Do I need SPF, DKIM and DMARC, or just one?

All three. Since February 2024 Google and Yahoo require every bulk sender to have SPF, DKIM, and a DMARC record. They also work as a chain — DMARC only enforces when SPF or DKIM passes and aligns with your From domain.

What counts as a “bulk sender”?

Google and Yahoo draw the line around 5,000 messages a day to their users. But the requirements are cheap to meet and good hygiene, so it’s worth publishing all three even below that threshold.

Is DMARC p=none enough to comply?

Yes for the requirement — Gmail and Yahoo accept p=none. But p=none only monitors; it doesn’t stop spoofing. Once your aggregate reports show legitimate mail passing, move to p=quarantine and then p=reject.

Why does my SPF pass but DMARC fail?

DMARC needs alignment, not just a pass. If a SaaS sends for you using its own return-path domain, SPF authenticates that domain — not your From domain — so DMARC sees a misalignment and fails. Fix it with an aligned return-path or DKIM.

How do I find my DKIM selector?

It’s in the DKIM-Signature header of a message you sent, in the s= tag. Common ones are google, selector1/selector2 (Microsoft), s1, k1, and dkim. Enter it above if auto-detection comes up empty.

What’s the SPF 10-lookup limit?

RFC 7208 caps SPF evaluation at 10 DNS lookups. Each include: costs one. Exceed it and SPF returns permerror, which many receivers treat as a fail — so adding senders can quietly break authentication.

Does passing all three guarantee inbox placement?

No — it clears the authentication bar, which is a prerequisite, not a guarantee. Sending-IP reputation, content, list hygiene and engagement still decide inbox versus spam. But you can’t win those until authentication is green.

Email Authentication Checker

Email authentication is the set of DNS records — SPF, DKIM, and DMARC — that let a receiving server confirm a message really came from your domain and decide what to do when it didn’t. Since February 2024, Google and Yahoo require all three from anyone sending bulk mail to their users. This checker reads all three at once and tells you exactly which are in place and which are missing.

How to use it

1
Enter the sending domain
Use the domain in your From address — the part after the @. If you send as [email protected], check acme.com.
2
Add a DKIM selector if you know it
DKIM lives at selector._domainkey.yourdomain. The check auto-detects common selectors, but if it comes back empty and you know yours (google, s1, k1, dkim…), type it in.
3
Read SPF, DKIM and DMARC
Green means the record is published and sane. The verdict line at the top tells you whether you clear the Gmail/Yahoo bar, and each gap links to the tool that fixes it.

How it works

Why all three, and why it got urgent

For years SPF, DKIM and DMARC were “best practice” — recommended, rarely enforced. That changed in February 2024. Google and Yahoo now require bulk senders (roughly anyone sending 5,000+ messages a day to Gmail or Yahoo addresses) to publish SPF, sign with DKIM, and have a DMARC record, plus keep spam complaints under 0.3% and support one-click unsubscribe. Miss those and mail gets throttled or rejected outright.

The practical effect is that a domain which sent fine in 2023 can hit a wall in 2024 with no code change on your side — the receivers moved the goalposts. Checking all three together matters because they’re a chain: DMARC only does its job when SPF or DKIM passes AND aligns with your From domain, so a green SPF with no DMARC still leaves you spoofable and non-compliant.

SPF: who is allowed to send

SPF is a single TXT record starting with v=spf1 that lists the servers permitted to send for your domain — your own mail server, plus every SaaS that sends on your behalf (a help desk, a newsletter platform, your CRM). The receiver checks the connecting server’s IP against that list.

The catch that breaks SPF quietly is the lookup limit: RFC 7208 §4.6.4 allows at most 10 DNS lookups while evaluating the record. Every include: mechanism (and most vendors give you one) counts toward it. Add enough services and evaluation returns permerror, which many receivers treat as an outright fail — so onboarding a new tool can silently break authentication for everything.

DKIM: the cryptographic signature

DKIM proves the message body wasn’t altered and that it really came from a server holding your private key. Your mail platform signs each outgoing message; the receiver fetches the matching public key from a TXT record at selector._domainkey.yourdomain and verifies the signature. The selector is just a label that lets you run several keys at once (one per provider, or old and new during a rotation).

Key length matters: 1024-bit keys are the old floor and 2048-bit is the current recommendation. If DKIM comes back missing here, it usually means the selector wasn’t published or the record was truncated — DNS providers sometimes split long TXT values incorrectly, and a broken public key fails verification the same as no key at all.

DMARC: the policy that ties it together

DMARC is the record that turns SPF and DKIM into an actual decision. It tells receivers what to do when a message fails authentication — p=none (report only), p=quarantine (send to spam), or p=reject (bounce) — and where to send the aggregate reports via the rua= address. Gmail and Yahoo accept p=none to satisfy the requirement, but p=none protects nobody: spoofed mail still lands.

The part people miss is alignment. A message can pass SPF and still fail DMARC if the domain SPF authenticated doesn’t match the From domain — common when a SaaS sends on your behalf using its own return-path. DMARC requires SPF or DKIM to both pass and align with the visible From. That’s why "SPF passes but DMARC fails" is such a frequent, confusing result.

How to read the results

Result	What it means	What to do
SPF — green	A v=spf1 record is published and stays under 10 lookups.	Nothing to do — recheck when you add a sender.
SPF — amber (over 10 lookups)	Evaluation exceeds the RFC limit and can permerror.	Flatten or drop unused include: mechanisms.
DKIM — red (no key)	No public key at the checked selector.	Publish your provider’s DKIM record, or enter the correct selector.
DMARC — amber (p=none)	Published but not enforcing; spoofing still works.	Move to p=quarantine once reports look clean.
DMARC — red (missing)	No DMARC — you fail the Gmail/Yahoo requirement.	Publish at least v=DMARC1; p=none; rua=mailto:you@domain.