You bought a sending domain, connected a mailbox, and started sending. Then half your emails vanished into spam and you had no idea why. Nine times out of ten, the problem is buried in your DNS records - the invisible plumbing that tells the world your domain is legit.
This guide walks through every record that matters for cold email, in order, in plain English. No jargon dumps. By the end you will know exactly what an MX record does, why SPF, DKIM and DMARC are non-negotiable, and how to check your setup before you send a single message.
What is an MX record and why does cold email need one?
An MX (Mail Exchange) record tells the internet which server receives email for your domain. For cold email, you need a valid MX record so that replies and bounces can actually come back to you - without it, receiving mail servers see a half-configured domain and treat you with suspicion.
Here is the thing people miss: cold email is two-way. You send, prospects reply, some addresses bounce. If your sending domain has no MX record, those replies have nowhere to land, and inbox providers notice the gap. A domain that can send but not receive looks like a throwaway spam domain - because that is exactly what spammers use.
When you set up a mailbox through Google Workspace or Microsoft 365, the provider gives you MX records to paste into your DNS. Add them exactly as specified, including the priority numbers. Priority just tells servers which mail host to try first (lower number = higher priority). Get these wrong and your replies quietly disappear.
No MX record means no replies, no bounces, and no trust. It is the first domino - set it before anything else.
What DNS records do you need for a cold email sending domain?
You need four core records: MX (receives mail), SPF (lists who can send for you), DKIM (cryptographically signs your mail), and DMARC (tells receivers what to do when checks fail). Skip any one of them and your inbox placement suffers.
Think of it as a chain of trust. Each record answers a different question a receiving server asks about your message:
- MX - "Where does mail for this domain go?"
- SPF - "Is this IP allowed to send for this domain?"
- DKIM - "Has this message been tampered with, and is the signature valid?"
- DMARC - "If SPF or DKIM fail, what should I do with the message?"
Google and Yahoo now enforce bulk sender requirements that make SPF, DKIM and DMARC effectively mandatory for anyone sending at volume. We cover the specifics in our Google and Yahoo bulk sender rules breakdown, but the short version is: authenticate properly or get filtered. There is no gray area anymore.
How does SPF work and how do you set it up?
SPF (Sender Policy Framework) is a DNS TXT record that lists every server allowed to send email on behalf of your domain. When a receiving server gets your message, it checks the sending IP against this list - if there is no match, that is a red flag.
A basic SPF record looks like this:
v=spf1 include:_spf.google.com ~all
The include pulls in the authorized servers for your mail provider. The ~all at the end means "soft fail" anything not listed - a safe default while you settle in. The single most common SPF mistake is having more than one SPF record on the same domain, which invalidates both. You get exactly one. If you use multiple sending tools, merge their include statements into a single record.
Also watch the ten-DNS-lookup limit. Every include counts, and chaining too many services blows past the cap, breaking SPF entirely. Keep it lean. If you want the deeper mechanics of all three auth records together, our SPF, DKIM and DMARC for cold email guide goes record by record.
What is DKIM and why does it matter for inbox placement?
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every email you send, published as a public key in your DNS. The receiving server uses that key to confirm the message really came from you and was not altered in transit.
Without DKIM, anyone can spoof your domain, and inbox providers know it - so unsigned mail gets penalized. Your mail provider generates a DKIM key and gives you a CNAME or TXT record (often at a selector like google._domainkey) to add to DNS. Publish it, wait for propagation, then send a test message and check the headers to confirm it reads dkim=pass.
DKIM is also what lets DMARC do its job. DMARC relies on "alignment" - the domain in your DKIM signature matching your visible From address. If those line up and DKIM passes, you clear the strongest signal in the chain.
How do you set up DMARC without hurting deliverability?
DMARC tells receiving servers what to do when a message fails SPF or DKIM: do nothing, quarantine it, or reject it. Start with a monitoring-only policy (p=none) so you collect reports without risking legitimate mail, then tighten gradually.
A starter DMARC record looks like this:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
The p=none means "monitor but do not act." The rua address receives aggregate reports showing who is sending as your domain and whether they pass authentication. Watch those reports for a couple of weeks, confirm your own mail passes cleanly, then step up to p=quarantine and eventually p=reject.
Do not jump straight to p=reject. If your SPF or DKIM has a gap you have not caught, a strict policy will bounce your own campaigns. We map the whole safe progression in our DMARC policy progression guide - follow it in order and you will never blackhole your own sends.
Should you send from your root domain or a subdomain?
Send cold email from a separate domain or subdomain - never your primary business domain. That way, if a sending domain takes reputation damage, it stays isolated and your main domain (with your website and normal business email) stays clean.
Most teams register lookalike domains close to their brand - think getcompany.com or trycompany.com - and send from mailboxes there. This is standard practice, and it is why we manage lookalike sending domains as a matter of course. The choice between a subdomain and a fully separate root domain has real trade-offs, which we unpack in subdomain vs root domain sending.
The point is separation. Your DNS records live on the sending asset, your reputation risk stays contained, and one bad week never takes down the email your customers rely on.
Your cold email DNS setup checklist
Run this before your first send. Every box should be ticked:
- MX record points to your mail provider with correct priority values.
- SPF record exists, is a single TXT record, and includes your sending provider.
- DKIM key is published and a test message returns
dkim=pass. - DMARC record is live, starting at
p=nonewith a reporting address. - Custom tracking domain is set up (avoid shared tracking domains that carry other senders' reputation).
- DNS has propagated - allow up to 48 hours and verify with a lookup tool.
- Warmup is running before any real campaign volume hits the mailbox.
That last point matters more than the rest combined. Perfect DNS on a cold mailbox still lands in spam if you skip warmup - which is why we never rush warmup and run a full 3-4 week ramp on every mailbox we manage.
Why do emails still go to spam with perfect DNS records?
Because DNS is necessary but not sufficient. Correct SPF, DKIM and DMARC get you to the starting line, but spam filters also weigh sending volume, warmup history, list quality, content, and engagement - one weak factor sinks the rest.
We see this constantly: someone nails their DNS, then blasts 200 emails from a brand-new mailbox with a spammy subject line and a raw purchased list. The records passed; the send still failed. Deliverability is a system, not a single fix. We cover the full picture in why cold emails go to spam and give you a pre-flight in our cold email deliverability checklist.
Volume discipline is part of it too. We cap each mailbox at around 25 emails per day and scale by adding mailboxes, not by hammering one address - the reasoning is in 25 emails per mailbox. Combine clean DNS, patient warmup, verified lists and sane volume and you get results like our own live campaigns: 98.7% inbox placement, a bounce rate near 0.8%, and a reply rate around 4.5%.
Let Moongie handle the plumbing
DNS records, warmup schedules, tracking domains, DMARC progression - this is the unglamorous infrastructure work that decides whether your campaign ever gets read. We operate it for you across 1,500+ managed mailboxes, and we never hand you a half-built setup to babysit yourself.
You tell us what you sell and to whom. We handle the cold email infrastructure, the deliverability monitoring, and the daily maintenance. Ready to skip the DNS headaches? Get in touch and we will size a setup to your goals.
Want this handled for you? Moongie runs managed cold email infrastructure, mixed email + LinkedIn outreach and high-converting landing pages. Book a free 30-minute strategy call - or win our playbook in the Inbox Run game.