You can write the best cold email of your life and still end up in spam. Most of the time, the problem isn't the words. It's four small records in your domain's DNS settings that you set up once and forget about.
At WayneFlow, we run cold email for B2B companies, mostly in the USA and Canada. In 2026 our campaigns sent 588,000 emails and got 12,900+ replies. Every one of those emails went out from a domain with these four records in place. Here's what each one does and how to set it up.
A quick rule before we start
Don't set up cold email on your main business domain. Buy one to three secondary domains that look like your main one (for example, if your company is acme.com, you might use getacme.com or tryacme.com) and redirect them to your website. If a sending domain gets a bad reputation, your main domain, the one your clients and invoices use, stays safe.
Now, the four records. The examples below are for Google Workspace. Other email providers work the same way, but the values are different, so always copy the values from your provider's admin page.
1. MX: the record that lets you receive replies
An MX (mail exchange) record tells the internet where to deliver emails sent to your domain. Without it, nobody can reply to you, and an inbox that can't receive mail looks suspicious to spam filters.
For newer Google Workspace accounts, Google gives you a single MX record:
Type: MX
Host: @
Value: smtp.google.com
Priority: 1Older accounts may show a list of five records instead. Either is fine. Use whatever your Google Admin console shows.
2. SPF: the list of who is allowed to send for you
SPF (Sender Policy Framework) is a TXT record that lists the servers allowed to send email from your domain. When Gmail or Outlook receives your email, it checks whether the server that sent it is on your list.
Type: TXT
Host: @
Value: v=spf1 include:_spf.google.com ~allTwo common mistakes:
- Having two SPF records. You can only have one. If you use another sending service, add its "include" to the same record.
- Forgetting to update SPF when you add a new tool that sends email for you.
3. DKIM: the signature on every email
DKIM (DomainKeys Identified Mail) adds a hidden digital signature to every email you send. The receiving server checks the signature against a public key in your DNS. If it matches, the server knows the email really came from you and wasn't changed on the way.
In Google Workspace:
- Go to the Admin console, then Apps, Google Workspace, Gmail, Authenticate email.
- Choose your domain and generate a new record. Use a 2048-bit key if your DNS host supports it.
- Copy the TXT record Google gives you. The host is usually google._domainkey.
- Add it in your DNS, wait for it to take effect (it can take a few hours), then go back and click "Start authentication."
DKIM is the step people forget most. Don't skip it.
4. DMARC: the instructions for when something fails
DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receiving servers what to do if an email fails SPF and DKIM checks. It can also send you reports.
Type: TXT
Host: _dmarc
Value: v=DMARC1; p=none; rua=mailto:reports@yourdomain.comThe "p" part is your policy:
- p=none means "just monitor, don't block anything." Start here.
- p=quarantine means "send failing emails to spam."
- p=reject means "block failing emails completely."
Start with p=none. After a few weeks of everything passing, you can move to p=quarantine.
Why this matters more now
Since 2024, Google and Yahoo have required bulk senders to authenticate their email, and Microsoft announced similar rules for Outlook in 2025. Even if you don't send at that volume, inbox providers use the same signals to decide where your email goes. Missing records are one of the easiest ways to look like a spammer.
How to check your setup
Send an email from your new inbox to a personal Gmail account. Open it, click the three dots, and choose "Show original." You want to see:
SPF: PASS
DKIM: PASS
DMARC: PASSIf any of them says FAIL or is missing, go back and fix it before you send anything else.
What DNS records don't fix
These four records get you in the door. They don't make a brand-new inbox trusted. After the records are in place, you still need to:
- Warm up each inbox for about three weeks before real sending
- Fill in the inbox profile with a real name, photo and signature
- Verify your list so bounces stay low (ours run between 0.45% and 3.08%)
- Turn off open tracking, which adds a tracking pixel that can hurt deliverability
- Check inbox health every day
Get this right, and the rest of cold email gets much easier. When everything is tuned, our campaigns get reply rates between 2.8% and 4%, counted as replies divided by people contacted.
Want the full setup?
We wrote everything down in The WayneFlow Cold Email Playbook: the exact records, the 3-week warmup schedule, the 10-minute daily health check, list building, the 5-part cold email under 80 words, and 7 real case studies with dashboard screenshots. It's 35 pages and free.
Get the playbook here: the free playbook page
Syed Asim Hussain and Syed Ali Hassan run WayneFlow, a done-for-you B2B appointment setting agency for U.S. companies. Every number in this guide comes from campaigns we ran ourselves or from the sources linked. See our live dashboards.