Since 2024, Gmail and Yahoo require senders of large volumes of mail to authenticate it properly: SPF and DKIM, a DMARC record, valid forward and reverse DNS for sending servers, TLS, easy unsubscription and a low spam complaint rate. Mail that misses them is increasingly rejected or sent to spam. If your newsletter open rates suddenly dropped, or a provider's bounce message mentions authentication requirements, these rules are the first thing to check.
The Email Provider Compliance Check runs the technical checks behind those requirements for a sending domain and maps each one to a clear result: pass, problem, warning or not checked. It is honest about what it cannot see: requirements that depend on a real message or on provider data are listed as not checked, never as passed.
What is the Email Provider Compliance Check?
In simple terms
It is a checklist run against your domain. It looks up the DNS records large mailbox providers expect a bulk sender to have, connects once to your mail server to see whether it offers encryption, and tells you which boxes are ticked and which are not.
Technical background
Gmail's and Yahoo's sender guidelines distinguish all senders from bulk senders (Google defines bulk senders as those sending close to 5,000 or more messages a day to personal Gmail accounts). For bulk senders, the published requirements include:
- SPF and DKIM authentication for the sending domain (RFC 7208, RFC 6376).
- A DMARC record for the sending domain, with at least
p=none(RFC 7489), and DMARC alignment: the From: domain must align with the SPF or DKIM domain. - Valid forward and reverse DNS for sending IPs: the IP's PTR name must resolve back to the IP.
- TLS for transmitting mail.
- One-click unsubscribe for marketing and subscribed messages, using
List-UnsubscribeandList-Unsubscribe-Postheaders (RFC 8058). - A low spam complaint rate, as reported in the provider's postmaster tools (Google asks senders to keep it below 0.1% and never reach 0.3%).
- Correctly formatted messages according to RFC 5322.
Only some of these are visible from outside. DNS records can be read by anyone; TLS and reverse DNS can be tested for servers that DNS points to. Alignment, headers and complaint rates are properties of actual messages and provider statistics.
Why use the Email Provider Compliance Check?
- Quick gap analysis before a provider deadline or a large campaign.
- Bounce investigation when messages are rejected with authentication-related errors.
- Vendor onboarding: after connecting a new email platform, check that the domain still has valid SPF, a DKIM key and DMARC.
- Clear scope: the report separates "passed", "problem" and "not checked", so you know what still needs a manual check.
Who should use it?
- Marketing operations and CRM teams sending newsletters or notifications at volume.
- Mail and DNS administrators responsible for a sending domain.
- SaaS companies sending transactional mail on behalf of their product.
- Agencies auditing a client's sending setup.
How the Email Provider Compliance Check works
The check runs from your browser against the NetTools.tech API, one step after another (the API allows only a few parallel requests per visitor):
- MX lookup for the domain, including the addresses and reverse DNS (PTR) of the first address of each MX host.
- SPF lookup, recursively evaluating includes and counting DNS lookups.
- DMARC lookup at
_dmarc.<domain>, falling back to parent domains. - MTA-STS and TLS-RPT lookups (run as part of the shared mail checks; they are not part of the compliance rows).
- DKIM lookup at
<selector>._domainkey.<domain>, only if you entered a selector. - SMTP test on port 25 of the highest-priority MX host: banner, EHLO and STARTTLS, then QUIT. No message is sent.
DNS queries go to public resolvers (Cloudflare 1.1.1.1 and Google 8.8.8.8). The results are then mapped to six rows:
| Row | Pass condition |
|---|---|
| SPF published and valid | Exactly one SPF record and no SPF errors (syntax, more than 10 lookups, …) |
| DKIM key published | A key of at least 1024 bits at the selector you entered |
| DMARC published (p=none or stronger) | A DMARC record with a p tag is found |
| TLS when receiving mail | The MX host completes STARTTLS on port 25 |
| Reverse DNS of mail servers | Every MX host with an address has a PTR record (missing PTR is a warning) |
| From/DKIM/SPF alignment, one-click unsubscribe, spam rate | Always "Not checked" |
The whole run has a 60-second limit. The SMTP step follows the SMTP Test's safeguards: public IPs only, strict timeouts, and at most three tests per mail server in ten minutes across all users.
