreds overnight.

A practice many outbound teams follow, and one I'd suggest, is sending outreach from a separate domain, so any reputation damage doesn't touch the domain your clients use for everyday mail. That's a judgement call rather than a rule, and it means repeating the setup above for the second domain.

Pacing matters too. Some outreach tools, such as DCA Recruit, space out sends and stop following up when someone replies, which helps keep volume steady and complaints low. The tool matters less than the habit, though.

When this doesn't apply, or isn't enough

• Authentication doesn't make a bad list good. If you email people who have no reason to want your message, you'll earn complaints and your reputation will suffer however perfect your records are.
• Rules vary by country. Laws on unsolicited business email differ between the UK, UAE, EU and elsewhere. This isn't legal advice, so check the rules for where your recipients are.
• Providers change their requirements. Check the Google and Yahoo pages linked above periodically rather than trusting a post from a year ago, including this one.
• You may still need an expert. If you've set everything up and mail still goes to spam, a deliverability specialist can look at your actual sending history.

If you want the bigger picture on finding the right companies to email in the first place, see what actually works in AI lead generation, or read about AI for recruitment agencies.

Stuck on your setup or want a second pair of eyes? Get in touch.