This guide is for newsletter publishers, small business owners and agency staff who send email from their own domain and want it to reach the inbox. You do not need to be technical. You do need access to wherever your domain’s DNS is managed, and to the settings of the tool that sends your email. The rules below come from Google’s and Yahoo’s published sender guidelines, which are the clearest public statement of what large mailbox providers expect.
Contents
What SPF, DKIM and DMARC actually do
Mailbox providers want proof that a message claiming to come from your domain really did. Three DNS-based checks supply that proof.
| Record | Plain-English job | Where it lives |
|---|---|---|
| SPF | Lists the servers and services allowed to send mail for your domain. | A TXT record on your domain |
| DKIM | Adds a cryptographic signature to each message so the receiver can check it was not altered and that your domain authorised it. | A public key published in DNS, supplied by your sending tool |
| DMARC | Tells receivers what to do when a message fails, requires the visible From: domain to line up with SPF or DKIM, and can send you reports. | A TXT record on your domain |
What Google and Yahoo require
Google’s email sender guidelines say the requirements apply from February 1, 2024. They split senders into two groups.
All senders
- Set up SPF or DKIM for the sending domain.
- Use valid forward and reverse DNS (PTR) records for sending domains or IPs.
- Send over a TLS connection.
- Keep the spam rate in Postmaster Tools below 0.3%.
- Format messages to RFC 5322 and do not impersonate Gmail From: headers.
Senders of more than 5,000 messages a day
Google applies extra rules to anyone who sends more than 5,000 messages per day to Gmail accounts. These senders must set up SPF and DKIM and also DMARC, and the DMARC policy is allowed to be none. For direct mail, the From: domain must align with the SPF domain or the DKIM domain. Marketing and subscribed messages must support one-click unsubscribe, plus a clearly visible unsubscribe link in the body.
Enjoying this? Get our best tips by email
Practical SEO, link building and content strategies, straight to your inbox.
Google’s FAQ adds some detail that small senders often miss:
- The FAQ describes a bulk sender as one sending “close to 5,000 messages or more” to personal Gmail accounts within 24 hours, so do not treat 5,000 as a safe line to hover under.
- Messages from the same primary domain count together, subdomains included.
- Bulk sender status is permanent once you meet the criteria.
- The rules concern mail sent to personal Gmail accounts, not to Google Workspace accounts.
- Spam rate is calculated daily. Google says to keep it below 0.1% and never let it reach 0.3% or higher.
Yahoo’s Sender Hub best practices are similar. It asks all senders to implement SPF or DKIM at a minimum and to keep the spam rate below 0.3%. For bulk senders it asks for both SPF and DKIM, a valid DMARC policy of at least p=none, and a From: domain aligned with either the SPF or DKIM domain. Yahoo’s page lists a minimum DKIM key length of 1024 bits and says unsubscribe requests should be honoured within 2 days. Yahoo’s best-practices page does not state a volume threshold for “bulk”, so check Yahoo’s current wording if that matters to you.
Microsoft also publishes high-volume sender requirements for Outlook.com, but this guide does not cover Microsoft’s specific thresholds or dates. Check Microsoft’s own page if you send heavily to Outlook.com or Hotmail addresses.
Step-by-step setup
Step 1: Decide which domain sends your email
Authenticate the domain that appears in your From: address, for example [email protected]. Many small senders use a free address from a mailbox provider as the From: address. That cannot be authenticated by you, so move to an address on a domain you own. If you use several tools (a newsletter platform, a shop, a helpdesk), list them all, because each one needs to be covered.
Step 2: Find your DNS settings
DNS records are edited where your domain’s nameservers point. That is often your domain registrar, but it may be your web host or a service such as a CDN. Look for a section called DNS, DNS Zone, Advanced DNS or Manage DNS. If you are unsure, your registrar’s account page usually shows which nameservers are active. Edit records only at that one place, since changes made elsewhere will have no effect.
