Email DeliverabilityHow to Set Up DKIM and Finally Get Your Cold Emails Into Inboxes Struggling with cold email deliverability? Learn how to set up DKIM on Gmail, Outlook, or GoDaddy and get your messages out of spam, step by step.
If you’re setting up a new domain for cold email, and your email looks something like outreach.yourcompany.com, the first thing you need to do is authenticate it properly.
Without that, inbox providers like Gmail and Outlook will likely treat your emails as suspicious. And with filters getting stricter in 2024, even low-volume senders are seeing legitimate emails land in spam.
Setting up DKIM is how you prove your emails are real, not spoofed or tampered with.
If it’s missing, you might already be seeing:
❌ “Missing DKIM” errors in your warm-up tool
❌ Gmail headers showing dkim=fail
❌ Campaigns underperforming with low opens, high spam placements, and no replies
In this guide, we’ll walk you through how to set up DKIM step by step, depending on your setup:
Every time you send an email, DKIM adds an invisible digital signature to it. That signature proves two things:
Here’s how it works in simple terms:
You’ll often see this show up in your email headers as something like:
dkim=pass header.i=@yourcompany.com
If that line is missing or says dkim=fail, your emails are more likely to hit spam or get blocked entirely.
In 2024, Gmail and Yahoo began enforcing strict requirements for anyone sending more than 5,000 emails a day, including cold outreach and warm-up traffic. DKIM is no longer optional if you want your emails to land.
Even if you're sending fewer than 5,000 emails, failing DKIM checks still puts you on the fast track to spam. That’s why deliverability tools like MailReach check for a valid DKIM record.
If you’re seeing a “Missing DKIM” error in MailReach, it means your emails aren’t signed and inboxes like Gmail can’t verify they’re really from you.
Until that’s fixed, your outreach is either invisible or flagged as untrustworthy. DKIM is one of the first and most important steps in being seen.
You’ll need to log into your DNS provider like GoDaddy, Cloudflare, or Namecheap to add a TXT or CNAME record. If you don’t have access, get it from whoever manages your domain.
DKIM keys are generated inside the platform that sends your emails, Google Workspace, Microsoft 365, Zoho, or Mailgun.
That platform must be set to sign your emails before you add the DNS record.
Cold email may go through tools like Instantly, Smartlead, or Lemlist. Marketing emails may come from Mailchimp or Brevo.
Transactional emails might be routed via SendGrid, Postmark, or Amazon SES.
Each one usually needs its own DKIM record with a unique selector. If you’re using multiple tools, you’ll be adding multiple records.
Don’t just assume it’s working after publishing the record. You’ll want to verify that emails are actually being signed.
Use MailReach’s free DKIM Checker to do this after you finish setting up. We cover how to do this later in the article (scroll to the bottom).
Setting up DKIM differs depending on your email provider. Below are the most common platforms. Pick the one you use and follow the exact steps.
1. Log in to the Google Admin Console using a super admin account. This is the main admin account used to set up Google Workspace for your domain. If you don’t have access to that, you’ll need to ask your IT admin or domain manager..
Once you're in, go to: Apps → Google Workspace → Gmail → Authenticate Email
Here, you’ll see a list of domains connected to your account. Select the domain you use for sending emails (like yourcompany.com). If DKIM isn’t set up yet, you’ll see a button that says “Generate new record.” Click that.
2. You’ll now be asked to choose two things:
Click Generate. Google will then show you two important pieces of information:
3. Open your DNS provider’s dashboard. This is wherever your domain is hosted. Common ones are GoDaddy, Cloudflare, Namecheap, or Google Domains. You’re going to add a TXT record there, which might sound intimidating, but it’s just a copy-paste task.
4. In your DNS dashboard, click “Add new record”, and choose:
Save the record. DNS changes typically propagate within 5–30 minutes, but in rare cases may take up to 24 hours.
5. Now, go back to the Google Admin Console and hit “Start authentication” . This tells Google to start signing all your outgoing emails with that DKIM key. If you see an error, it’s probably because the DNS record hasn’t propagated yet. Wait 10–30 minutes and try again.
