Two back-end moves quietly decide whether your email lands in the inbox or rots in spam: authenticate your domain (SPF, DKIM, DMARC — simplified) and warm up your sender before you scale. Do them in order and your reputation survives real volume.
That's two full weeks of the Sidekick Summer Slam — one free tool every single day. To celebrate, we're handing you the unglamorous setup that makes every other marketing tool actually work: getting your email seen.
You can write the perfect offer, design a beautiful template, and segment your list like a pro — and none of it matters if the mail server quietly files it under junk. The customer never sees it. You never even know.
Deliverability is decided before your email is opened — by two things most owners never set up: proof that you're really you (authentication), and a track record that you're not a spammer (warmup). Skip them and you can torch a brand-new domain on day one — and a burned sending reputation is slow and painful to rebuild.
Get them right and you've built a quiet asset: a sending reputation that holds up when you finally scale.
Three short text records you add to your domain. Sounds like IT homework — it's really just three ID checks that prove your email is really from you. Here's each one in plain English, why it matters, and the exact steps.
A public list of which servers are allowed to send email for your domain. If a server isn't on the list, receivers treat the mail as suspicious. Stops random servers from spoofing your name.
A tamper-proof signature stamped on every message. The receiver checks the seal against a public key on your domain. If the mail was altered or faked, the seal breaks and it gets flagged.
Your instructions for what to do when a message fails the first two checks — let it through, send to spam, or reject it outright. Also emails you reports on who's sending as you.
A single TXT record on your domain listing the mail services authorized to send on your behalf (your email host, your CRM, your invoicing tool, etc.).
Without it, anyone can send email pretending to be your domain — and receivers have no way to tell real from fake, so your real mail gets treated with suspicion too.
@ (your root domain).v=spf1 include:_spf.google.com ~all
include: bits inside the same record, e.g. v=spf1 include:_spf.google.com include:sendgrid.net ~all. Keep total lookups under 10.A cryptographic signature added to every email you send. Your email host generates a key pair; you publish the public half as a DNS record, and the host signs outgoing mail with the private half.
It proves a message genuinely came from you and wasn't altered in transit. DKIM is the single strongest signal you can give inbox providers that you're legit.
google._domainkey TXT v=DKIM1; k=rsa; p=MIGfMA0G...your-long-public-key...AQAB
google) will differ per provider.A TXT record telling receivers what to do when an email fails SPF/DKIM, plus an address where they email you reports about who's sending under your name.
It's the instruction layer. Gmail and Yahoo now require a DMARC record for anyone sending in bulk. Without it you're not just less trusted — you may be flat-out rejected.
_dmarcp=none) so you see reports without risking real mail.rua= at an inbox you'll actually check (a DMARC report reader helps).p=quarantine, then eventually p=reject.v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; fo=1; adkim=s; aspf=s
none (watch) → quarantine (spam-folder failures) → reject (block them). Don't jump straight to reject or you risk killing legit mail you forgot to authenticate.Brand-new sending address? Inbox providers don't trust strangers. Blast 1,000 cold emails on day one and you'll get flagged instantly. Warming = starting small and ramping slowly so providers learn you're a real human sending wanted mail. Tell me your target and I'll build the schedule.
| Week | Emails / day | Per week* | Status |
|---|
A schedule is half of it. The other half is sending mail people actually want — because engagement (opens, replies, "not spam") is what teaches providers to trust you.
Same two moves, slightly different emphasis depending on what you sell and how you send.
You send fewer, higher-stakes emails — quotes, invoices, appointment reminders. One quote in spam can cost a job.
You send for clients and run cold outreach at volume. A burned domain isn't just your problem — it's your client's brand.
You blast promos and flows to big lists. Gmail/Yahoo bulk rules hit you hardest — and one bad send tanks the whole list's deliverability.
Every one of these is common, self-inflicted, and avoidable.
You ramp slowly but never set up SPF/DKIM/DMARC. You're just teaching filters to distrust you, politely. Authenticate first.
Adding a second SPF record instead of merging into one. Receivers see a conflict and SPF fails entirely. One record, nested includes.
Setting DMARC to reject before you've confirmed everything passes. You block your own legit mail you forgot to authenticate.
New domain, 2,000 cold emails out the gate. Instant flag, sometimes an instant blacklist. The schedule above exists for this reason.
Sending to people who never opted in spikes complaints and bounces — the two metrics that wreck reputation fastest.
Never checking your DMARC reports or deliverability. Problems are silent. Glance at reports monthly so you catch drift before it costs you.
Your whole golden-email setup, start to finish.
Block 30–45 minutes for the setup, then let the warmup run over the following weeks.
@, all senders nested inside it.p=noneMonitor-only to start, pointed at an inbox you check.Sign up for the Sidekick Summer Slam. One free marketing or operations tool dropped to your inbox every day from May 8 → September 4. No fluff. No fee. (And yes — we authenticated and warmed the domain it comes from.)
Get me on the list →