J
Jeanus
Help centre
⌕
All articlesContact support
Help/AI SDR agent

Authenticate your email before auto-send (SPF, DKIM, DMARC)

Set up SPF, DKIM and DMARC on your sending domain so cold email lands in the inbox, not spam. Includes how to test it.

Updated 27 July 2026

When you turn on auto-send, the agent fires cold email from your own domain through your connected inbox. For those emails to reach the inbox instead of the spam folder, your domain needs three email authentication records: SPF, DKIM and DMARC. This is a one-time setup at your DNS provider and it takes about ten minutes plus propagation time.

Do this before you switch on auto-send.Sending cold email from an unauthenticated domain trains the big providers to distrust you, and that reputation is slow to repair. Get the three records green first, then enable automatic sending.

What the three records do

  • SPF - lists the servers allowed to send for your domain. For Microsoft 365 this is a TXT record containing include:spf.protection.outlook.com.
  • DKIM - cryptographically signs each message so the recipient can verify it was not forged or altered. Published as two CNAME records that point at your mail provider.
  • DMARC - tells receivers what to do if SPF or DKIM fail, and where to send reports. A TXT record at _dmarc.yourdomain, for example v=DMARC1; p=quarantine;.

Setting up DKIM on Microsoft 365 / Outlook

SPF and DMARC are usually already present if your email is on Microsoft 365. DKIM often is not - here is how to enable it:

  1. Go to the Microsoft Defender portal (security.microsoft.com) → Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM.
  2. Select your domain and click Create DKIM keys. Microsoft shows you two CNAME records (selector1 and selector2). Copy them exactly.
  3. Add both CNAMEs at your DNS provider (GoDaddy, Cloudflare, etc). The host is selector1._domainkey and selector2._domainkey; the value is the target Microsoft gave you.
  4. Wait for DNS to propagate (usually minutes, up to a few hours), then return to the DKIM page and switch the domain to Enabled.
Copy the target Microsoft shows you, character for character.The exact hostname format changes over time, so trust the value in the portal over any example. A single wrong or missing character (a dropped letter in a selector) means the record never resolves and DKIM stays stuck on “CnameMissing”. If it will not enable, re-check both records against the portal, then give DNS an hour to catch up.

Testing that it works

Once the records are in, confirm a real message passes before you rely on it. The simplest check:

  1. From your connected inbox, send any email to check-auth@verifier.port25.com.
  2. Within a minute or two you get an automated reply with a full report.
  3. Look for SPF check: pass, DKIM check: pass and DMARC: pass.

A free alternative is mail-tester.com, which gives your message a score out of ten and lists anything missing. Either one confirms the setup end to end.

If you use a different email provider

The concepts are identical for Google Workspace or any other provider - only the exact record values differ. Your provider's admin docs give you the SPF include and the DKIM keys to publish; DMARC is the same TXT record regardless of provider. Once all three pass the test above, you are clear to turn on auto-send.

Related