Why email deliverability starts with your domain setup
Most people think getting into the inbox is about the subject line. A catchy hook, no spammy words, the right time to send. Those things matter, but they come second.
Before Gmail or Outlook even looks at what you wrote, it asks a simpler question: is this email really from who it says it is? If your domain cannot prove it, the best copy in the world ends up in spam, or never arrives at all.
That proof lives in three DNS records on your domain: SPF, DKIM and DMARC. Together they are called email authentication, and they are the foundation of your deliverability. The checker above reads all three, plus your MX records, and tells you in plain words what is in place and what is missing.
What are SPF, DKIM and DMARC?
Think of your domain as a company letterhead. Anyone can print a fake one. These three records are how the receiving side checks that a letter is genuine.
- SPF (Sender Policy Framework) is your guest list. It names the servers that are allowed to send email for your domain: your mailbox provider, your newsletter tool, your app. When an email arrives from a server that is not on the list, the receiver gets suspicious.
- DKIM (DomainKeys Identified Mail) is your signature. Every email you send gets signed with a private key, and the matching public key sits in your DNS. The receiver checks the signature against it, which proves the email came from you and was not changed along the way.
- DMARC (Domain-based Message Authentication, Reporting and Conformance) is your instruction to the receiver. It says what to do when an email claims to come from your domain but fails SPF and DKIM: deliver it anyway, send it to spam, or reject it. It can also send you reports on who is sending email in your name.
Gmail and Yahoo requirements for SPF, DKIM and DMARC
For years, plenty of domains got away with a half-done setup. That changed in February 2024, when Gmail and Yahoo started enforcing new rules for anyone sending in volume.
If you send more than about 5,000 emails a day to Gmail or Yahoo addresses, you now need SPF and DKIM both set up, a DMARC record (even a relaxed p=none policy counts), and your From address aligned with one of them. Below that volume, you still need at least SPF or DKIM. Microsoft followed with similar rules for Outlook in 2025.
Missing a record rarely means instant rejection. It means your emails are trusted less, land in spam more often, and get throttled first when something else goes wrong. Fixing it is free and takes minutes, which makes it the highest-return deliverability work you can do.
How to read your SPF, DKIM and DMARC check results
Each record comes back with one of three states. Pass means inbox providers can use it as it is. Warning means it works but leaves something on the table, like a DMARC policy that only watches, or a DKIM key shorter than recommended. Fail means receivers will treat the record as missing or broken.
At the top, the verdict tells you whether your domain meets the Gmail and Yahoo requirements, and if not, which records are holding it back.
One honest limit: DKIM keys hide behind a name called a selector, and DNS has no way to list them. The checker tries the selectors used by common services like Google Workspace, Microsoft 365, Mailchimp, SendGrid and Resend. If yours uses another one, add it under the domain field. You will find it as s= in the DKIM-Signature header of any email you sent.
Common SPF, DKIM and DMARC mistakes
Almost every broken setup comes down to one of these.
- Two SPF records. You add a new email tool, it asks you to create an SPF record, and you add a second one instead of editing the first. Receivers treat two SPF records as an error, so SPF fails for every email you send.
- Going over the 10 lookup limit. Every include in your SPF record can pull in more includes, and receivers stop counting at 10 DNS lookups. Past that, SPF breaks even though every service is listed. The checker counts them for you.
- DMARC stuck on `p=none`. It is the right place to start and it satisfies Gmail and Yahoo. But it does nothing to stop someone sending phishing emails in your name. Once your reports show only your own tools, move to
quarantine, thenreject. - A tool sending without DKIM. Your mailbox signs its emails, but the tool sending your newsletters or product emails does not. Every service that sends as your domain needs its own DKIM key in your DNS.
How to fix SPF, DKIM and DMARC errors
Every fix happens in the DNS settings of your domain, wherever you bought it or host its DNS. Change one record at a time, then run the checker again. Most changes show up within minutes, some DNS hosts take a few hours.
For SPF, keep a single record that includes every service you send with, and end it with ~all. For DKIM, copy the key your sending service gives you, under the exact name it asks for. For DMARC, start with v=DMARC1; p=none; rua=mailto: followed by an address you actually read, then tighten the policy once the reports look clean.
And if you send marketing emails, consider doing it from a subdomain like news.yourcompany.com. It keeps the reputation of your newsletters apart from the mailboxes your team uses every day. You can check a subdomain here too: just type it in.