Is your domain ready for cold email?

What we look for: One v=spf1 record. 10 DNS lookups or fewer. 2 void lookups or fewer. Ends in ~all or -all, never +all.

Why it matters: More than 10 lookups, or two SPF records, is a permanent error: SPF returns an error instead of a pass (RFC 7208, section 4.6.4). Gmail and Yahoo require SPF or DKIM from every sender.

What we look for: A record at _dmarc.yourdomain, its policy (none, quarantine or reject), pct and a rua= reporting address.

Why it matters: Gmail and Yahoo have required DMARC from bulk senders since February 2024; p=none is accepted. Microsoft has rejected non-compliant mail to outlook.com, hotmail.com and live.com from senders of 5,000+ a day since 5 May 2025.

What we look for: A public key on 14 common selectors (google, selector1, selector2, s1, k1 and 9 more) and its key length.

Why it matters: Bulk senders need both SPF and DKIM. Custom selectors can’t be listed from DNS, so when we find nothing we say “not found”, never “fail”.

What we look for: MX records exist, and which mailbox provider runs them (Google, Microsoft or other).

Why it matters: Without MX, replies have nowhere to land. The provider sets the SPF include we suggest in the fix.

What we look for: A default._bimi record.

Why it matters: Shows your logo in supporting inboxes, and only once DMARC enforces.

Yes. Inbox Health lite checks SPF, DKIM, DMARC and MX for any domain and returns a fix list ranked by severity, with the exact record to publish. It is free. General DNS tools such as MXToolbox and Google’s Check MX read the same records; ours ranks the fixes for teams sending cold email.

Usually something did change, just not your copy. A new tool’s SPF include can push you past the 10-lookup limit. Volume can cross a bulk-sender threshold (5,000 a day to Gmail or Outlook). Complaints can rise past Gmail’s 0.3% ceiling, or a domain can land on a blocklist. Check DNS first, then volume, complaints and blocklists.

Send cold email from separate secondary domains, not your main one. On each, publish one SPF record that includes only your sending provider, turn on DKIM signing with a 2048-bit key, and publish DMARC at p=none with a rua= address so you can read reports. Keep sign-in and receipt mail on its own domain, out of any warm-up pool. We learned that last rule on our own setup on 29 Sep 2026.

Gmail requires SPF or DKIM from every sender. If you send 5,000 or more messages a day to personal Gmail accounts, it requires both, plus DMARC, with your From: domain aligned to SPF or DKIM. A new cold email domain should have all three from day one.

Stop sending from that domain first. Check it against the major blocklists, read its compliance status and spam rate in Google Postmaster Tools (and Microsoft SNDS if you send from your own IPs), and fix any authentication errors. Move outreach to fresh secondary domains, warm them up and send less per mailbox. There is no fixed recovery time: scale again only once spam rate and blocklist status are clean.

For the bulk-sender rules, yes. Gmail and Yahoo accept p=none as long as DMARC passes with an aligned SPF or DKIM domain, and Microsoft asks for at least p=none. But p=none only monitors: it does not stop spoofing. Move to p=quarantine once your reports show every real sender passing.

RFC 7208 caps one SPF check at 10 DNS-querying terms: include, a, mx, ptr, exists and redirect. Every include for a tool uses at least one, and nested includes count too. Past 10, receivers return a permanent error, so SPF fails for every message from that domain.

No. It means your domain can pass authentication. Placement also depends on volume, complaint rate, bounce rate, list quality and content, which DNS can’t show. Our free growth report adds blocklist lookups and, if you give us read access, Postmaster Tools compliance status.

The free check reads public DNS and keeps no copy of the domain or the result. If you ask for the growth report, we keep your email and domain so we can send it to you. We never publish a domain by name.