The short answer
For your emails to arrive, your sender domain needs SPF, DKIM and DMARC, a clean recipient list and a spam complaint rate below 0.3 %. Google even recommends staying permanently below 0.1 % [1].
Anyone sending around 5,000 or more emails a day to personal Gmail addresses has needed all three records, a matching sender domain and one-click unsubscribe since 1 February 2024 [1][2]. Yahoo has set similar rules since February 2024 [3], Microsoft for Outlook.com since May 2025 [4].
What are SPF, DKIM and DMARC?
All three are records in your domain's DNS. They answer one question for the receiving server: does this email really come from whoever is named as the sender?
| Record | What it checks |
|---|---|
| SPF | Which servers may send emails on behalf of your domain? |
| DKIM | Is the email cryptographically signed and unchanged in transit? |
| DMARC | Does the visible sender domain match SPF or DKIM, and what happens if not? |
SPF (Sender Policy Framework) is a list of permitted sending servers. The receiving server compares the sender's IP address with this list. Important: there's only one SPF record per domain, and at most ten DNS lookups are allowed when evaluating it [6]. Anyone who appends another "include" for every new tool quickly breaks this limit.
DKIM (DomainKeys Identified Mail) attaches a signature to every email, which is checked with a public key in the DNS. For personal Gmail addresses Google requires at least 1,024 bits and recommends 2,048 bits where your provider supports it [1][7].
DMARC (Domain-based Message Authentication, Reporting and Conformance) builds on both. It requires the domain in the visible sender to match the domain checked by SPF or DKIM (alignment). It also defines what happens to emails that fail and sends you reports on who is sending in your name.
Example (fictional domain) of a DMARC starting point that only monitors:
_dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"
A common mistake: SPF and DKIM are correct, but DMARC still fails. Usually the newsletter tool signs with its own domain instead of yours. Then the alignment is missing.
What do Gmail, Yahoo and Microsoft require?
Google and Yahoo tightened their rules for senders in February 2024. Google distinguishes between all senders and bulk senders with around 5,000 emails a day to personal Gmail addresses [1]. A dash means: not required.
| Requirement | All | From approx. 5,000/day |
|---|---|---|
| Authentication | SPF or DKIM | SPF and DKIM |
| DMARC | – | Required, "p=none" is enough |
| Sender domain matches SPF or DKIM | – | Required |
| Spam rate in Postmaster Tools | below 0.3 % | below 0.3 %, target below 0.1 % |
| One-click unsubscribe | – | Required for marketing emails |
| Reverse DNS and TLS | Required | Required |
A few details matter. A bulk sender is anyone who sends around 5,000 emails to personal Gmail accounts in one day. Emails from the same primary domain are counted together, and the status is permanent [2]. According to Google, unsubscribes should be processed within 48 hours [2]; Yahoo requires it within two days [3]. Since November 2025 Google has enforced the rules more strictly, up to rejecting emails [2].
One-click unsubscribe is described in RFC 8058: two header lines ("List-Unsubscribe" and "List-Unsubscribe-Post") that have to be covered by the DKIM signature [5]. Good newsletter tools set this automatically. A visible unsubscribe link in the text still belongs in the email.
In April 2025 Microsoft announced comparable rules for Outlook.com, Hotmail and Live for senders with more than 5,000 emails a day: SPF, DKIM and DMARC, at least with "p=none" [4].
Do the rules apply to small B2B senders too?
Formally, the bulk sender rules only concern large volumes to personal inboxes. Google writes explicitly that the sender guidelines don't apply to emails sent to Google Workspace accounts, i.e. to company addresses on Google [2]. A mid-sized B2B newsletter with 3,000 recipients therefore doesn't fall under the obligation.
Still, we recommend everyone set up SPF, DKIM and DMARC properly. From our project experience the setup usually takes one to two hours. Without the records you lack any basis for troubleshooting when emails don't arrive. Google also requires at least SPF or DKIM from all other senders [1].
How do you set up authentication?
- Inventory: list all systems that send emails with your domain. Typical ones are the mailbox (Microsoft 365 or Google Workspace), newsletter tool, CRM, shop, accounting and ticket system.
- Merge SPF: one single record that permits all these systems. Then check the number of DNS lookups.
- DKIM per system: in every tool, activate signing with your own domain, with a 2,048-bit key where possible.
- DMARC with "p=none": only monitor at first and send the reports to a dedicated address.
- Read the reports: for two to four weeks, check which systems still fail and fix them.
- Tighten: only then move to "p=quarantine" and later to "p=reject", so nobody can spoof your name any more.
Our recommendation for newsletters and campaigns: a separate subdomain, for example "news.example.com". That keeps the reputation of your main domain, which carries quotes and invoices, separate from marketing experiments.
Why do emails land in spam despite correct records?
Authentication only says who's sending. Whether the email is wanted is judged by mailbox providers based on the behaviour of recipients and sender. Google names these points, among others [1]:
- Starting too fast: Google advises starting with small volumes to interested recipients and increasing slowly. A new or long-unused domain shouldn't start with 10,000 emails on day one.
- Mixed content: advertising in order confirmations or invoices. Google advises against mixing content categories in one message.
- Bought lists: Google explicitly advises against buying addresses from other companies.
- A high complaint rate: every "Spam" report counts against the domain. That's why unwanted cold emails also put the rest of your communication at risk.
Reputation is cumulative. A botched campaign is sent quickly, but in our project experience recovery takes weeks. For content, common sense helps: no all-caps subjects, no piles of exclamation marks, no email that consists only of one big image.
How do you keep your list clean?
A smaller list of active recipients delivers better than a large one full of dead addresses. Google recommends requesting confirmation before adding someone to the list, automatically removing recipients after repeated bounces and removing recipients who don't read from the list [1].
Example of a simple rule you adapt to your sending frequency:
- Remove hard bounces (address doesn't exist) immediately.
- Remove soft bounces (mailbox full) after three failed attempts in a row.
- Contacts without a click for six months get a reactivation email with a clear question: "Do you want to keep hearing from us?"
- Anyone who doesn't react goes onto a dormant list and gets no more campaigns.
Careful with point 3: since Apple's Mail Privacy Protection, opens aren't reliable proof of activity. Use clicks and replies, see email KPIs.
How do you monitor deliverability?
- Google Postmaster Tools: shows spam rate and authentication for emails to Gmail users. Google explicitly recommends the tool [1].
- DMARC reports: show which servers send in your name and whether they pass the check.
- Bounce messages: a sudden rise in rejections from one provider is an early warning signal.
- Test emails: before every larger campaign, to your own inboxes at Gmail, Outlook and a German provider.
Conclusion: technology first, then optimisation
Deliverability isn't a one-off setup, but a state you maintain. SPF, DKIM and DMARC are quickly set up and protect your domain permanently. After that, list and behaviour decide: confirmed sign-ups, a slow ramp-up, quick removal of bounces and unsubscribes. Only on this basis is work on subject line and copy worth it.