How to use the NetTools.tech Email Provider Compliance Check
- Open the Email Provider Compliance Check.
- Enter your Domain, the domain in the From: address of your bulk mail, for example
example.com. - Enter the DKIM Selector. Find it in the
DKIM-Signatureheader (s=) of a message you sent; the Email Header Analyzer shows it. Without a selector, the DKIM row is "Not checked". - Press Run Email Provider Compliance Check. In the terminal use
/email-compliance example.com --selector selector1. - Read the summary line and the table, then open the expandable details for the underlying findings.
- Check the items marked "Not checked" with a real message and your provider's postmaster tools.
Understanding the results
| Result | Meaning | What to look for |
|---|---|---|
| Summary line | "All checked items pass", "No problems; N warnings" or "N problems and M warnings found" | "Not checked" rows are not counted either way |
| Pass | The requirement is met as far as DNS and the SMTP test can show | Still verify alignment with a real message |
| Problem | A requirement that can be checked is not met | Open the details for the exact finding |
| Warning | Reverse DNS is missing on at least one MX host | Matters most if those hosts also send mail |
| Not checked | No selector, the MX could not be tested, or the requirement needs a message or provider data | Check manually |
| SPF summary | "Yes", the first SPF error, or "Check failed: …" | A failed lookup is a problem, not a pass |
| DKIM summary | "Yes (2048 bits)" or "No usable key for this selector" | A wrong selector also shows as no usable key |
| DMARC summary | p=none, p=quarantine, p=reject or "No DMARC record" | Details show if the record was inherited from a parent domain |
| TLS summary | TLS version and MX host, "STARTTLS not offered" or "Could not test the MX" | Certificate problems appear in the SMTP Test, not here |
| Reverse DNS summary | "Present" or "Missing for <hosts>" | Only MX hosts are checked |
| Note | Based on Gmail and Yahoo bulk-sender requirements; sending IPs may differ from MX hosts | Check your real outbound IPs separately |
Example: a domain with one gap
For example.com with selector s2026, the report shows:
1 problem and 0 warnings found.
Check Result Summary
SPF published and valid Pass Yes
DKIM key published Pass Yes (2048 bits)
DMARC published (p=none or stronger) Problem No DMARC record
TLS when receiving mail Pass TLSv1.3 on mail.example.com
Reverse DNS of mail servers Pass Present
From/DKIM/SPF alignment, one-click unsubscribe, spam rate Not checked Need a real message or provider data …The fix is a DMARC record. A minimal record that meets the requirement, with reports so you can see what happens:
_dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:[email protected]"The DMARC Record Generator builds it. Then send a newsletter test to a Gmail or Yahoo mailbox you control, open the original message and check Authentication-Results for dmarc=pass and the List-Unsubscribe-Post: List-Unsubscribe=One-Click header.
Common use cases
- Pre-campaign check before a large send.
- Requirement audits across several sending domains or subdomains (for example
news.example.com). - After DNS changes to SPF, DKIM or DMARC, to confirm nothing broke.
- Bounce analysis when a provider rejects mail citing authentication or sender requirements.
Troubleshooting
DKIM shows "No usable key for this selector"
The selector is wrong, the record is missing, or the key is shorter than 1024 bits. Take the selector from the s= tag of a current message, and check the key with DKIM Lookup. The check counts key size, so a valid Ed25519 key (256 bits) is also reported as no usable key; verify such keys with DKIM Lookup.
TLS shows "Could not test the MX"
The SMTP connection to the first MX host failed or was rate limited (three tests per server in ten minutes across all users). Wait a few minutes, then run the SMTP Test on the MX host for the detailed session.
DMARC passes here but providers report DMARC failures
The record exists, but messages fail alignment: the Return-Path domain does not match From:, or DKIM is signed with the provider's domain instead of yours. Look at a real message in the Email Header Analyzer and configure custom DKIM or a custom bounce domain at your sending platform.
SPF is a problem but the record looks fine
The details list the SPF errors. The most common is exceeding 10 DNS lookups through nested includes; SPF Lookup shows the include tree.
Common mistakes
- Reading "All checked items pass" as full compliance while alignment, unsubscribe headers and spam rate are unchecked.
