Since November 2025, Google no longer soft-bounces non-compliant bulk mail: it rejects it permanently with a 550 error. Yahoo enforces the same rulebook, Microsoft and Apple have joined it, and DMARC graduated to a proposed internet standard (RFC 9989) in May 2026. Authentication stopped being a deliverability optimization and became the entry ticket. This guide sets up all three records for a B2B sending program: what each one does, the exact rules the mailbox providers now enforce, and the policy ramp that gets you to enforcement without losing legitimate replies.

TL;DR

Every domain that sends B2B email needs all three records in 2026: SPF listing your authorized senders (one record, under 10 DNS lookups, ~all), DKIM signing every message with a 2048-bit key on a domain aligned with your From address, and DMARC published at _dmarc.yourdomain, starting at p=none with reporting switched on. Cross the bulk line of 5,000 messages a day to Gmail or Yahoo and the rest becomes mandatory too: spam complaints under 0.3% in Postmaster Tools, one-click unsubscribe honored within 48 hours on marketing mail, TLS, and valid reverse DNS. Ramp DMARC deliberately (p=none for 2-4 weeks of reports, quarantine at low percentage, then reject) and test placement before and after each step with a seed-list tool like GlockApps. Misconfigured authentication now fails silently at the door, so verify, do not assume.

What the three records actually do

The trio answers three different questions a receiving server asks, and passing two out of three is not a passing grade.

SPF: who may send for this domain. A TXT record listing your authorized sending services, like v=spf1 include:_spf.google.com ~all for Google Workspace. Two rules break most setups: exactly one SPF record per domain, and no more than 10 DNS lookups when all the includes unroll. Every tool you bolt on (CRM, billing, sequencer) adds includes, and the 11th lookup silently voids the whole record.

DKIM: was this message signed and untampered. A cryptographic signature on every message, verified against a public key in your DNS. Use 2048-bit keys (1024 is the floor, 2048 is what Google recommends), and sign with the same domain as your From address: alignment is what DMARC will check, and a mismatched signature passes DKIM while failing the check that matters.

DMARC: what happens when the first two fail. Published at _dmarc.yourdomain.com, it tells receivers what to do with unauthenticated mail claiming to be you (nothing, quarantine, or reject) and where to send aggregate reports. The minimum compliant record is v=DMARC1; p=none; rua=mailto:reports@yourdomain.com, and the reporting address is not optional in practice: those reports are the only visibility you get into who is sending as you.

The 2026 enforcement rules, provider by provider

The Google sender guidelines define the template every other provider now follows, and the 2026 provider requirements align on the same thresholds.

The bulk line is 5,000 messages a day to one provider's mailboxes. Under it you still need SPF or DKIM to land anywhere; over it, all three records plus the hygiene rules become mandatory. A B2B program running sequences across a few sending domains crosses this line faster than most teams think.

Spam complaints: under 0.3%, watched in Postmaster Tools. Google and Yahoo both enforce it. Above the line, delivery degrades for the whole domain, which is why list segmentation and clean opt-outs are deliverability work, not just courtesy.

One-click unsubscribe (RFC 8058) on marketing mail, honored within 48 hours. Google, Yahoo, and Apple require the List-Unsubscribe headers; Microsoft recommends them. Transactional mail is exempt; a cold sequence is not the exemption you hope it is.

TLS and valid reverse DNS. Google and Microsoft require TLS outright, and every sending IP needs forward and reverse DNS that match. Your sending platform handles both; a self-hosted SMTP box that skips rDNS gets rejected before content is ever read.

Enforcement is now terminal. Since November 2025, Google answers non-compliance with permanent 550 rejections rather than temporary deferrals. The mail does not slow down; it stops.

The DMARC ramp that protects replies

Publishing p=reject on day one is how teams block their own newsletters, billing mail, and CRM notifications. Ramp it.

Weeks 1-4: p=none, read the reports. Every legitimate sending service shows up in the aggregate reports. Fix SPF includes and DKIM signing for each one until the report shows near-100% alignment on mail you actually send.

Weeks 4-6: p=quarantine, low percentage first. p=quarantine; pct=25 sends a quarter of failing mail to spam while you watch for casualties, then ratchet pct upward as the reports stay clean.

