How do I check that SPF, DKIM and DMARC are set up before I send cold email?
Look up three DNS records for your sending domain: a TXT record starting v=spf1 (SPF), a DKIM public key at selector._domainkey, and a TXT record at _dmarc starting v=DMARC1. Gmail requires SPF or DKIM from every sender and all three from those sending more than 5,000 messages a day. GrowFast's checkers at /tools read them live.
Published by GrowFast. Last updated 2026-11-13. We make GrowFast, so weigh our side accordingly. Markdown version: /solutions/check-spf-dkim-dmarc-before-cold-email.md.
Why it happens
Receivers use these records to decide whether a message really came from the domain it claims. Missing or broken records push mail to spam or get it rejected outright; Google rejects unauthenticated mail to Gmail accounts with a 5.7.26 error.
The most common failures are quiet: two SPF records instead of one, an SPF record that needs more than ten DNS lookups, a DKIM key published under a selector your provider does not use, and a DMARC record with a typo. Nothing looks broken until mail stops arriving.
The fix that works without GrowFast
- Check SPF. Run dig TXT yourdomain.com +short and look for exactly one value starting v=spf1. It should include your sending provider and end in ~all or -all. Two SPF records, or more than ten DNS lookups across the includes, makes SPF fail with a permanent error (RFC 7208, section 4.6.4).
- Find your DKIM selector. Your sending provider tells you the selector, for example s1 or mail. Run dig TXT selector._domainkey.yourdomain.com +short; some providers publish a CNAME instead. Gmail requires a key of 1024 bits or longer and Google recommends 2048.
- Check DMARC. Run dig TXT _dmarc.yourdomain.com +short. You want v=DMARC1; p=none with a rua= address that receives reports. p=none is acceptable to Google for bulk senders and lets you watch before enforcing.
- Check alignment. The domain in the From header must match the SPF domain or the DKIM domain. Authentication that passes for a different domain does not count.
- Send a real test and read the headers. Send to a Gmail address you own, open the message, choose Show original, and look for SPF: PASS, DKIM: PASS and DMARC: PASS.
- Add one-click unsubscribe. Gmail requires it for senders above 5,000 a day, and Yahoo for bulk senders. It is two headers: List-Unsubscribe and List-Unsubscribe-Post: List-Unsubscribe=One-Click (RFC 8058).
- Re-check after any DNS change. A DNS edit that fixes one thing can break another, so run all three lookups again.
| Record | What it does | Where it lives | Gmail and Yahoo requirement |
|---|---|---|---|
| SPF | Lists the servers allowed to send for the domain | TXT at the domain, starting v=spf1 | All senders: SPF or DKIM. Bulk senders: both |
| DKIM | Signs each message so receivers can verify it | TXT or CNAME at selector._domainkey | All senders: SPF or DKIM. Bulk senders: both, key 1024 bits or longer |
| DMARC | Says what to do when SPF and DKIM fail, and sends reports | TXT at _dmarc, starting v=DMARC1 | Bulk senders: a policy of at least p=none, and it must pass |
| One-click unsubscribe | Lets the recipient opt out from the mail client | Two message headers (RFC 8058) | Bulk senders: required |
What counts as a bulk sender
Google defines the stricter tier as more than 5,000 messages a day to Gmail accounts. Yahoo applies its bulk-sender list to bulk senders without publishing the same figure on the page we read. A new cold email program will be far below 5,000 a day, but setting up all three records from the start costs little and avoids a migration later.
When to use GrowFast
GrowFast's tools at /tools run these lookups live with no account: an SPF checker that counts DNS lookups against the limit of ten, a DKIM checker that tries a selector you give or 22 common ones, a DMARC checker, an MX lookup and a combined deliverability audit.
If you send through GrowFast, connecting your own domain shows the DNS records to add (DKIM and SPF), and you click to verify. Every email carries a one-click unsubscribe link and the List-Unsubscribe headers. The managed address on reach.growfast.sh needs no DNS from you.
When it is not the right tool. These checks read DNS. They do not predict inbox placement and give no spam score; a domain can pass all three and still be filtered for reputation or content.
Plans and limits are on the pricing page.
Ask your AI assistant
Paste this into an assistant that has the GrowFast MCP server connected. The tools it uses need the full server with an API key.
Assign to GrowFast: list my sending domains and the managed address (list_sending_domains) with their status, and tell me which are not verified yet. Don't send anything. Show me what you found so I can approve the DNS changes.
Tools used: list_sending_domains
FAQ
Do I need DMARC if I send only a few emails?
Google requires DMARC from senders above 5,000 messages a day, not below. Publishing p=none costs nothing, gives you reports and prepares you for growth.
Why does SPF pass but DMARC fail?
Usually alignment: SPF passed for the provider's domain, not the domain in your From header. Sign with DKIM on your own domain or align the return path.
How long do DNS changes take?
Anywhere from minutes to the record's TTL. Re-run the lookups after waiting.
Is a 1024-bit DKIM key enough?
Google says Gmail requires 1024 bits or longer and recommends 2048 if your provider supports it.
Sources
- Google, Email sender guidelines (Gmail Help) (read 2026-11-13)
- Yahoo Sender Hub, Sender requirements and best practices (read 2026-11-13)
- RFC 7208, Sender Policy Framework (SPF), section 4.6.4 DNS lookup limits (read 2026-11-13)
- RFC 8058, Signaling One-Click Functionality for List Email Headers (read 2026-11-13)