6. Once authentication starts, Google will show the status as “Authenticating email with DKIM.” That means it’s live.
7. To confirm everything is working, send a test email from your domain to a Gmail account (like your personal one). Open the email, click the three dots on the top right, and choose “Show original.” Scroll down and look for this line:
dkim=pass header.i=@yourcompany.com
If you see that, you’re all set. Your domain is now DKIM-protected, and your emails are more likely to land in inboxes, not spam.
You only need to do this once per domain, and you're done. DKIM doesn’t change often, but we recommend running a quick email spam test weekly or after DNS changes. This helps catch accidental issues before they affect deliverability.
If your business email runs on Microsoft 365 (e.g., Outlook), your messages by default get signed with Microsoft’s shared DKIM key tied to onmicrosoft.com, which isn't ideal, especially if you’re doing cold outreach. You want to use your own domain’s DKIM so that your messages look legitimate and trusted, especially to Gmail and other spam filters.
If everything is set up correctly, Microsoft will confirm that DKIM is now active. From that point onward, every email sent from your domain via Microsoft 365 will be signed using your domain’s own DKIM keys.
To double-check that everything is working:
If you see dkim=pass, congratulations, it’s all working.
Once it’s done, you won’t have to touch it again unless you change your DNS or want to rotate keys for security. Microsoft will handle key rotation behind the scenes automatically using those two selectors (selector1 and selector2), so you’re covered.
Why this matters: Without this setup, your emails may get flagged as suspicious, especially with Gmail’s new bulk sender rules. DKIM helps you build a strong sender reputation, critical if you’re running cold outreach or warming inboxes using email warmup tools like MailReach.
Even if you don’t use Google Workspace or Microsoft 365 to send emails, you’ll need to setup DKIM
Most providers including GoDaddy email hosting, Zoho Mail, Mailchimp, SendGrid, or Brevo, generate a DKIM that you need to copy and paste into your domain settings.
We’ll walk you through three of the most common non-Google/Microsoft setups:
If you bought your domain and email through GoDaddy, and you use their built-in email service (Webmail or cPanel-based), here’s what to do:
Zoho Mail is popular with startups and small businesses. Here’s how to set up DKIM in Zoho:
✅ Once verified, Zoho will begin signing all outgoing emails with DKIM.
These platforms typically give you multiple DNS records to publish for DKIM (and SPF or DMARC) records. The most common format involves two CNAME records.:
These three acronyms often come up together, and they work best as a team. Here’s how they break down:
Do you need all three?
Yes, ideally. But DKIM is often the most important when it comes to deliverability and domain trust, especially for Gmail and Outlook.
If you're starting from scratch, start with DKIM and SPF. Then add DMARC when you're ready to monitor and enforce policy.
At this point, you’ve done the hard parts: set up DKIM, authenticated your domain, and started warming your inbox. That’s the foundation.
But consistent deliverability is an ongoing process.
What keeps it strong?
MailReach monitors all of this behind the scenes. If your inbox reputation starts to slip, you’ll know what’s wrong before it tanks your campaigns.
Use MailReach to stay in the inbox, not just get there once.
Every email in spam equals to a lost potential customer. Start improving your inbox placement today with MailReach spam testing and warmup.
Following the rules isn’t enough—know where your emails land and what’s holding them back. Check your spam score with our free test, and improve deliverability with MailReach warmup.
Without the right warmup, your best campaigns are of no use. You can start by first testing your inbox placement and begin improving it today.
DMARC Fail: Complete Fix Guide for B2B Cold Email (2025)
How to Set Up DKIM and Finally Get Your Cold Emails Into Inboxes
Email Authentication: Methods, Best Practices & Importance in 2025
Regularly running a deliverability test is one of the best practices to avoid the spam filters and improve your deliverability. At MailReach, we’ve seen that most of the time, deliverability testing is often done in an incomplete or biased way. In this article, we’ll cover how to properly run a deliverability test and check if your email will land in spam, categories or inbox.
Outbound sales: Definition and How It Works
