# How do I check that SPF, DKIM and DMARC are set up before I send cold email?

Canonical: https://growfast.sh/solutions/check-spf-dkim-dmarc-before-cold-email | Last updated: 2026-11-13 | Published by GrowFast

Look up three DNS records for your sending domain: a TXT record starting v=spf1 (SPF), a DKIM public key at selector._domainkey, and a TXT record at _dmarc starting v=DMARC1. Gmail requires SPF or DKIM from every sender and all three from those sending more than 5,000 messages a day. GrowFast's checkers at /tools read them live.

## Why it happens

Receivers use these records to decide whether a message really came from the domain it claims. Missing or broken records push mail to spam or get it rejected outright; Google rejects unauthenticated mail to Gmail accounts with a 5.7.26 error.

The most common failures are quiet: two SPF records instead of one, an SPF record that needs more than ten DNS lookups, a DKIM key published under a selector your provider does not use, and a DMARC record with a typo. Nothing looks broken until mail stops arriving.

## The fix that works without GrowFast

1. **Check SPF.** Run dig TXT yourdomain.com +short and look for exactly one value starting v=spf1. It should include your sending provider and end in ~all or -all. Two SPF records, or more than ten DNS lookups across the includes, makes SPF fail with a permanent error (RFC 7208, section 4.6.4).
2. **Find your DKIM selector.** Your sending provider tells you the selector, for example s1 or mail. Run dig TXT selector._domainkey.yourdomain.com +short; some providers publish a CNAME instead. Gmail requires a key of 1024 bits or longer and Google recommends 2048.
3. **Check DMARC.** Run dig TXT _dmarc.yourdomain.com +short. You want v=DMARC1; p=none with a rua= address that receives reports. p=none is acceptable to Google for bulk senders and lets you watch before enforcing.
4. **Check alignment.** The domain in the From header must match the SPF domain or the DKIM domain. Authentication that passes for a different domain does not count.
5. **Send a real test and read the headers.** Send to a Gmail address you own, open the message, choose Show original, and look for SPF: PASS, DKIM: PASS and DMARC: PASS.
6. **Add one-click unsubscribe.** Gmail requires it for senders above 5,000 a day, and Yahoo for bulk senders. It is two headers: List-Unsubscribe and List-Unsubscribe-Post: List-Unsubscribe=One-Click (RFC 8058).
7. **Re-check after any DNS change.** A DNS edit that fixes one thing can break another, so run all three lookups again.

**What each record does and what Gmail and Yahoo ask for (read 2026-11-13)**

| Record | What it does | Where it lives | Gmail and Yahoo requirement |
| --- | --- | --- | --- |
| SPF | Lists the servers allowed to send for the domain | TXT at the domain, starting v=spf1 | All senders: SPF or DKIM. Bulk senders: both |
| DKIM | Signs each message so receivers can verify it | TXT or CNAME at selector._domainkey | All senders: SPF or DKIM. Bulk senders: both, key 1024 bits or longer |
| DMARC | Says what to do when SPF and DKIM fail, and sends reports | TXT at _dmarc, starting v=DMARC1 | Bulk senders: a policy of at least p=none, and it must pass |
| One-click unsubscribe | Lets the recipient opt out from the mail client | Two message headers (RFC 8058) | Bulk senders: required |

## What counts as a bulk sender

Google defines the stricter tier as more than 5,000 messages a day to Gmail accounts. Yahoo applies its bulk-sender list to bulk senders without publishing the same figure on the page we read. A new cold email program will be far below 5,000 a day, but setting up all three records from the start costs little and avoids a migration later.

## When to use GrowFast

GrowFast's tools at /tools run these lookups live with no account: an SPF checker that counts DNS lookups against the limit of ten, a DKIM checker that tries a selector you give or 22 common ones, a DMARC checker, an MX lookup and a combined deliverability audit.

If you send through GrowFast, connecting your own domain shows the DNS records to add (DKIM and SPF), and you click to verify. Every email carries a one-click unsubscribe link and the List-Unsubscribe headers. The managed address on reach.growfast.sh needs no DNS from you.

**When it is not the right tool:** These checks read DNS. They do not predict inbox placement and give no spam score; a domain can pass all three and still be filtered for reputation or content.

## Ask your AI assistant

Paste this into an assistant that has the GrowFast MCP server connected:

> Assign to GrowFast: list my sending domains and the managed address (list_sending_domains) with their status, and tell me which are not verified yet. Don't send anything. Show me what you found so I can approve the DNS changes.

Tools used: `list_sending_domains`. These need the full server (https://growfast.sh/api/mcp) with an API key.

## FAQ

### Do I need DMARC if I send only a few emails?

Google requires DMARC from senders above 5,000 messages a day, not below. Publishing p=none costs nothing, gives you reports and prepares you for growth.

### Why does SPF pass but DMARC fail?

Usually alignment: SPF passed for the provider's domain, not the domain in your From header. Sign with DKIM on your own domain or align the return path.

### How long do DNS changes take?

Anywhere from minutes to the record's TTL. Re-run the lookups after waiting.

### Is a 1024-bit DKIM key enough?

Google says Gmail requires 1024 bits or longer and recommends 2048 if your provider supports it.

## Sources

- [Google, Email sender guidelines (Gmail Help)](https://support.google.com/mail/answer/81126) (read 2026-11-13)
- [Yahoo Sender Hub, Sender requirements and best practices](https://senders.yahooinc.com/best-practices) (read 2026-11-13)
- [RFC 7208, Sender Policy Framework (SPF), section 4.6.4 DNS lookup limits](https://www.rfc-editor.org/rfc/rfc7208#section-4.6.4) (read 2026-11-13)
- [RFC 8058, Signaling One-Click Functionality for List Email Headers](https://datatracker.ietf.org/doc/html/rfc8058) (read 2026-11-13)

## Related

- [Why do my cold emails land in spam, and how do I fix it?](https://growfast.sh/solutions/why-do-cold-emails-go-to-spam)
- [Should I send cold email from a separate domain, and how do I set one up?](https://growfast.sh/solutions/set-up-a-separate-domain-for-cold-email)
- [Why are my cold emails bouncing, and how do I lower the bounce rate?](https://growfast.sh/solutions/why-do-cold-emails-bounce)
- [SPF checker](https://growfast.sh/tools/spf-checker)
- [DKIM checker](https://growfast.sh/tools/dkim-checker)
- [DMARC checker](https://growfast.sh/tools/dmarc-checker)
- [Deliverability audit](https://growfast.sh/tools/deliverability-audit)
- [All problems and solutions](https://growfast.sh/solutions)