Email Sending Infrastructure: SPF, DKIM, DMARC, and Choosing Your Engine

Before you write a single subject line, your sending infrastructure needs to be right. This guide covers how to choose the correct sending approach for your use case, set up the three DNS authentication records every sender needs, what SimpleSend sets up for you, and how to verify your configuration before you go live.

The two sending approaches

There are two fundamentally different ways to send email at scale, and they serve different purposes. Using the wrong one for your use case will hurt your deliverability and, in some cases, get your account suspended.

For cold outbound, individual sending is the right approach, and there are two paths to it. Send from SimpleSend, which drafts your emails and sends them from warmed mailboxes on domains registered in your name. Or export the drafts as a CSV to Smartlead, Instantly, Apollo, HubSpot or the sender you already run. Either way, send cold email from dedicated, authenticated domains, never your main one, and warm them first.

Approach 1: Bulk sending (Mailchimp, SendGrid)

Bulk ESPs (Email Service Providers) are built for sending large volumes from a shared or dedicated IP to people who have opted in to hear from you. They handle list management, unsubscribe processing, and compliance tooling out of the box.

The most widely used platforms:

• SendGrid by Twilio: developer-first, strong API, good deliverability at high volume.
• Mailchimp: beginner-friendly, all-in-one marketing automation.
• Klaviyo: built for e-commerce with deep behavioral triggers.
• Brevo (formerly Sendinblue): affordable starting point with solid feature coverage.

On shared IP plans, your sender reputation is partly influenced by other users on the same IP pool. Dedicated IPs are available at higher volume tiers (typically 100k+ emails/month on SendGrid Pro) and give you full control over your reputation.

Approach 2: Individual account sending

This is the modern outbound sales approach. Rather than one domain blasting thousands of emails, you use multiple individual Google Workspace or Microsoft 365 mailboxes, each sending 20 to 40 cold emails a day. Each email looks and behaves like a real person sent it, because technically one did.

The math still works in your favor: 10 warmed mailboxes at 25 cold sends a day is 250 targeted emails a day, or roughly 5,000 a month on weekdays. Spread across enough mailboxes, you can run serious outbound volume without any single mailbox sending at suspicious levels.

Tools for running multi-inbox outbound:

• SimpleSend Sequences: domains, mailboxes, warmup, pacing and one reply inbox, in the same app that researches and drafts your emails.
• SmartLead: multi-inbox management, built-in warmup, per-inbox analytics.
• Instantly.ai: similar feature set, large warmup network.
• Lemlist: image and video personalization per contact.
• Woodpecker: strong CRM integrations, good for smaller teams.

Sending limits matter. Keep each mailbox to 20 to 40 cold sends a day, 4 to 9 minutes apart. SimpleSend defaults to 25 a day per mailbox, ramps new mailboxes over their first two weeks of sending (you can change the ramp per mailbox), and never goes past 40. Smartlead and Instantly have similar controls.

DNS authentication: what you need and why

When a receiving mail server gets an email from your domain, it checks three DNS records to decide whether to trust the message. Skipping any of them increases the chance your emails hit spam, and missing DKIM or DMARC is a common reason technically correct emails fail deliverability tests.

All three records are required. They work together: SPF and DKIM provide authentication signals, DMARC sets the enforcement policy and ties them together under your domain.

Setting up SPF

An SPF record is a TXT record added to your domain's DNS at the root level (i.e., on yourdomain.com, not a subdomain). It lists the mail servers permitted to send on your behalf.

Example SPF record for a domain using Google Workspace and SendGrid:

v=spf1 include:_spf.google.com include:sendgrid.net ~all

Breaking down each part:

• v=spf1: declares this is an SPF record.
• include:_spf.google.com: authorizes Google's servers to send for you.
• include:sendgrid.net: authorizes SendGrid's servers.
• ~all: soft fail for anything not listed. Use -all (hard fail) once you are confident your record covers all your senders.

Verify your SPF record with MXToolbox's SPF checker or the Google Admin Toolbox.

Setting up DKIM

DKIM uses a public/private key pair. Your mail server signs outgoing messages with the private key. The public key lives in DNS. Receiving servers use the public key to verify the signature matches, confirming the email was not tampered with after leaving your server.

Every major email platform generates a DKIM key for you during setup. The process is roughly the same across providers:

1. 1Go to your email platform's authentication settings.
2. 2Generate or locate your DKIM public key.
3. 3Add it as a TXT record in DNS at selector._domainkey.yourdomain.com.
4. 4Return to the platform and verify the record is detected.

The record looks like this (values abbreviated):

Type:  TXT
Name:  google._domainkey.yourdomain.com
Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhki...

