Set up your sending domain (SPF, DKIM, DMARC)

Inboxes don't just trust that an email came from who it says it's from — they check. Three DNS records make that check possible, and getting them right is what keeps your outreach out of spam folders instead of landing in them.

The three records, in plain words

SPF lists who is allowed to send email for your domain, so a receiving inbox can confirm the message came from an approved source rather than someone spoofing your address. DKIM attaches a signature to every message that proves it wasn't altered in transit — tampered mail fails the signature check. DMARC is your policy for what happens when a message fails either of those checks: whether it should still be delivered, quarantined, or rejected outright. Together, the three tell a receiving inbox that a message is genuinely from your domain and hasn't been changed along the way.

Where to add them

These are DNS records, so they live at your domain registrar's DNS panel — wherever you manage the domain itself, not inside Matter Leads. If you're sending through Google Workspace, Google publishes the exact values it needs for each record; you're just copying them into your registrar's DNS settings.

Checking your status

Settings shows a live pass/fail for each of the three records, per sending domain, so you don't have to guess whether a record took effect or double-check it externally. If something shows as failing, it usually means a record is missing, has a typo, or hasn't propagated yet.

Why sending stays locked until they pass

On trial workspaces, cold outreach stays locked until SPF, DKIM, and DMARC all pass. That's not a trial restriction for its own sake — it protects your domain's reputation and everyone else's, since a domain sending real volume without proper authentication is exactly what gets flagged as suspicious.

A personal @gmail.com address won't pass

Domain checks apply to domains you control, and a personal @gmail.com or similar address can't pass them — there's no DNS panel for you to add records to. That's fine for testing the product early on, but get a custom domain in place before you send real outreach at any volume.

Give it time

DNS changes can take up to 48 hours to propagate fully, even after you've entered them correctly. If a check is still failing shortly after you've added the records, wait and re-check from Settings rather than assuming something's wrong — most failures at this stage resolve on their own once propagation finishes.