Domain provisioning
Email providers like Gmail need three technical records to trust that your emails are real. Here's what each one does and what the platform handles for you.
Before Gmail or Outlook will reliably deliver your cold emails to the inbox, they need to know you're a legitimate sender — not someone pretending to be. Three small DNS records do this work: SPF, DKIM, and DMARC. Without them, your emails get downgraded to spam by default, no matter how good the copy is.
This page explains what each record does and what the platform sets up automatically for inboxes bought through Acquisity.
What each record does (in plain English)
SPF — the guest list
Think of SPF as a guest list for your domain's email. It's a DNS record that says "these are the only servers allowed to send email claiming to be from my domain."
When a receiving email provider (say, Gmail) gets an email from james@yourbiz.com, it checks SPF: "Is the server that sent this on the guest list?" If yes, it's legitimate. If no, Gmail treats it as suspicious.
DKIM — the tamper-proof seal
DKIM attaches a digital signature to every email you send. The signature is created with a private key your sending server holds. The matching public key sits in your DNS.
Receiving servers check the signature against the public key. If it matches, the email is genuine and hasn't been altered in transit. If the signature is missing or broken, it's suspicious — like a package with a broken tamper-proof seal.
DMARC — the bouncer's rulebook
DMARC tells receiving email providers what to do when SPF or DKIM fails. Three possible instructions:
- None — "Just tell me when it fails; deliver the email anyway." A safe starting point.
- Quarantine — "Put failing emails in spam."
- Reject — "Bounce failing emails entirely."
DMARC also specifies where to send reports about failures.
Gmail and Outlook both require DMARC on any domain sending significant volume. Missing DMARC is the single biggest reason new domains go to spam.
What the platform handles automatically
When you buy a pre-warmed inbox or a DFY domain through the platform:
- SPF, DKIM, and DMARC are all set up automatically on the domain.
- The domain is wired up to our sending infrastructure.
- You don't need to touch DNS.
This is most of the value in buying inboxes through the platform — the authentication work that takes experienced email teams hours to set up correctly is done for you in the background.
What's shown in the app
The Email Accounts page is account-level. It shows each sending inbox with Status, Warmup, Health score, Account Type, and daily sending counts. Click a row to open the account settings panel for First Name, Last Name, Save, and Reconnect when the inbox is in Error status.
Domain-level billing lives in Settings → Billing → Email Accounts & Domains. That card shows managed domains, inbox counts, yearly domain pricing, monthly inbox pricing, Cancel, Cancel all, and Buy More. It is not a DNS status panel.
What's managed by the platform
On pre-warmed and Done-For-You (DFY) inboxes, the platform publishes and manages SPF, DKIM, DMARC, and domain forwarding for you. You don't need to touch DNS. If a managed inbox shows Error, or if support flags SPF, DKIM, DMARC, or forwarding, use Feedback in the sidebar or contact support with the affected domain or inbox.
You'll know setup is healthy when…
- The inbox rows show Active status.
- The warmup flame is green once warmup is complete.
- The Health score stays healthy after warmup traffic starts.
- Support or external checks confirm SPF, DKIM, and DMARC pass if a deliverability issue needs deeper inspection.
If Active inboxes still show DNS, authentication, or forwarding problems, contact support rather than editing DNS yourself.
If something's not right
A managed inbox is still not usable after provisioning
Pre-warmed inboxes usually appear quickly. DFY inboxes still need the initial warmup period before they are campaign-ready. If an inbox is missing, stuck, or still unusable after the expected window, contact support with the inbox address and domain.
An inbox row shows Error
Open the row from Cold Email Agent → Email Accounts. If Reconnect appears, use it to start re-authorisation. For platform-managed inboxes, the platform handles the provider work in the background.
Forwarding or authentication looks wrong
The visible app surface does not show a per-domain DNS badge. If an outreach domain does not forward correctly, or if a deliverability warning mentions SPF, DKIM, or DMARC, contact support with the domain name so they can inspect the managed setup.
My campaign is flagged for deliverability
The AI agent will sometimes log a FLAG_DELIVERABILITY action. If it mentions SPF, DKIM, or DMARC:
- Read the action details and note which domain or inbox it names.
- Open Cold Email Agent → Email Accounts and check whether any sending inbox shows Error.
- If the inbox rows look healthy but errors persist, contact support so they can re-run provisioning or inspect the managed domain.
Related
- Deliverability — the broader picture of why authentication matters
- Domain forwarding — a separate trust signal worth setting up too
- Health & troubleshooting — what to do if reputation drops
- FAQ → what does the SPF/DKIM/DMARC deliverability warning mean