Skip to content
InboxLee
Guide · authentication

Email authentication for cold email, end to end.

Authentication is the layer that tells Gmail, Outlook, and Yahoo that you are allowed to send from your domain, that the message was not tampered with, and what to do if either check fails. Get it wrong and even a perfectly warmed mailbox lands in spam. Get it right and you clear the single biggest bar to inbox placement before you send a word.

There are four records that matter on every sending domain: SPF authorizes the servers that may send for you, DKIM cryptographically signs each message, DMARC sets the policy for what happens when SPF or DKIM fail, and MX routes replies back to you. Two more, BIMI and MTA-STS, are optional trust signals that increasingly separate serious senders from the rest.

InboxLee applies the full stack automatically on every domain it provisions: a single-record SPF, a 2048-bit DKIM key, DMARC at quarantine with reporting, and the complete Workspace MX set. A mailbox is only marked live after the provider confirms authentication. This guide explains each piece so you understand what is running under the hood, whether InboxLee set it or you are configuring a domain yourself.

SPF, DKIM, and DMARC

The three records every cold sender needs, what each proves, and the exact values that pass in 2026.

Infrastructure · 4 minSPF records for cold email senders: the complete no-fluff guideWhat SPF does, why you need exactly one record, the common errors, and what InboxLee configures.Read →Deliverability · 4 minThe 1-record rule: why your domain can only have one SPFThe single most common cold-email deliverability bug: two SPF records on the same domain. Here is why it breaks SPF entirely.Read →Deliverability · 5 minDKIM explained: what it is and why every cold sender needs itWhat DKIM does, why 2048-bit, how propagation works, what InboxLee sets automatically.Read →Deliverability · 4 minDKIM 1024-bit vs 2048-bit: which one to publish in 20261024-bit keys still work. They are also a 1990s-era cryptographic compromise that modern enterprise mail servers are starting to flag.Read →Deliverability · 5 minDKIM key rotation for cold email: when, why, and how oftenRotation is operational hygiene, not a security stunt. Here is the cadence that holds up under enterprise audits and Gmail postmaster scrutiny.Read →Deliverability · 6 minDMARC p=quarantine vs p=reject: which one is right for cold emailReject sounds stronger. Quarantine ships safer. Here is the operator-grade reasoning for picking the right policy.Read →Deliverability · 6 minReading DMARC aggregate reports: what they tell you and which ones to ignoreDMARC reports look like XML dumps. They are actually one of the highest-signal deliverability data sources you have access to. Here is what to read first.Read →Deliverability · 7 minSPF, DKIM, and DMARC: the cold-email checklist Google actually checks in 2026The three records every cold sender needs, what each one does, what Google and Microsoft penalise when they are wrong.Read →

The rest of the stack

MX routing, reverse DNS, TLS, and the trust signals (BIMI, MTA-STS) that push you ahead of the median sender.

Deliverability · 4 minMX records and cold email deliverability: the often-forgotten recordSPF, DKIM, DMARC get all the attention. MX is the one that controls what happens to bounces and replies - and it matters more than people think.Read →Infrastructure · 4 minReverse DNS (PTR) for cold email senders: what it is and when to fix itPTR records are usually somebody else's problem. Here is when they become yours.Read →Infrastructure · 4 minTLS 1.2 (and 1.3) for cold email: why opportunistic encryption mattersMail in transit should be encrypted. Most providers enforce TLS 1.2 or higher. Here is the operational impact.Read →Deliverability · 5 minBIMI for cold email: what it is, who can use it, and whether it actually helps placementA logo next to your name in Gmail and Yahoo. Looks great in B2C marketing. Worth almost nothing for cold outbound until you cross specific thresholds.Read →Infrastructure · 5 minMTA-STS for cold email: what it is, how it interacts with TLS, and whether you need it in 2026Optional in 2026. Not required by Gmail or Yahoo. Still a clean positive signal that inbox providers notice - and InboxLee publishes it by default.Read →

Sender rules and feedback loops

The 2026 Gmail and Yahoo bulk-sender requirements, one-click unsubscribe, and the tools that report how mailbox providers actually see you.

Deliverability · 6 minGmail and Yahoo bulk-sender rules in 2026: what cold-email operators actually need to shipFive required signals, one hard threshold at 5,000 emails per day, and a quiet penalty most senders only notice after the placement chart drops. Pulled from what we apply by default at provisioning.Read →Deliverability · 5 minThe one-click List-Unsubscribe header for cold email: what it is, how to add it, how to verify itOne header. Two lines of metadata. Gmail and Yahoo render a one-tap unsubscribe button at the top of your message. Required above 5,000 sends per day and a quiet positive signal even below.Read →Deliverability · 7 minReading Gmail Postmaster Tools as a cold-email operatorPostmaster Tools is the only direct signal Gmail gives you. Here is how to actually use it without panicking at the first red bar.Read →Infrastructure · 5 minJMRP and FBL explained: how to read complaint loops as a cold senderJMRP and FBL are the only direct complaint signals Microsoft and Yahoo provide. Most cold senders never see them.Read →
FAQ

Questions, answered