Every question here is one somebody actually asked us, answered in one page with the command to check it yourself and the RFC section the rule comes from. Start with the question that matches your symptom. If you have a result from an audit and want to know what caused it, the SPF hub groups those by condition rather than by topic.
Written by Venkat Nookala · Reviewed by Venkat Nookala, last reviewed 2026-09-08.
Straight answers to the questions cold-email senders actually ask. Each one explains the problem and gives you the exact fix. No signup, no card.
The difference between delivery and deliverability, the three layers that decide whether your mail reaches the inbox (authentication, reputation, engagement), and what you can actually control.
Missing or misaligned authentication, a new domain with no reputation, no one-click unsubscribe, or high complaint rates — and why the 2025 Gmail and Microsoft rules mean rejection rather than foldering.
Send to a small set of seed mailboxes you control across Gmail, Outlook, and others, then read each inbox over IMAP to see where the message actually landed.
Checking where mail actually arrives by reading destination inboxes directly, rather than inferring delivery from send-side signals.
The three standards that prove your mail is legitimate: who may send for your domain, a cryptographic signature on each message, and what receivers should do when the checks fail.
One SPF record, ten DNS lookups, clean syntax: the three ways SPF breaks completely, what each looks like in real DNS, and how to fix it in minutes.
Enforcing DMARC with no rua= tag means receivers reject failing mail and send you no reports. What the failure looks like, the one tag that fixes it, and what three checkers said about it.
RFC 9990 gives a report destination two ways to authorize you: a wildcard record covering every domain, or one naming yours. Six destinations measured on two dates, and the one dig command that tells you which applies to you.
DMARC's monitoring mode does nothing without a rua reporting address, and most domains never add one. What p=none means, the subdomain gap, and how to move to enforcement.
Rented mailboxes cost roughly $3–7 each per month and providers restrict cold-email use on consumer-facing plans. What self-hosting on your own infrastructure changes.
RFC 8301 makes 1024 bits the floor a signer may use and 2048 the size it tells signers to use. How to read your key length from DNS, and how to rotate without breaking mail in transit.
p=quarantine covers the domain and sp=none asks receivers to take no action on every subdomain. What the sp tag does in RFC 7489, and the one-tag fix.
The selector record exists, so a record-presence checker says fine. The name it points to returns no TXT, and RFC 6376 calls that PERMFAIL on every message signed with it.
The _mta-sts TXT record only announces a policy. If the policy host does not resolve, RFC 8461 has senders proceed as though MTA-STS was never implemented.
Two to six weeks, scaled by signal rather than a fixed calendar. Start low and increase only while complaint rates stay near zero and authentication passes.
Pools of mailboxes engaging with each other's mail to simulate a good reputation — and why mailbox providers increasingly detect and discount that manufactured signal.
You inherit a sending history you cannot audit, and reputation does not transfer once your sending behavior changes. When they help, when they hurt, and the safer alternative.