cold-outreach

Cold Outreach

Workflow

1. Deliverability Setup

Do this BEFORE sending a single email. Skipping this = spam folder.

DNS records (required) — publish only the ESP you actually send through. Do not copy a multi-include SPF "starter" record; each include: costs DNS lookups (SPF hard-fails at 10 lookups per RFC 7208) and an unused include both wastes a lookup and authorizes a sender you don't use.

# SPF — pick ONE example matching your ESP. Use ~all (softfail) while warming, -all once stable.
# Google Workspace:   v=spf1 include:_spf.google.com ~all
# SendGrid:           v=spf1 include:sendgrid.net ~all
# Microsoft 365:      v=spf1 include:spf.protection.outlook.com ~all
# Amazon SES:         v=spf1 include:amazonses.com ~all
# Most cold-email senders (Instantly/Smartlead) ship a dedicated domain — use the
# exact SPF/DKIM strings from THEIR setup wizard, not the strings above.

# DKIM — your ESP generates the keypair and gives you the exact TXT record + selector.
# Publish it verbatim. Prefer a 2048-bit key. Example selector:
sg._domainkey.example.com  TXT  "v=DKIM1; k=rsa; p=MIGfMA0GCSq..."   # value from ESP

# DMARC — start at p=none with reporting; tighten only after SPF+DKIM align cleanly for ~2 weeks.
_dmarc.example.com  TXT  "v=DMARC1; p=none; rua=mailto:[email protected]; fo=1"

Alignment, not strictness. DMARC passes on relaxed alignment by default (org-domain match), which is all Gmail/Yahoo require. Do not reflexively set aspf=s; adkim=s — strict mode breaks legitimate setups where the ESP signs with a subdomain or rewrites the envelope (common with shared sending domains). Leave alignment relaxed (the default) unless you control every signing surface and have a specific spoofing reason.

Verify before you send (run these; don't trust the dashboard alone):

dig +short TXT example.com                         # SPF: exactly one v=spf1 record, <10 includes
dig +short TXT sg._domainkey.example.com           # DKIM: your selector resolves to v=DKIM1 ...
dig +short TXT _dmarc.example.com                   # DMARC: v=DMARC1; p=...; rua=...
# Count SPF lookups (must stay <=10):
dig +short TXT example.com | grep -o 'include:' | wc -l
# End-to-end: send one message to a Gmail account, open "Show original" → expect
#   SPF: PASS,  DKIM: PASS,  DMARC: PASS

If you use a click/open tracking domain, host it as a CNAME on a subdomain you control (e.g. track.example.com) and confirm it isn't on a blocklist — a shared/blacklisted tracking domain tanks deliverability even when auth passes.