Cold email: the minimum setup (SPF, DKIM, DMARC, one click unsubscribe)

Before your first cold email, publish an SPF record, turn on DKIM signing, publish a DMARC record (policy none is enough to start), make sure the unsubscribe mechanism works, and start with a low daily volume that grows slowly. Google's sender guidelines require the first three for bulk senders and a spam rate below 0.30%, and mailbox providers judge small senders by the same signals.

This is the short version of a longer subject. If you want the line by line table of what Google and Yahoo state, read the Google and Yahoo bulk sender rules. This post is the order of work: what to do first, how to check it and what is not your job.

What does each record do?

Three DNS records and one header carry most of the weight.

• SPF lists the servers that may send mail for your domain. Google says to publish an SPF record that includes all senders for your domain, and notes that senders missing from it are more likely to be marked as spam.
• DKIM puts a cryptographic signature on each message so the receiver can check it was not changed and came from your domain. Google says that sending to personal Gmail accounts requires a key of 1024 bits or longer, and recommends 2048 bits where your provider supports it.
• DMARC tells receivers what to do when SPF and DKIM do not line up with the From address, and where to send reports. Google says to publish a DMARC record and that the policy can be set to none. Yahoo says at least p=none, with a reporting address strongly recommended.
• One click unsubscribe is two headers, List-Unsubscribe and List-Unsubscribe-Post, that let the mail client offer an unsubscribe button. Both providers word the rule for marketing and subscribed messages.

The sender guidelines also ask you to keep the spam rate reported in Google's Postmaster Tools below 0.30%, and Google advises staying under 0.10%.

In what order should you set them up?

Order matters because each step depends on the one before it.

1. Pick the domain and mailboxes. Decide which domain sends and which people send. Changing this later resets your reputation.
2. Publish SPF. One SPF record per domain, listing every service that sends as that domain. Two SPF records break each other.
3. Turn on DKIM. Your mailbox provider, such as Google Workspace or Microsoft 365, generates a key. You publish it as a DNS record, then switch signing on in the admin console.
4. Publish DMARC with p=none. Add a reporting address and read the reports for two weeks. They show who sends mail as your domain, including services you forgot.
5. Check the result. Send a test message to a mailbox at another provider and open the full headers. Look for pass next to SPF, DKIM and DMARC. Fix anything that says fail or neutral.
6. Set up the unsubscribe. In Sellinger this is a per mailbox setting that adds an unsubscribe line and the standard one click headers. It is off by default, so switch it on for cold email.
7. Ramp the volume. Start low and raise it in steps, as described below.

If your mail goes through Google Workspace or Microsoft 365, the transport lines of the guidelines, such as reverse DNS and TLS, are handled by the provider. The lines that stay with you are the records on your own domain, the unsubscribe mechanism and your complaint rate.

How do you check that it worked?

Do not trust a green tick in a dashboard. Check three things yourself.

• A header test. The message headers should show SPF, DKIM and DMARC as pass for the From domain.
• The unsubscribe link. Click it from a test mailbox. It should work without logging in, and the contact should stop receiving mail.
• The reports. After a week, DMARC reports should show your sending services passing. A service you do not recognise sending as your domain is a problem to solve before anything else.

Google also offers Postmaster Tools for domains that send enough mail to a Gmail audience. Small senders often see no data there, and that is normal.

What is the ramp?

Mailbox providers have no history for a new mailbox, so a sudden volume looks like abuse. Sellinger defaults to 50 sends a day per mailbox. An optional warm up starts at 5 a day and doubles every 3 days up to the limit: 5, 10, 20, 40, then 50. The daily limit is set per account and the agent cannot exceed it.

The ramp is only a part of the answer. Reputation comes from what people do with your mail: reply, ignore, delete or report. A small list of the right people with a plain message will do more for you than a perfect warm up with a careless list.

What is not your job here?

Sellinger is not a deliverability product. It does not sell inbox placement, domain monitoring or dedicated sending infrastructure, and this post is editorial, not a feature list. What the platform does around the text is narrower: it checks the suppression list before every send and refuses the send if the contact is on it or the check cannot be completed. Automatic replies, no reply senders and satisfaction surveys are marked as machine mail and never count as a human reply. The details are in the cold email rules we enforce.

Does the setup matter if the message is good?

Yes, and the reverse is also true. In the Shelly installer programme, 3,940 installers were emailed in 111 countries and 13.6% replied in the June to August waves, against 3.3% for the first email alone. That result came from a short, specific email and two follow ups to a base that knew the brand. A clean setup does not create that result, but a broken one can bury it. See the case study for the context, which was a listening programme to an existing partner base and not a cold sales campaign.

What about warming up the mailbox?

Warm up means starting with a small number of messages and raising it in steps, so that the mailbox builds a history. Sellinger offers it as an optional setting per mailbox, starting at 5 a day and doubling every 3 days up to the limit. Some tools sell a separate warm up network that exchanges mail between mailboxes. We do not offer that, and we have no data on whether it helps, so we make no claim either way.

Whatever you choose, watch two signals in the first two weeks: the share of messages that bounce, and the replies that say "who is this?" or "remove me". Both are cheaper to fix at 20 messages a day than at 200. A list with many bounces needs verifying before more sending, and a list with many confused replies needs a clearer first line.

A checklist

• [ ] One SPF record that lists every sending service.
• [ ] DKIM is signing, with a 2048 bit key if the provider supports it.
• [ ] DMARC is published with a reporting address.
• [ ] A header test shows SPF, DKIM and DMARC pass.
• [ ] The unsubscribe line and one click headers are on, and I tested the link.
• [ ] The first week is at a low volume that grows in steps.
• [ ] My list is small enough that I could read every name.