Every cold-outreach domain needs four DNS records to land in the inbox: MX, SPF, DKIM, and DMARC. If you use BrandJet tracking, a fifth CNAME record is added. Here is what each one does, and how to set it up.
MX — where mail lands
The MX record tells the world which server receives mail for your domain. Without a valid MX, replies and warmup conversations cannot reach you.
Google Workspace: priority 1, value smtp.google.com.
Microsoft 365: priority 0, value yourdomain-com.mail.protection.outlook.com.
One MX per provider. Remove any old MX records from previous providers.
SPF — who can send as you
SPF is a TXT record listing the servers allowed to send mail on behalf of your domain. Receivers check SPF before they check anything else.
Google Workspace:
v=spf1 include:_spf.google.com ~allMicrosoft 365:
v=spf1 include:spf.protection.outlook.com ~allSendGrid or Mailgun add-on: include their domain in the same record, for example
v=spf1 include:_spf.google.com include:sendgrid.net ~all.
You can only have one SPF record per domain. If you need more includes, merge them into one record.
DKIM — cryptographic signature
DKIM signs each outgoing message with a private key your provider holds. Receivers verify the signature against the public key in your DNS, proving the message was not tampered with and actually came from your provider.
Google Workspace: generate the key in Apps Google Workspace Gmail Authenticate email, then add the resulting
google._domainkeyTXT record at your DNS host.Microsoft 365: enable DKIM in Microsoft Defender Email and collaboration Policies DKIM. Microsoft will give you two CNAME records (selector1 and selector2) to add at your DNS host.
Custom or SMTP/IMAP provider: follow your provider DKIM setup. The selector name varies.
DMARC — what to do when a check fails
DMARC tells the receiver what to do when SPF or DKIM fails. It also sends you reports about who is sending mail from your domain.
Start with a monitoring policy and tighten over time:
Day 1:
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.comOnce you trust your sending:
v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.comFor very high-volume senders:
v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourdomain.com
The record name is always _dmarc.
Tracking CNAME — your branded click domain
If you use click tracking, BrandJet rewrites links to a tracking domain. Using your own branded subdomain (for example links.yourdomain.com) instead of track.brandjet.ai improves trust and click-through rate.
Add a CNAME record at
links.yourdomain.compointing totrack.brandjet.ai.In BrandJet, go to Settings → Domains, add the subdomain, and click Verify.
Once verified, all tracked links rewrite to your branded domain automatically.
Verifying everything is right
Use the Domain health check inside Settings → Domains, or external tools like MXToolbox or mail-tester.com. Send a test from BrandJet to a personal Gmail; look at the original message and confirm SPF, DKIM, and DMARC all show PASS.