Check your email authentication before Black Friday: a 10-minute pre-send check

Before you start: list every platform that sends as you

Most authentication failures in a busy season come from a sender nobody remembered: the newsletter tool, the store platform's order emails, the help desk, a review-request app, a new SMS-and-email tool added for the sale. Write down each one and the exact From address it uses (for example news@yourstore.com or orders@shop.yourstore.com). The domain after the @ is what you check, and a subdomain counts as its own name.

The check, in order

1. SPF: one record, under 10 lookups

There must be exactly one TXT record starting v=spf1 at each From domain (or at the platform's bounce subdomain, see step 4). Two SPF records is a permanent error, and receivers then treat SPF as failed.
Every include: counts toward a limit of 10 DNS lookups. Adding a new platform's include right before a campaign is the most common way to go over it. The checker above counts them for you.
End with ~all or -all. +all lets anyone pass.

2. DKIM: signed with your domain

Each platform should sign with a key published under your domain, at selector._domainkey.yourstore.com. Most platforms give you two or three CNAME records to add during "domain authentication" or "sender verification" in their settings.
If a platform signs only with its own domain (d=platform.com), DKIM passes but doesn't count for your DMARC. That's the gap to close before peak season.
Use a 2048-bit key where the platform offers one.

3. DMARC: published, with reports turned on

A TXT record at _dmarc.yourstore.com, starting v=DMARC1. p=none is the minimum the large mailbox providers ask bulk senders for.
Add rua=mailto:… so you receive daily aggregate reports. They show every server sending as your domain and whether it passed, which is how you find the platform you forgot.
Don't tighten the policy in the middle of the season. Moving from p=none to quarantine or reject is right once reports show all your real senders passing, but doing it the week of a big send risks blocking a sender you missed. If you haven't read your reports yet, keep p=none until January.

4. Alignment: the step most checklists skip

DMARC passes only if SPF or DKIM passes for the same domain as your From address (or, by default, a subdomain of it). A platform can pass SPF for its own bounce domain and still fail your DMARC. For each platform, look at one real message's headers (in Gmail: ⋮ → Show original):

dkim=pass header.d=yourstore.com → aligned through DKIM. Good.
spf=pass smtp.mailfrom=bounces.platform.com with no aligned DKIM → DMARC fails. Turn on domain authentication (DKIM) in that platform, or set a custom return-path on a subdomain of yours.
dmarc=pass in the Authentication-Results line is the answer you want for every platform.

5. Inbound: MX still works

Customers reply to sale emails and order confirmations. Check that your MX records resolve, so those replies don't bounce during your busiest week.

What the big mailbox providers ask of bulk senders

Since February 2024, Gmail and Yahoo require more of anyone sending around 5,000 or more messages a day to their users, and Outlook.com added similar rules for high-volume senders in 2025. In short:

SPF and DKIM for the sending domain.
A DMARC record (at least p=none), with the From domain aligned with SPF or DKIM.
One-click unsubscribe (the List-Unsubscribe and List-Unsubscribe-Post headers) on marketing mail, with unsubscribes honoured within two days.
Low spam-complaint rates. Gmail's stated threshold is 0.3%, and it advises staying well below it.

Smaller senders have lighter requirements, but the same setup helps every sender. One-click unsubscribe and complaint rates are handled in your email platform, not in DNS, so this checker can't see them; check those settings there.

Worked example: our own domain

Running the check above on mistermarbi.com today shows:

mistermarbi.com TXT "v=spf1 include:_spf.mail.hostinger.com ~all"

_dmarc.mistermarbi.com TXT "v=DMARC1; p=none; rua=mailto:dmarc-reports@mistermarbi.com"

SPF: one record, 3 of 10 lookups, soft fail at the end. Passes.
DKIM: the mail host's selectors are CNAMEs to the provider, which rotates keys itself.
DMARC: published, with reports on. The checker flags p=none as a warning, because it monitors but doesn't protect. For us that's a deliberate choice until a few weeks of reports confirm every sender aligns, which is the same advice we'd give a store before a holiday rush.

What this check can't tell you

Passing authentication is necessary, but it doesn't guarantee inbox placement. Mailbox providers also weigh your sending history, complaint rates, list quality and sudden volume jumps. Nobody can honestly promise inbox delivery; the check above makes sure authentication isn't the reason you miss it.

Quick pre-send list

Every sending platform listed, with its From domain.
One SPF record per domain, 10 lookups or fewer.
DKIM signed with your domain on every platform.
DMARC published with rua; policy unchanged during peak.
A real message from each platform shows dmarc=pass.
MX resolves for replies.

Check email authentication before Black Friday