Before sending creator partnership emails, ask your technical team to verify SPF authorization, DKIM signing and DMARC alignment for every sending route. Then test messages from the actual outreach tool, using the intended From address. Save the receiving mailbox's authentication results. A DNS record alone does not show that the tool sends correctly, and passing authentication cannot guarantee inbox placement.
This handoff applies whether a manager sends individual invitations or uses an outreach platform. Keep recipient selection separate. Use only creator-welcomed business inquiry routes where applicable rules permit the message. Our guide to finding a creator's business email without guessing private details covers that earlier decision.
What SPF, DKIM and DMARC each check
The names describe different checks. Ask the technical team to explain which domain passes each one.
| Method | What it does | Evidence to request |
|---|---|---|
| SPF, Sender Policy Framework | Lets a domain authorize sending servers through DNS | The sending service is authorized, and a received test passes SPF |
| DKIM, DomainKeys Identified Mail | Adds a domain signature that a receiver can verify | A received test passes DKIM, with the expected signing domain |
| DMARC, Domain-based Message Authentication, Reporting and Conformance | Connects authentication to the visible From domain and publishes a policy for failures | A received test passes DMARC through an aligned SPF or DKIM identity |
Yahoo's sender documentation explains SPF authorization and DKIM signatures. Google's DMARC instructions explain the alignment test. An SPF pass uses the envelope-sender domain, also called the Return-Path or bounce domain. A DKIM pass uses the signing domain, shown in the signature's d= value.
Those domains can differ from the address a creator sees. DMARC requires at least one passing method whose domain also aligns with the visible From domain. A provider can pass SPF and DKIM for its own domain while your message still fails DMARC.
Provider requirements and the team's setup target
Google's sender guidelines require SPF or DKIM for all senders to personal Gmail accounts. For senders sending 5,000 or more messages per day to those accounts, Google requires SPF, DKIM and DMARC. Its bulk rules allow a DMARC policy of p=none and require alignment for direct email.
Yahoo's requirements also require SPF or DKIM for all senders. Bulk senders must use both, publish a valid DMARC policy of at least p=none, and pass DMARC. Yahoo accepts relaxed alignment. Do not assume Google's numerical threshold defines Yahoo's bulk category.
For an outreach setup, our recommendation is to configure all three before launch, even when the provider's minimum is lower. Google recommends all three, too. This establishes an authentication baseline. Each new sending route still needs provider setup, DNS and alignment checks, and a received-message test.
Authentication is one part of the requirements. Google also requires TLS for transmission and valid forward and reverse DNS. Both providers impose additional rules on bulk marketing and subscribed messages, including unsubscribe functionality. Have the provider or administrator confirm which requirements apply to your traffic. Coordinate that work with the person who enforces opt-outs across outreach lists.
Send this checklist to the technical owner
Ask for evidence against each row. Assign the DNS changes to someone who already manages the domain.
| Check | Technical handoff |
|---|---|
| Sending inventory | List the mailbox service, outreach tool, CRM, website and other services sending for the domain |
| Visible identity | Record the intended From address for each route |
| SPF | Confirm the actual sending service is authorized for its envelope-sender domain |
| DKIM | Confirm signing is enabled and identify the signing domain on received messages |
| DMARC | Confirm the published policy and which passing method supplies alignment |
| Reporting | Name the mailbox or service receiving DMARC reports and the person reviewing them |
| Receiver tests | Save authentication results from controlled Gmail and Yahoo test mailboxes |
| Infrastructure | Obtain confirmation of required DNS and transport settings from the sending provider |
| Change ownership | Name who rechecks authentication when a tool, domain or sending route changes |
Google's SPF setup guide starts with an inventory of senders. Follow that order. Copying a DNS example for one mailbox service may leave another service out. Ask the administrator to use the current instructions from each provider and preserve legitimate existing senders.
For a new DMARC rollout, Google recommends starting with p=none, reviewing authentication, then moving toward quarantine or reject. A monitoring policy does not request rejection of failing mail. If your domain already has an enforcement policy, ask its owner to diagnose the new route before proposing a policy change.
Do not paste a sample DMARC record into production without checking the reporting destination and alignment settings. Reports need an owner who will read them.
A hypothetical alignment failure
Suppose a brand sends a partnership invitation through a newly added outreach service. The following domains and results are hypothetical.
| Field or result | Received test |
|---|---|
| Visible From | partnerships@brand.example |
| Envelope-sender domain | mailer.example.net |
| SPF result | Pass for mailer.example.net |
| DKIM signing domain | mailer.example.net |
| DKIM result | Pass |
| DMARC result | Fail |
Both authentication methods pass for a different domain. Neither authenticates an identity aligned with brand.example, so this test fails DMARC.
The next question for the provider is whether the account has completed its custom-domain authentication setup. Ask it to identify a supported way to authenticate an aligned domain. Then send another test through the same outreach route and inspect the result. Editing the display name or writing a more personal subject line would leave this alignment problem unchanged.
Questions to ask when the test fails
Use these questions to keep the investigation tied to the message:
- Did the test leave through the outreach platform, or through a manager's normal mailbox?
- What From domain did the receiver see?
- Which domain passed SPF, and which domain signed with DKIM?
- Which passing method was expected to satisfy DMARC alignment?
- Did the provider finish enabling signing after the DNS records were published?
- Was this a direct test, or did forwarding change the delivery path?
- What changed since the last passing test?
Save the message date, sending route and relevant authentication results with the support request. Keep private message content and credentials out of shared tickets. If the message bounced, use the separate hard- and soft-bounce diagnosis guide to organize the rejection evidence.
A passing test establishes what happened on that route at that time. Google explicitly says it cannot guarantee that an email provider's messages will pass Gmail's spam filters. Recipient feedback and sending practices still matter. Modash's discussion of mass outreach argues for creator research and relevant messages; authentication does not replace that editorial work.
Before approving the send, ask the technical owner for a dated test from every planned sending route, the aligned domain, and a named DMARC-report reviewer. Leave any unexplained failure open until that route passes a new test.
