Why do SPF, DKIM, and DMARC matter?

Email lets a sender place almost any address in the From field. Receiving services therefore use SPF, DKIM, and DMARC to check whether a message is authorized by the domain it claims to come from.

SPF authorizes sending servers

SPF is a DNS record listing services allowed to send for your domain. For a Google Workspace mailbox, it must authorize Google’s servers.

A domain should have one SPF record. Two separate v=spf1 records make the result invalid.

DKIM signs each message

DKIM adds a cryptographic signature to outgoing mail. The public key in DNS lets a receiving service confirm that the signature belongs to your domain and that the signed content was not changed in transit.

ColdMerge treats confirmed DKIM misalignment more seriously than the other signals because it shows that real mail is being signed under the wrong domain.

DMARC sets the policy

DMARC tells receiving services what to do when authentication and the visible From domain do not align. It can also send reports to addresses named in the record.

The common policy levels are:

Policy	Requested handling
p=none	Monitor and report
p=quarantine	Treat failing mail as suspicious
p=reject	Refuse failing mail

Start cautiously and review reports before moving to a stronger policy. A policy that is too strict can also affect legitimate services sending for your domain.

What ColdMerge enforces

Missing SPF, missing DMARC, and weak policies produce warnings. An unaligned DKIM result can block campaign launch only when a probe send or Google Postmaster Tools confirms it.

To publish the records, follow Set up your sending domain.