StopBouncingWhy SPF and DKIM Matter
Gmail and Yahoo announced in 2024 that bulk senders (anyone sending 5,000+ emails per day) must have SPF, DKIM, and DMARC configured or their emails will be rejected. Even for lower-volume senders, missing authentication records significantly increase spam folder placement rates.
Without SPF, any server in the world can send email appearing to come from your domain. Without DKIM, receiving servers can't verify that messages haven't been modified in transit. Together, they form the foundation of email authentication.
SPF & DKIM FAQ
What is an SPF record?
An SPF (Sender Policy Framework) record is a DNS TXT record that lists which mail servers are authorized to send email from your domain. When a receiving server gets an email claiming to be from your domain, it checks the SPF record to verify the sending server is authorized. Missing or incorrect SPF records increase the chance of your email landing in spam.
What is DKIM?
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to your outgoing email messages. The receiving server uses your DKIM public key (published in DNS) to verify that the message came from your domain and wasn't altered in transit. DKIM is required by Gmail and Yahoo for bulk senders since 2024.
What is the difference between SPF softfail (~all) and hard fail (-all)?
With ~all (softfail), email from unauthorized servers is tagged as suspicious but usually still delivered. With -all (hardfail), email from unauthorized servers should be rejected outright. Start with softfail while you confirm all your sending sources are in the record, then switch to hardfail for maximum protection.
Why does DKIM not show for my domain?
DKIM keys are published at a specific selector subdomain (e.g., google._domainkey.yourdomain.com). This tool checks common selectors (google, default, mail). If your email provider uses a different selector, check your provider's DKIM configuration documentation to find the correct selector name.