Email deliverability for founders: SPF, DKIM, DMARC

Most cold email advice starts with copywriting. That is backwards. If your emails land in spam, the best first line ever written performs exactly as well as the worst one, because nobody sees either. Deliverability is the plumbing of outbound, and for founders sending from their own domain it is the part you have to get right first.

This guide covers the four things that decide whether your email reaches an inbox: authentication (SPF, DKIM, DMARC), domain reputation, warm-up, and volume. None of it requires a paid tool. All of it requires patience.

How mailbox providers decide where your email goes

When your message arrives at Gmail or Microsoft 365, the receiving server asks three questions:

1. Is the sender who they claim to be? This is authentication. SPF, DKIM, and DMARC exist to answer it cryptographically.
2. Does this sender have a history? This is reputation. It attaches to your domain and, to a lesser degree, your sending IP.
3. Do recipients seem to want this mail? This is engagement. Opens, replies, and "not spam" clicks help you; spam complaints and deletions without reading hurt you.

Fail the first question and you rarely get to the second. Since February 2024, Gmail and Yahoo require authenticated mail from bulk senders outright, and in practice they hold small senders to the same standard. Set up all three records before you send a single cold email.

SPF: who may send for your domain

SPF (Sender Policy Framework) is a DNS TXT record listing the servers allowed to send mail for your domain. When your email arrives, the receiver checks whether the sending server is on that list.

A typical record for a domain that sends through Google Workspace looks like this:

v=spf1 include:_spf.google.com ~all

Two rules founders trip over:

• One SPF record per domain. Two TXT records that both start with v=spf1 cause a permanent error. If you add a second sending service, merge it into the existing record as another include:.
• Stay under 10 DNS lookups. Every include: costs lookups. Pile in too many services and SPF starts failing with permerror. Remove services you no longer use.

The ~all suffix (softfail) is the safe default. Do not use +all; it tells the world anyone may send as you, which is worse than no record at all.

DKIM: proof the message was not altered

DKIM (DomainKeys Identified Mail) signs each outgoing message with a private key. The matching public key lives in your DNS, and receivers use it to verify that the message really came from your infrastructure and was not modified in transit.

You do not generate DKIM keys by hand. Your email provider does it; you copy the resulting record into DNS:

• Google Workspace: Admin console, then Apps, then Google Workspace, then Gmail, then Authenticate email. Generate the key, publish the TXT record, click activate.
• Microsoft 365: Defender portal, Email authentication settings, DKIM tab, enable signing for your domain and publish the two CNAME records it gives you.

Use a 2048-bit key where offered. After activating, send a test message to a Gmail address, open "Show original", and confirm you see DKIM: PASS with your domain next to it.

DMARC: the policy that ties it together

DMARC tells receivers what to do with mail that fails SPF or DKIM alignment, and it is the record Gmail and Yahoo now explicitly require for bulk senders. Start with a monitoring policy:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

p=none changes nothing about delivery yet. It gives you aggregate reports showing who is sending as your domain and whether authentication passes. After a few clean weeks, tighten to p=quarantine and eventually p=reject. A strict DMARC policy is one of the strongest trust signals a small domain can have, and it also stops other people from spoofing you.

Warm-up: reputation is earned, not configured

A brand-new domain, or an old domain that has never sent cold email, has no sending history. Mailbox providers treat history-less senders with suspicion, and a sudden burst of 200 emails from a silent domain is the classic spam signature. Warm-up is the practice of building history gradually.

What actually builds reputation:

• Real conversations. Replies are the strongest positive signal there is. In your first weeks, email people who will write back: customers, friendly founders, your existing network.
• Gradual ramp. Start with a handful of sends per day and increase weekly. A reasonable shape for a new domain looks like this:

• Consistency. Sending 20 a day every weekday builds a better profile than 100 every Friday. Providers score patterns, and spiky volume looks like a compromised account.

A note on automated warm-up networks, the tools that exchange fake positive engagement between member inboxes: Google's sender guidelines prohibit them, and Gmail has gotten measurably better at discounting that traffic. Some warm-up automation still helps on cold-start domains, but treat it as a supplement to real conversations, never a substitute. Moatify's own warm-up works on the ramp-and-monitor model: it paces your daily volume against your domain's measured health rather than simulating engagement.

Volume: how much is safe

The honest ceiling for one founder sending from one inbox on an established, authenticated domain is around 30 to 50 cold emails per day. That number surprises people who have read about SDR teams sending thousands, but those teams spread volume across many inboxes and domains, and their deliverability is usually worse than they think.

Why stay under 50:

• Complaint math is brutal. Gmail's spam-rate threshold is 0.3 percent, measured against your whole sending volume. At small volume, two complaints in a week can put you over it. Lower volume with better targeting keeps the ratio down.
• Quality degrades with quantity. Fifty genuinely researched emails a day is already a lot of research. Past that, personalization collapses into templates, reply rates fall, and the engagement signals that protect your reputation fall with them.
• Follow-ups count. If you email 25 new people a day and each gets two follow-ups over the next week, your actual daily send volume is roughly 75. Budget for the sequence, not the first touch.

This is why Moatify caps sending at 50 emails per day on every tier, including the highest one. It is not an artificial limit to upsell you past; it is the ceiling we believe a single sending identity can sustain without damaging the domain it sends from.

The pre-flight checklist

Before your first real campaign, verify all of this:

1. SPF record exists, contains only the services you use, and stays under 10 lookups.
2. DKIM signing is active, 2048-bit key, and a test to Gmail shows DKIM: PASS.
3. DMARC record published, at least p=none with reports flowing, tightened once clean.
4. A test email to your own Gmail lands in the inbox, and "Show original" shows SPF, DKIM, and DMARC all passing.
5. Your list is verified. Bounce rate above 2 percent burns reputation fast; validate addresses before sending, not after the bounces arrive.
6. Volume ramp planned: single digits daily on a new domain, holding under 50 even when established.
7. Every message has a working unsubscribe path and your real identity. CAN-SPAM and GDPR both apply to B2B outreach, and compliance signals also correlate with inbox placement.

Deliverability is not a one-time setup. Reputation drifts with every send, which is why the monitoring habit matters more than any single record. Check your DMARC reports weekly, watch your bounce and reply rates, and treat a sudden drop in replies as a spam-placement alarm, not a copywriting problem.

Get the plumbing right and the interesting work, the research and the writing, actually gets a chance to matter.