If your domain sends 5,000+ emails per day to Gmail, Yahoo, or Outlook users, all three providers now require SPF, DKIM, and DMARC authentication. Fail any of them and your emails don’t land in spam. They bounce. According to MailOver’s 2026 bulk sender guide, non-compliant mail gets rejected at the SMTP level.

I’ve seen teams lose entire campaigns to a single missing DNS record. One wrong character in an SPF entry, one expired DKIM key, and suddenly every cold email returns a 550 error. The fix is almost always the same: understand what SPF and DKIM actually do, how they differ, and set them up correctly.

In this article, I’ll break down how SPF and DKIM work, where they differ technically, why you need both (especially under 2026 enforcement rules), and how to verify your records are set up right.

In simple terms:

SPF ensures that only authorized servers can send emails on your domain’s behalf. DKIM ensures that email content has not been altered in transit.

They work at different levels, protect against different threats, and are configured differently. Let’s walk through each one.

SPF, short for Sender Policy Framework, lets you specify which servers are allowed to send emails from your domain.

For example:

If you use Salesforce to send emails, you’d add their server to your SPF record.

The SPF record would look something like this:

With this server authorized, any server other than Salesforce’s will cause emails to fail authentication.

In other words, SPF stops email spoofing. Criminals use email spoofing to pretend to send email from a trusted domain.

With the correct settings, emails from unauthorized servers will not reach their intended recipients, helping to make the Internet a safer place.

Since SPF-authenticated emails are deemed safer, they can boost your sender reputation and increase your open rates.

The ~all at the end of the SPF record above is a soft fail. It tells receiving servers “if the sender isn’t listed, flag it but don’t necessarily reject it.” A hard fail (-all) tells servers to reject the message outright.

Most deliverability setups use ~all because it’s more forgiving during testing. Once you’re confident in your SPF record, switching to -all gives you stronger protection.

One constraint to watch: SPF records have a 10-DNS-lookup limit. Every include:, a:, or mx: mechanism counts toward that limit. Go over 10, and your entire SPF record fails validation silently. I’ve debugged this for teams who had five different tools in their SPF record and couldn’t figure out why authentication was breaking. If you’re using multiple ESPs, CRMs, and outreach tools, count your lookups.

While SPF operates on the server level, DKIM is concerned with the email’s content.

If an email fails DKIM authentication, it means its content has been altered in transit. This can signal tampering, though legitimate forwarding or mailing-list processing can also break DKIM.

DKIM prevents tampering by using public and private cryptographic keys to sign emails digitally.

Your email Service Provider or sending tool provides both keys. The public key goes into your DKIM record, and the private key is only accessible by your ESP.

The ESP usually decides what to include in the DKIM signature. Depending on your ESP, the DKIM signature can cover the from address, subject line, and body content, or just a subset of these.

If any of these variables get altered during transit, the email will fail authentication.

The DKIM signature includes a d= tag that specifies the signing domain. For DMARC to pass, the domain in the d= tag needs to align with the domain in your From header. This is called DKIM alignment. Having a valid DKIM signature is not enough on its own. If the signing domain doesn’t match your From domain, DMARC will still fail on the DKIM side.

Key length matters too. A 1024-bit key is the minimum accepted by most providers, but 2048-bit is recommended. Yahoo explicitly requires at least 1024-bit keys and will reject messages signed with 512-bit keys. If you’re setting up DKIM through Google Workspace, Google’s DKIM documentation walks through the key generation process.

In 2026, Gmail, Yahoo, and Outlook enforce authentication before your email even reaches the spam folder. It just bounces.

According to MailOver, if a domain sends 5,000 or more emails per day to Gmail, Yahoo, or Outlook users, all three providers now require SPF, DKIM, and DMARC authentication, spam complaint rates below 0.3%, and easy unsubscribe mechanisms. The consequences are real: PowerDMARC reports that compliant senders average 89% inbox placement in 2026, while non-compliant senders see 22–34% of their email routed to spam.

A good open rate can be achieved by having your technical setup in order and not sending any spammy content.

SPF and DKIM are part of your technical setup. But you can’t have just one of these. You need both.

In fact, your technical setup doesn’t stop there. You also need DMARC (which covers the 5,000-email-per-day rule and full 2026 setup instructions) and a Custom Tracking Domain.

When you connect an existing domain or buy a new sending domain in lemlist, the platform can set up authentication automatically through the Deliverability Hub. SPF, DKIM, and DMARC, configured correctly from the start. That removes one of the most common failure points I see: manual DNS setup errors that silently tank deliverability for weeks before anyone notices.

Setting up SPF and DKIM is only half the job. You also need to verify they’re working. Here’s a quick walkthrough.

1. Check your SPF record. Use a free DNS lookup tool like MXToolbox (mxtoolbox.com) to query your domain’s TXT records. Look for a record starting with v=spf1. Confirm it includes all the services you send from and that you’re under the 10-lookup limit.

2. Check your DKIM record. You’ll need your DKIM selector (your ESP can tell you what it is). Query selector._domainkey.yourdomain.com as a TXT record. If it returns a public key, DKIM is published. If it returns nothing, your DKIM record is missing or the selector is wrong.

3. Send a test email. Send a message to a Gmail account, open it, click “Show original,” and look for spf=pass and dkim=pass in the Authentication-Results header. If either says fail, your records need fixing.

4. Use a deliverability checker. Tools like Google Postmaster Tools give you ongoing visibility into how Google sees your domain’s authentication. lemlist’s free deliverability setup checker shows your SPF, DKIM, and DMARC status in one view.

Not fully. SPF only verifies the sending server, so a forwarded email will often fail SPF even if it’s legitimate. DKIM only verifies content integrity, so it won’t stop an unauthorized server from sending unsigned mail. You need both, plus DMARC, for complete protection.

Google and Yahoo recommend authentication for all senders, not just bulk senders. Even below the 5,000/day threshold, properly configured SPF and DKIM improve your sender reputation and inbox placement. There’s no good reason to skip them.

Your entire SPF record becomes invalid. Receiving servers treat it as if no SPF record exists, which will cause SPF-based DMARC alignment to fail. Audit your SPF record regularly, especially when adding new sending tools.

Yes. When a forwarding server or mailing list modifies the message (adds a footer, changes headers), the DKIM signature often breaks because the content no longer matches what was signed. This is one reason you need both SPF and DKIM: they cover each other’s blind spots.

At minimum, check them whenever you add or remove a sending tool, change ESP, or modify your DNS. A monthly audit is a good habit if you’re running outbound at scale.

SPF and DKIM do different jobs. SPF controls which servers can send on your behalf. DKIM proves the message wasn’t altered. You need both, plus DMARC, and in 2026 that’s not a recommendation. It’s a requirement enforced by Gmail, Yahoo, and Outlook with hard bounces.

If you’re running cold outreach, the fastest path is to get authentication right before your first campaign goes out. Not after deliverability drops.

Want to start with authentication handled from day one? Start a 14-day free trial.