SPF, DKIM and DMARC for Cold Email
For cold email you need all three: SPF, DKIM and DMARC. Since February 1, 2024, Gmail requires bulk senders (5,000+ messages a day) to have SPF, DKIM and DMARC, and every sender to have at least SPF or DKIM. Yahoo sets similar rules. Check all three with OutreachBox's free checker.
Updated October 23, 2026 · Rules checked against Google and Yahoo sender pages on October 20, 2026
OutreachBox is our product. The free checker is ours; the sender rules come from Google and Yahoo.
What do SPF, DKIM and DMARC each do?
SPF names the servers that may send for your domain, DKIM proves the message was signed and not changed, and DMARC tells receivers what to do when those checks fail to align.
| Record | What it proves | Where it lives | Key rule |
|---|---|---|---|
| SPF | Which servers may send for your domain | TXT at the domain root (v=spf1 ...) | At most 10 DNS-querying terms (include, a, mx, ptr, exists, redirect). More returns permerror (RFC 7208 §4.6.4). |
| DKIM | The message was signed by your domain and not changed in transit | TXT at selector._domainkey.domain | Yahoo asks for a key of at least 1024 bits. |
| DMARC | What receivers should do when SPF and DKIM fail to align, plus where to send reports | TXT at _dmarc.domain (v=DMARC1; p=...) | Gmail and Yahoo bulk senders: at least p=none. The From domain must align with the SPF or DKIM domain. |
What do Gmail and Yahoo require from senders?
Gmail requires SPF or DKIM from every sender, and SPF, DKIM, and DMARC from anyone sending 5,000 or more messages a day. Yahoo’s bulk-sender rules are similar, and both pages were checked on October 20, 2026.
| Requirement | Gmail: all senders | Gmail: 5,000+/day | Yahoo: all senders | Yahoo: bulk senders |
|---|---|---|---|---|
| SPF / DKIM | SPF or DKIM | SPF and DKIM | SPF or DKIM at minimum | SPF and DKIM |
| DMARC | Not required | Required (p=none allowed) | Not required | Required (at least p=none; rua strongly recommended) |
| From: alignment | Not required | From domain aligned with the SPF or DKIM domain | Not required | Aligned with the SPF or DKIM domain (relaxed is acceptable) |
| Spam rate | Below 0.3% (Postmaster Tools) | Below 0.30% | Below 0.3% | Below 0.3% |
| Forward and reverse DNS (PTR) | Required | Required | not captured | not captured |
| One-click unsubscribe | n/a | Marketing and subscribed messages | n/a | List-Unsubscribe one-click (RFC 8058 POST recommended); honor within 2 days |
Yahoo said enforcement would roll out gradually from February 2024. Sender pages change, so re-read them before you rely on a cell in a client report.
Sources: Gmail email sender guidelines, Yahoo sender best practices, and RFC 7208 (the 10-lookup limit is §4.6.4; more than one SPF record is a permerror under §4.5). Fetched October 20, 2026.
How do I check my records?
Run the free checker. It reads the public SPF, DKIM, and DMARC records and returns pass, warn, or fail for each one.
On that checker, SPF -all is pass, SPF ~all is warn, and SPF +all is fail. DMARC p=reject and p=quarantine are pass. DMARC p=none is warn. The steps for running the lookup live on the tool page, not here.
What do the common SPF, DKIM, and DMARC errors mean?
Match the label to the free checker: pass, warn, or fail. A short key is a Yahoo sender rule, not a separate checker status.
| Situation | Checker label | What to do |
|---|---|---|
| No v=spf1 TXT record | Fail | Publish an SPF record listing your email providers. |
| Two or more v=spf1 records | Fail | Merge them into one SPF record. Multiple records make SPF fail (RFC 7208 §4.5). |
| More than 10 DNS-querying terms after expanding includes | Fail | Too many lookups (limit 10). Flatten the record or remove unused includes. |
| The record ends in +all | Fail | +all lets anyone send as you. Use ~all while testing, then -all. |
| The record ends in ~all or ?all | Warn | ~all monitors unauthorized senders instead of rejecting them. Move to -all once every legitimate sender is listed. |
| The record ends in -all and stays within 10 lookups | Pass | Unauthorized servers are rejected. Keep the include list current when you add a sending tool. |
| No DKIM key at the selector | Fail | Enable DKIM signing in your email provider and publish the key. |
| No _dmarc TXT record | Fail | Publish v=DMARC1; p=none; rua=mailto:you@yourdomain to start. |
| DMARC p=none | Warn | Fine to start. Move to quarantine, then reject, once reports look clean. |
| DMARC p=quarantine or p=reject | Pass | The policy is enforcing. Add a rua= address if you want aggregate reports. |
Yahoo asks for a DKIM key of at least 1024 bits. The checker does not measure key length, so a short key is not labeled warn or fail there. A missing rua address is a report you will not receive; the checker still calls an enforcing policy pass.
SPF, DKIM, and DMARC questions
Do I need SPF, DKIM and DMARC for cold email?
Yes. Set up all three. Gmail requires anyone sending 5,000 or more messages a day to its users to have SPF, DKIM, and DMARC, and every sender to have at least SPF or DKIM. Yahoo sets similar rules for bulk senders. Cold email domains without these records are more likely to be filtered. Check them with the free OutreachBox checker.
What DMARC policy should I start with?
Start with p=none and a rua reporting address. Gmail and Yahoo both accept p=none for bulk senders. The free checker labels p=none as warn, because the record is present but not yet enforcing. Once reports show your legitimate mail passing, move to quarantine and then reject.
Why does my SPF record fail with "too many lookups"?
SPF allows at most 10 DNS-querying terms, including include, a, mx, ptr, exists, and redirect, per evaluation. Beyond that the result is permerror, under RFC 7208. Remove unused includes or replace them with ip4 and ip6 ranges so the record stays inside the limit.
How do I find my DKIM selector?
Open an email you sent, view the original or the headers, and find the DKIM-Signature line. The value after s= is the selector. The free OutreachBox checker can also try common selectors, such as google, selector1, and s1, if you leave that field blank.
What spam complaint rate is too high?
Gmail and Yahoo both ask senders to stay below 0.3%. Gmail measures the rate in Postmaster Tools. Yahoo’s sender guidance uses the same 0.3% complaint ceiling. Those pages were checked on October 20, 2026, and the rules can change, so confirm them before you cite a number in a client report.
Related reading
- Free SPF, DKIM, and DMARC checker
- Cold email deliverability guide
- Cold email for agencies
- Pricing
- Compare OutreachBox
OutreachBox is a product of Pulse Real LLC, Sheridan, Wyoming, USA.
Check a domain, then send with approval
The checker is free and does not need a login. OutreachBox campaigns run after that, with a free plan and paid plans from $99/month.
- Free plan available
- No credit card required
- Approval gates you control