When outreach gets no replies, the cause is often the sending domain's DNS, not the copy. Below: what each record does, which one is missing most often, who sets them up, and what Google, Yahoo and Microsoft now require.
What is email authentication?
Email has no built-in proof of sender: anyone can write any address into the From line. Three DNS records close that gap, and Gmail, Outlook and Yahoo check them on every message.
A domain without them is treated as unverified. For a cold sender that usually means the spam folder, and every such delivery lowers the domain's reputation a little further.
What do SPF, DKIM and DMARC each do?
Each record answers a different question in the sending domain's DNS.
| What it checks | Where in DNS | Typical mistake | How to check | |
|---|---|---|---|---|
| SPF | Which servers may send for the domain | TXT record on the sending domain, starting v=spf1 | Too many includes: more than 10 DNS lookups makes SPF fail | Count the include terms |
| DKIM | That the domain signed the message and nobody changed it | TXT record at the selector under _domainkey | Key missing or under the wrong selector | Open a sent message's headers and look for dkim=pass |
| DMARC | That SPF or DKIM passed for the From domain, and what to do if not | TXT record at _dmarc on the domain | No record, so failures have no policy | Check the policy and report address |
The 10-lookup limit is set by RFC 7208. DMARC is defined by RFC 9989, which replaced RFC 7489 in May 2026.
DMARC adds alignment: passing SPF or DKIM is not enough if the domain that passed differs from the one in the From line. That check stops someone from authenticating their own domain while displaying yours.
The three records are open standards. RFC 7208 defines SPF, including the limit of 10 DNS lookups. RFC 6376 defines DKIM signatures with the public key in DNS. RFC 9989, a Proposed Standard published in May 2026, defines DMARC and obsoletes RFC 7489 and RFC 9091. Spamhaus's sender guidelines ask for DKIM keys of at least 1024 bits, 2048 recommended, and from November 2026 for consistent HELO, PTR and A records.
Which record is missing most often, and what happens then?
In Leadspicker's support experience DKIM is the record missing most often, and missing records are the most common reason behind 'sending but no replies'. Without DKIM the receiver has no signature to verify and DMARC can only rest on SPF.
The second common gap is checking the wrong domain. Records must resolve for the exact domain in the From address; a subdomain or a separate outreach domain is not covered by the root domain's records. Then check every domain in the rotation. One domain in a set of ten silently misconfigured is common.
- List every sending domain, including subdomains.
- SPF: one record, under 10 lookups, naming your actual provider.
- DKIM: key published for your provider's selector; a test message shows dkim=pass.
- DMARC: a record with at least p=none and a report address.
- Re-check whenever you add a domain or change provider.
Who sets the records up: you, the provider or the tool?
It depends on how the mailbox connects. The domain owner controls DNS, so a sending tool can only set records for domains it sells you.
| Connection | Who configures DNS | What the tool can see |
|---|---|---|
| Gmail or Outlook through the official connector | You, following Google's or Microsoft's setup guide | The mailbox; the DNS is yours to check |
| Custom SMTP | You, entirely | Nothing: the platform cannot see your DNS or warn you |
| Mailboxes bought through Custom Domains | Set before delivery | Records arrive configured |
Responsibilities as described in the Leadspicker knowledge base, August 2026, pending clearance.
What do Google, Yahoo and Microsoft require from senders?
All three enforce authentication for bulk senders. Since February 2024 Google requires SPF, DKIM and DMARC with alignment, one-click unsubscribe and a spam rate below 0.3% from anyone sending more than 5,000 messages a day to Gmail. Yahoo asks bulk senders for SPF and DKIM, a DMARC record of at least p=none, and one-click unsubscribe. Since May 2025 Microsoft requires SPF, DKIM and DMARC from domains sending more than 5,000 messages a day to Outlook; failing mail goes to junk and is later rejected with error 550 5.7.515.
A cold sender is far below those thresholds, but receivers run the same checks on every message.
Leadspicker's support team sees missing records, most often DKIM, as the usual cause of 'sending but no replies'.
Frequently asked questions
Do I need SPF, DKIM and DMARC for cold email?
Yes. Receivers check all three on every message, whatever the volume. A cold domain without them is treated as unverified and lands in spam far more often.
Is RFC 7489 still the DMARC standard?
No. RFC 9989, published in May 2026, obsoletes RFC 7489 and RFC 9091 and is the current DMARC reference.
How do I check that my records work?
Send a test message to a mailbox you control and open its headers. Look for spf=pass, dkim=pass and dmarc=pass for the domain in the From line, then repeat for every domain in the rotation.
- IETF, RFC 7208: Sender Policy Framework (SPF)
- IETF, RFC 6376: DomainKeys Identified Mail (DKIM) Signatures
- IETF, RFC 9989: DMARC (May 2026)
- Google, Email sender guidelines (in force from February 2024)
- Microsoft, Outlook postmaster policies (May 2025)
- Yahoo Sender Hub, Best practices
- Spamhaus, Sender guidelines
- GTM playbook for 2026 by Leadspicker, chapters: Email authentication; Connecting your email; Buying domains and mailboxes