- Checking the organization's main domain while bulk mail is sent from a subdomain or a different domain.
- Leaving the selector empty and assuming DKIM is fine.
- Assuming reverse DNS on MX hosts covers the newsletter platform's sending IPs.
- Fixing DNS but not the sending platform's DKIM or bounce-domain configuration, so alignment still fails.
Limitations
- Only the Gmail and Yahoo bulk-sender requirements are the basis of the report; other providers' rules are not mapped.
- Alignment, one-click unsubscribe, RFC 5322 formatting and spam rate are never checked; they need a real message or provider data.
- Reverse DNS is checked for MX hosts only, and only for the presence of a PTR record, not forward confirmation. Your sending IPs may be different servers.
- TLS is tested inbound on the domain's first MX host from the NetTools.tech server, which shows whether your mail system supports STARTTLS, not whether every outbound path uses it.
- DKIM is checked only for the selector you supply; DKIM keys under other selectors are invisible.
- Provider requirements change; the check reflects the requirements implemented at the time and is not an official provider tool.
Security & privacy
You enter a public domain and optionally a DKIM selector. DNS queries go to public resolvers, and the only connection to your infrastructure is one read-only SMTP session to your MX host (banner, EHLO, STARTTLS, QUIT): no message, sender or recipient is transmitted. No mailbox credentials are requested or used; never enter passwords into any email testing tool. Internal domain names are rejected, and the requests are rate limited per client.
Related tools
- Email Health Check – the full MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT and SMTP report (guide).
- Email Header Analyzer – check alignment and unsubscribe headers of a real message (guide).
- DMARC Lookup – the DMARC record in detail (guide).
- SPF Lookup – include tree and lookup count (guide).
- DKIM Lookup – the key for any selector (guide).
- SMTP Test – full STARTTLS and certificate details (guide).
Summary
Gmail and Yahoo require bulk senders to authenticate mail with SPF, DKIM and DMARC, use TLS, maintain valid reverse DNS and keep complaints low. The NetTools.tech Email Provider Compliance Check verifies the DNS- and SMTP-visible parts for a sending domain and clearly marks what it cannot see. Treat a pass as "the infrastructure is in place", then confirm alignment and unsubscribe headers with a real message and complaint rates in the providers' postmaster tools.
Frequently asked questions
Which provider requirements does this check cover?
It is based on the published bulk-sender requirements of Gmail and Yahoo. It checks the parts that can be verified from DNS and a single SMTP connection: SPF, a DKIM key for a given selector, a DMARC record, TLS on the domain's MX and reverse DNS of the MX hosts.
Does it check Microsoft Outlook.com requirements?
No. The report refers only to the Gmail and Yahoo bulk-sender requirements. Many technical points overlap across providers, but the check does not map results to any other provider's rules.
Why is DKIM shown as not checked?
DKIM keys are published under a selector name that cannot be listed from DNS. Enter the selector from the s= value of a DKIM-Signature header in one of your sent messages, and the check will look up that key.
Does a full pass mean my mail meets the Gmail and Yahoo requirements?
No. Requirements such as From: alignment with SPF or DKIM, one-click unsubscribe headers, message formatting and spam-rate thresholds cannot be seen from DNS and are always listed as not checked. A pass only covers the items in the report.
What is the DMARC requirement for bulk senders?
Gmail and Yahoo require bulk senders to publish a DMARC record for their sending domain; p=none is enough to meet that requirement. The message must also pass DMARC, which means SPF or DKIM must pass for a domain aligned with the From: address.
How do I check one-click unsubscribe?
One-click unsubscribe is a property of each marketing message: the List-Unsubscribe and List-Unsubscribe-Post headers defined in RFC 8058. Send a real message to a mailbox you control and inspect its headers with the Email Header Analyzer.
Why is reverse DNS checked on my MX hosts and not on my sending IPs?
The check only knows your domain, and the MX records are the mail servers it can find from DNS. Your outbound mail may leave from different IPs, such as a newsletter provider's servers, so check reverse DNS of the actual sending IPs with Reverse DNS Lookup.
How do I see my spam rate?
Spam complaint rates are only visible in each provider's own tools, such as Google Postmaster Tools for Gmail. They cannot be measured from outside, so the compliance check never reports them as passed.