Weeks 6-8: p=reject. Full enforcement, which is also full protection: nobody spoofs a domain at p=reject, and mailbox providers treat the domain's mail accordingly.

Continuously: test placement, monitor reputation. Run a seed-list test in GlockApps before and after each policy step, keep Postmaster Tools open weekly, and if a cold-outbound domain needs its reputation rebuilt alongside the records, a warm-up layer like MailReach does that job while the sequencer rests. The sending infrastructure you choose matters less than whether the domain under it is authenticated and warm; volume and pacing rules live in our Instantly pricing and lemlist pricing breakdowns.

The mistakes that kill authenticated domains

Mistake 1: two SPF records. A second v=spf1 record does not extend the first; it invalidates both. Merge every include into one record.

Mistake 2: blowing the 10-lookup limit. Audit the unrolled includes whenever you add a tool. Flattening services exist for a reason.

Mistake 3: p=reject with no report-reading phase. Enforcement before alignment torches your own transactional mail. The reports are the ramp.

Mistake 4: authenticating the main domain, sending cold from it. Cold outbound belongs on separate sending domains with their own records and warm-up, so a burned campaign never takes the root domain's reputation with it.

Mistake 5: setting records once and never verifying. DNS changes, tools get added, keys rotate. A quarterly check of SPF, DKIM, DMARC, and placement takes twenty minutes and catches the silent failures.

FAQ

Do I need SPF, DKIM and DMARC for cold email in 2026?

Yes, all three, on every sending domain. Google and Yahoo require them for bulk senders and reward them below the threshold, and since late 2025 non-compliant mail is rejected outright rather than deferred. Unauthenticated cold email is undelivered cold email.

What is the minimum DMARC record that satisfies Google and Yahoo?

v=DMARC1; p=none; rua=mailto:reports@yourdomain.com published at _dmarc.yourdomain.com. That passes the compliance check, but p=none is a starting posture: the providers treat enforced domains better, so ramp toward quarantine and reject once reports show alignment.

How long does SPF, DKIM and DMARC setup take?

The DNS records themselves take under an hour on a normal stack: your email provider generates the DKIM key, SPF is one TXT record, DMARC is another. The honest timeline is the 6-8 week DMARC ramp from monitoring to enforcement, which runs in the background.

What happens if I send over 5,000 emails a day without DMARC?

Gmail and Yahoo classify you as a bulk sender and reject or spam-folder the mail; since November 2025 Google issues permanent 550 rejections rather than temporary errors. The threshold counts per provider per day, and sustained near-threshold volume gets treated the same way.

Should cold outreach use a separate domain from the main company domain?

Yes, always: dedicated sending domains (with their own SPF, DKIM, DMARC, and warm-up) isolate campaign risk from the domain your invoices and contracts depend on. Redirect the sending domains to the main site and keep the root domain for signed, low-volume mail.

How do I know my SPF, DKIM and DMARC actually pass?

Send to a seed test and read the authentication results: Gmail's "show original" view shows pass/fail per record, DMARC aggregate reports show alignment over time, and a placement tool like GlockApps shows where the mail actually lands across providers. Verify after every DNS or tool change.

Bottom line

Authentication in 2026 is a pass/fail gate with a public rulebook: one clean SPF record under 10 lookups, 2048-bit DKIM aligned with your From domain, and DMARC ramped from p=none to p=reject on the strength of its own reports. Cross the 5,000-a-day line and the hygiene rules (0.3% complaints, one-click unsubscribe, TLS, rDNS) come with it. Set it up once, verify quarterly, and keep cold outbound on domains that can afford the risk.

Want sending infrastructure that is authenticated, warm, and pointed at pipeline? Book a call with GROU. We build and run outbound systems, deliverability included, for B2B teams.

We are GROU, a B2B pipeline agency that runs lead generation, outbound, and LinkedIn content for clients across manufacturing, fintech, iGaming, software, and professional services. The setup and ramp reflect the deliverability standards we run across client sending programs between 2024 and 2026.

Some links in this article are affiliate. We may earn a small commission at no extra cost to you. We only recommend tools we've deployed for clients.