Cold-email domains are just domains. The records below are the same ones every receiver already checks. Skip the folklore and publish them correctly.
SPF
Publish exactly one TXT record on the sending domain that starts with v=spf1. Include every host that actually sends, then end the record with ~all while you confirm the includes, and -all once the set is stable.
Do not publish two SPF records. Receivers are allowed to ignore all of them. Do not use +all. That approves the entire internet. Do not stack so many include: mechanisms that you pass 10 DNS lookups. Past that, evaluation stops and the record can fail closed.
DKIM
Each mailbox provider gives you a selector, which is the name in front of ._domainkey. Google Workspace often uses google. Microsoft often uses selector1 and selector2. Other hosts use k1, s1, or a name they invent.
The TXT record should contain v=DKIM1 and a public key in p=. An empty p= means the key was revoked. Inbox Watch checks a list of common selectors and lets you add yours. If the checker says DKIM is missing and you know the selector, add it before you assume the domain is unsigned.
DMARC
Publish one TXT record at _dmarc.yourdomain:
v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain; pct=100; adkim=s; aspf=s
Start at p=none only long enough to read reports. Cold email that stays on p=none forever is telling receivers you do not want spoofed mail quarantined. Move to p=quarantine when legitimate mail is aligned. pct should be 100 once you trust it. A policy that applies to 10% of mail is a partial policy.
Alignment means the visible From domain matches the domain that signed and authorized the mail. A tracking domain on a different host does not fix a missing key on the From domain.
What not to do
Do not buy a "deliverability network" that asks you to add +all or to flatten SPF into something you cannot explain. Do not keep sending on a domain the checker marks burned. Fix the record, or replace the domain and leave the burned one alone.