Your cold emails land in spam. It's almost never your copy.
You're rewriting the subject line for the tenth time. The real problem is underneath: DNS authentication and sending reputation. Here are SPF, DKIM, DMARC explained, and the records to copy.
You think your cold emails land in spam because of your copy. You rewrite the subject line, drop the word "free", test three openers. Nothing moves. The problem is almost never the text. It sits in a layer you never see: your domain's authentication and its sending reputation.
Since February 2024, Google and Yahoo require SPF, DKIM and DMARC for any inbox that sends volume. Without these three DNS records, your email never even reaches the content filter: it is dropped before that. Here are the three explained simply, and the exact records to copy.
- Spam comes from infrastructure, not copy: without SPF, DKIM and DMARC, you are filtered before the content is even read.
- SPF says which servers may send. DKIM signs the message to prove it wasn't altered. DMARC says what to do if both fail.
- Reputation: dedicated secondary domain, 2 to 4 week warmup, ~30 emails per inbox per day, bounces under 1%.
- The DNS records to copy and the pre-send checklist are below.
Why your email is judged before it's read
When your email reaches Gmail, the server asks three questions in a fraction of a second. Who claims to be sending it? Is that server allowed to? Was the message tampered with in transit? If the answers don't hold up, the email is filed as spam without the content filter ever running.
It's counterintuitive: you picture an algorithm reading the text and flagging suspicious words. In reality, the first barrier is purely technical. A perfectly written email from an unauthenticated domain loses to a mediocre email from a compliant one. Copy only counts once that barrier is cleared.
SPF, DKIM, DMARC: each in one sentence
Forget the jargon. Here is the one thing to remember about each, with an analogy that holds.
A DNS record declaring: "only these servers may send in my name". Like a guest list at the door. The receiving server checks the sender is on it.
Every email leaves with a cryptographic signature. The receiving server checks it against your public key (in DNS). If the message was changed in transit, the signature breaks. It's the wax seal on the envelope.
Tells the receiving server what to do when SPF or DKIM fails: do nothing (p=none), quarantine (p=quarantine), or reject (p=reject). And sends you reports to monitor who's spoofing your domain.
SPF says who can send. DKIM proves the message is intact. DMARC decides what to do when it fails. All three, or nothing.
The exact DNS records to add
Here is what the three records look like. You add them at your registrar (OVH, Gandi, Cloudflare), in the DNS zone of your sending domain. The SPF include values and the DKIM key are given to you by your sending provider: don't copy mine, they're there for shape only.
# SPF (TXT record, host "@" or domain root)
# Authorizes your sending servers. ONLY ONE SPF record per domain.
v=spf1 include:_spf.google.com include:sendgrid.net ~all
# DKIM (TXT record, host provided by your tool, e.g. "s1._domainkey")
# The public key. Copy the value from your provider EXACTLY.
s1._domainkey IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSq...YOUR_PUBLIC_KEY...QAB"
# DMARC (TXT record, host "_dmarc")
# Start with p=none to observe without blocking anything.
_dmarc IN TXT "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; fo=1"
# Once SPF + DKIM are aligned and verified (2 to 4 weeks):
_dmarc IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com"Three classic traps. One: only one SPF record per domain, or it's invalid. If you use several services, merge their include: into a single line. Two: the DKIM key is copied character for character, one extra space and it breaks. Three: start DMARC at p=none, watch the reports for two to four weeks, then move to p=quarantine. Going straight to p=reject can block your own legitimate emails.
Authentication gets you into the race. Reputation wins it.
Once all three records PASS, you're no longer dropped by default. But you're not in the inbox yet. The rest plays out on the reputation of your domain and IPs, built by your sending behavior.
Buy a domain close to your brand for cold outbound only. Never your primary domain: if reputation burns, your team and billing emails burn with it.
On a fresh domain, ramp volume gradually with exchanges that get replies. Cold email tools automate this warmup. A fresh domain blasted with 500 emails at once goes to spam for sure.
Stay around 30 emails per inbox per day for cold. To scale, multiply inboxes (several addresses, possibly several domains), never volume per inbox.
Verify every list before sending, keep bounces under 1%. An unverified list is the fastest way to destroy a reputation you spent a month building.
The signal providers watch most is engagement: do people reply, do they mark you as spam? Hence the direct link to targeting. A relevant email, sent to the right person, protects your deliverability. A bulk blast to a cold list destroys it, as Postmark's deliverability guide points out.
The checklist before you hit send
Run these seven points before every new campaign. If one fails, don't launch.
Open the demo campaigns and judge the lead quality yourself, no card required. Worst case, you lose ten minutes.
Where AutoLeads fits
None of the above requires AutoLeads, and above all, AutoLeads does not send your emails. DNS setup happens at your registrar, warmup and sending at Lemlist or Smartlead, with the tool you know. AutoLeads stops one step earlier: it finds leads in your niche, enriches them, then pushes them straight into your Lemlist campaign. Deliverability stays in your hands, we just bring you clean, targeted leads to send to.
If you remember one thing: before touching your subject line again, go read "Show original" on a test email. Three PASS, or nothing. The rest of your copy only counts after.
Frequently asked questions
How many emails can I send per inbox per day?
On a warmed, well-authenticated inbox, stay around 30 to 50 emails per day per address for cold outbound. This is not an official Google rule, it's the consensus across cold email tools (Lemlist, Smartlead) to avoid tripping spam filters. To send more, add inboxes, never volume per inbox.
What is warmup, and is it mandatory?
Warmup means ramping sending volume gradually over 2 to 4 weeks on a fresh domain, with exchanges that get replies, to build reputation. On a fresh domain that was never warmed, your first bulk sends go almost entirely to spam. Yes, it is mandatory for a recent domain.
Do I need a separate domain for cold email?
Yes. Never send cold outbound from your primary domain (the one for your invoices and your team). Buy a close secondary domain (for example yourbrand-mail.com) and send from it. If its reputation burns, your primary domain stays intact.
What bounce rate is acceptable?
Aim for under 1% bounces. Above 2 to 3%, providers read it as an unverified or purchased list, and your reputation drops. Verify every list before sending (NeverBounce, ZeroBounce, or your tool's built-in verification).
Are SPF, DKIM and DMARC enough to stop landing in spam?
No. Authentication is the entry ticket: without it, you are filtered by default since 2024. But once you're compliant, deliverability depends on reputation (reply rate, spam complaints, bounces) and volume. Authentication gets you into the race, it doesn't win it.
Do you need AutoLeads to apply all this?
No. DNS setup happens at your registrar, warmup and sending at Lemlist or Smartlead. AutoLeads finds and enriches leads, then pushes them into Lemlist. Sending and deliverability stay your domain, with the tool you know.