Step 3: Publish SPF
Your email platform’s help centre will give you an SPF value that names its servers, usually as an include: entry. A domain should have a single SPF TXT record, so if one already exists, add the new include to it rather than creating a second record. A typical record has this shape, where the include value is a placeholder you replace with your provider’s:
v=spf1 include:mail.your-provider.example ~allStep 4: Turn on DKIM
In your sending tool, look for a setting called domain authentication, sender authentication or DKIM. It will show one or more DNS records, often CNAME or TXT, with a host name and a value. Copy them exactly into your DNS zone, then return to the tool and use its verify button. Where you have the choice, pick 2048-bit keys. Google says sending to personal Gmail accounts requires a DKIM key of 1024 bits or longer and recommends 2048 bits where your domain provider supports them.
Step 5: Add DMARC at p=none
Create a TXT record whose host is _dmarc. A starting value looks like this, with your own reporting address in place of the placeholder:
v=DMARC1; p=none; rua=mailto:[email protected]The p=none policy asks receivers to take no action on failures, which makes it safe to start with. Yahoo strongly recommends including a rua tag so you receive aggregate reports while you are setting up. Google’s FAQ warns that a missing DMARC record, or one without a policy, leads to rate limiting.
Tightening DMARC safely
Neither Google’s nor Yahoo’s pages require anything stricter than p=none. Moving to a stricter policy is a separate decision, made to protect your domain from being spoofed. A cautious path looks like this:
- Stay at p=none while you read the reports and identify every legitimate service sending as your domain.
- Fix any legitimate sender that fails, by adding it to SPF or enabling DKIM for it.
- When legitimate mail consistently passes, move to p=quarantine, which asks receivers to treat failures as suspicious.
- Later, consider p=reject, which asks receivers to refuse failing mail.
The main risk is jumping straight to quarantine or reject and blocking your own invoices or helpdesk replies because one tool was never authenticated. Aggregate reports are XML files that are hard to read by eye, so many senders use a free or paid report-viewer service to summarise them.
One-click unsubscribe
For marketing and promotional mail, Google requires headers that implement RFC 8058: a List-Unsubscribe-Post header with the value List-Unsubscribe=One-Click, and a List-Unsubscribe header containing an HTTPS URL. Per Google’s FAQ, a mailto link or a link in the body alone does not satisfy the requirement, and transactional messages such as password resets are excluded. One-click unsubscribe removes the person only from the associated mailing list. Google recommends honouring requests within 48 hours.
Most newsletter platforms add these headers automatically. If you use one, your job is to check that the feature is on, not to write headers by hand. If you send through a plugin or your own server, confirm that it adds both headers. A good welcome flow also reduces complaints because people know what they signed up for, which is covered in our guide to building an email welcome sequence for a newsletter, and our email marketing tips cover wider list habits. Authentication proves identity, not that recipients want your mail.
Checking that it works
- Use the verification buttons in your sending tool for DKIM and SPF.
- Send a test message to a personal Gmail account and inspect the message headers, where the authentication results for SPF, DKIM and DMARC are normally recorded.
- Confirm the From: domain aligns with the domain that passed SPF or DKIM, since a pass on an unrelated domain does not satisfy DMARC.
- Add your domain to Google Postmaster Tools and watch the spam rate. Google says to keep it below 0.1%.
- Read your DMARC reports weekly at first.
Key takeaways
- All senders need SPF or DKIM; senders above Google’s 5,000-a-day line need SPF, DKIM and DMARC.
- Set up all three anyway. It is cheap, and your volume may grow.
- Start DMARC at p=none with a rua reporting address, and tighten only after reports show your real senders pass.
- Marketing mail needs RFC 8058 one-click unsubscribe headers, not just a body link.
- Keep your spam rate under 0.1% and never let it reach 0.3%.
FAQ
Do I need all three if I only send a small newsletter?
Below Google’s bulk threshold, SPF or DKIM is the stated minimum. Publishing all three is still sensible, and Yahoo and Google both require the full set for bulk senders.
Is p=none enough?
Google lists p=none as the minimum DMARC policy, and Yahoo asks for at least p=none. Stricter policies protect against spoofing but are not required by those pages.
Does this apply to transactional email?
Authentication requirements apply to all your mail. The one-click unsubscribe requirement applies to marketing and promotional messages, not transactional ones, according to Google’s FAQ.