For Google Workspace, DKIM is enabled in Admin Console > Apps > Google Workspace > Gmail > Authenticate email. Full instructions are in Google's DKIM setup guide. Microsoft 365 has an equivalent in the Microsoft 365 Admin Center under Email authentication settings.

For SmartLead users connecting Gmail or Outlook accounts: DKIM is handled at the Google or Microsoft level for that account's domain. You do not configure it in SmartLead directly. For domains bought in SimpleSend, DKIM is generated and published for you.

Setting up DMARC

DMARC sits on top of SPF and DKIM. It tells receiving servers what to do when an email fails either check, and it sends aggregate reports to an email address you specify so you can monitor your domain's authentication results.

A basic DMARC record looks like this:

Type:  TXT
Name:  _dmarc.yourdomain.com
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; pct=100

The key parameters:

• p=none: monitoring mode. No action taken on failing messages, but reports are generated. Start here.
• p=quarantine: failing emails go to spam. Move to this after 2 to 4 weeks of clean reports.
• p=reject: failing emails are blocked entirely. This is the end goal once you are confident in your setup.
• rua=: where to send aggregate reports. These are daily XML summaries from major providers.
• pct=100: apply the policy to 100% of failing messages.

Configuring your sending engine

For bulk sending (Mailchimp / SendGrid)

Both platforms walk you through domain authentication during onboarding. Complete every step, including the DKIM portion. A few additional settings are worth attention:

• Use a subdomain for marketing email. Send from mail.yourdomain.com or news.yourdomain.com instead of your root domain.
• Set up a custom tracking domain. By default, tracked links route through the ESP's generic domain (like track.sendgrid.net). Spam filters notice this.
• If you are on a dedicated IP, warm it up. Shared IP plans are pre-warmed. Dedicated IPs start cold. Ramp volume gradually over 4 to 6 weeks.

For SimpleSend Sequences

Most of the setup is done for you. Here is what SimpleSend handles and what is left to you.

• Domains. Pick lookalike domains in the app. They're registered in your name, send visitors on to your main site, and get SPF, DKIM and DMARC automatically.
• Mailboxes. Google or Microsoft, up to 5 per domain (3 is the recommended number). Pro includes 1 domain and 3 Google mailboxes, as does each Teams seat; on Individual, sending comes with the Email Sending add-on ($49.99/mo).
• Warmup. Automatic: about 2 weeks for Google mailboxes and 3 for Microsoft. Each mailbox shows Warming, then Ready, and warmup keeps running after that.
• Pacing. Weekdays 8am to 5pm in each mailbox's time zone, 4 to 9 minutes between sends, 25 cold sends per mailbox a day by default (you can raise it to 40). New mailboxes ramp at 10 a day, then 18, over their first two weeks of sending (or on a ramp you set per mailbox), and poor mailbox health slows or pauses sending.
• What you set. Your business mailing address (in Sequences → Settings; it's printed under every signature) and a signature for each mailbox (on its page under Mailboxes). Nothing sends without both.

For individual account sending in other tools (Smartlead, Instantly)

Setup here is more hands-on because you are managing multiple inboxes and domains rather than one account with one sending address.

• Register alias domains. Do not use your primary business domain for cold outreach.
• Use Google Workspace or Microsoft 365. Free Gmail addresses have lower trust with inbox providers. Business accounts on paid plans perform significantly better.
• Configure SPF, DKIM, and DMARC on every sending domain. Each alias domain needs its own records.
• Warm up every inbox before sending campaigns. See the warmup guide for the full schedule.
• Cap cold sends at 20 to 40 per day per mailbox. Use randomized intervals of 4 to 9 minutes.

Pre-launch checklist

Before sending your first campaign, confirm every item below is complete. DNS authentication issues are the leading cause of deliverability problems for new senders. Items marked automatic are handled for you when you send from SimpleSend.

• SPF record is published and validated (MXToolbox confirms passing)Automatic in SimpleSend
• DKIM key is generated, published in DNS, and verified by your email platformAutomatic in SimpleSend
• DMARC record is live at _dmarc.yourdomain.com (start with p=none)Automatic in SimpleSend
• Sending domain is not your primary business domainAutomatic in SimpleSend
• Mailbox warmup is complete (about 2 weeks on Google and 3 on Microsoft with a slow ramp after, or 3 to 4 weeks on the conservative schedule)Automatic in SimpleSend
• Daily cold-send limit is set per mailbox (20 to 40)Automatic in SimpleSend
• Business mailing address is set (it goes in every email's footer) and every sending mailbox has a signature. SimpleSend won't send without both
• Inbox placement test run and email landing in Primary inbox, not Spam
• Unsubscribe mechanism is in place on every email (required by CAN-SPAM)Automatic in SimpleSend
• Hard bounce removal is configured (automatic in most platforms)Automatic in SimpleSend

Tools reference