Your cold emails land in spam. It's almost never your copy.
You're rewriting the subject line for the tenth time. The real problem is underneath: DNS authentication and sending reputation. Here are SPF, DKIM, DMARC explained, and the records to copy.
You think your cold emails land in spam because of your copy. You rewrite the subject line, drop the word "free", test three openers. Nothing moves. The problem is almost never the text. It sits in a layer you never see: your domain's authentication and its sending reputation.
Since February 2024, Google and Yahoo require SPF, DKIM and DMARC for any inbox that sends volume. Without these three DNS records, your email never even reaches the content filter: it is dropped before that. Here are the three explained simply, and the exact records to copy.
- Spam comes from infrastructure, not copy: without SPF, DKIM and DMARC, you are filtered before the content is even read.
- SPF says which servers may send. DKIM signs the message to prove it wasn't altered. DMARC says what to do if both fail.
- Reputation: dedicated secondary domain, 2 to 4 week warmup, ~30 emails per inbox per day, bounces under 1%.
- The DNS records to copy and the pre-send checklist are below.
Why your email is judged before it's read
When your email reaches Gmail, the server asks three questions in a fraction of a second. Who claims to be sending it? Is that server allowed to? Was the message tampered with in transit? If the answers don't hold up, the email is filed as spam without the content filter ever running.
It's counterintuitive: you picture an algorithm reading the text and flagging suspicious words. In reality, the first barrier is purely technical. A perfectly written email from an unauthenticated domain loses to a mediocre email from a compliant one. Copy only counts once that barrier is cleared.
SPF, DKIM, DMARC: each in one sentence
Forget the jargon. Here is the one thing to remember about each, with an analogy that holds.
A DNS record declaring: "only these servers may send in my name". Like a guest list at the door. The receiving server checks the sender is on it.
Every email leaves with a cryptographic signature. The receiving server checks it against your public key (in DNS). If the message was changed in transit, the signature breaks. It's the wax seal on the envelope.
Tells the receiving server what to do when SPF or DKIM fails: do nothing (p=none), quarantine (p=quarantine), or reject (p=reject). And sends you reports to monitor who's spoofing your domain.
SPF says who can send. DKIM proves the message is intact. DMARC decides what to do when it fails. All three, or nothing.
The exact DNS records to add
Here is what the three records look like. You add them at your registrar (OVH, Gandi, Cloudflare), in the DNS zone of your sending domain. The SPF include values and the DKIM key are given to you by your sending provider: don't copy mine, they're there for shape only.
# SPF (TXT record, host "@" or domain root)
# Authorizes your sending servers. ONLY ONE SPF record per domain.
v=spf1 include:_spf.google.com include:sendgrid.net ~all
# DKIM (TXT record, host provided by your tool, e.g. "s1._domainkey")
# The public key. Copy the value from your provider EXACTLY.
s1._domainkey IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSq...YOUR_PUBLIC_KEY...QAB"
# DMARC (TXT record, host "_dmarc")
# Start with p=none to observe without blocking anything.
_dmarc IN TXT "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; fo=1"
# Once SPF + DKIM are aligned and verified (2 to 4 weeks):
_dmarc IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com"Three classic traps. One: only one SPF record per domain, or it's invalid. If you use several services, merge their include: into a single line. Two: the DKIM key is copied character for character, one extra space and it breaks. Three: start DMARC at p=none, watch the reports for two to four weeks, then move to p=quarantine. Going straight to p=reject can block your own legitimate emails.
Authentication gets you into the race. Reputation wins it.
Once all three records PASS, you're no longer dropped by default. But you're not in the inbox yet. The rest plays out on the reputation of your domain and IPs, built by your sending behavior.
Buy a domain close to your brand for cold outbound only. Never your primary domain: if reputation burns, your team and billing emails burn with it.
On a fresh domain, ramp volume gradually with exchanges that get replies. Cold email tools automate this warmup. A fresh domain blasted with 500 emails at once goes to spam for sure.
Stay around 30 emails per inbox per day for cold. To scale, multiply inboxes (several addresses, possibly several domains), never volume per inbox.
Verify every list before sending, keep bounces under 1%. An unverified list is the fastest way to destroy a reputation you spent a month building.
The signal providers watch most is engagement: do people reply, do they mark you as spam? Hence the direct link to targeting. A relevant email, sent to the right person, protects your deliverability. A bulk blast to a cold list destroys it, as Postmark's deliverability guide points out.
The checklist before you hit send
Run these seven points before every new campaign. If one fails, don't launch.
Open the demo campaigns and judge the lead quality yourself, no card required. Worst case, you lose ten minutes.
Where AutoLeads fits
None of the above requires AutoLeads. DNS setup happens at your registrar, whatever tool sends. AutoLeads finds leads in your niche and enriches them, then sends your sequences itself from the mailboxes you connect, or pushes them into your Lemlist campaign if you would rather keep your tool. Either way, the emails leave from your domain: deliverability rests on the three records above, and on clean, targeted leads.
If you remember one thing: before touching your subject line again, go read "Show original" on a test email. Three PASS, or nothing. The rest of your copy only counts after.