Email Deliverability: SPF, DKIM and DMARC in Plain English

For years, email authentication was something a careful IT person set up and everyone else ignored. That changed in February 2024, when Gmail began requiring it from bulk senders and Yahoo set similar rules. Microsoft followed for Outlook.com in May 2025. From November 2025, Gmail stepped up enforcement, and messages that fail its requirements now face disruptions that include temporary and permanent rejections.

If your newsletters, invoices or booking reminders have started landing in spam or bouncing, three DNS records are the first place to look.

What SPF, DKIM and DMARC actually do

• SPF (Sender Policy Framework) is a DNS record listing the servers and services allowed to send email using your domain. It has a hard limit: the specification caps the DNS lookups an SPF check may trigger at 10, and going over returns an error. Every service you add with an include statement spends part of that budget.
• DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each message. The receiving server checks it against a public key published in your DNS. If the message was altered in transit, or was never sent by you, the check fails.
• DMARC (Domain-based Message Authentication, Reporting and Conformance) ties the two together. It checks that the domain in the visible From address aligns with a domain that passed SPF or DKIM, tells receivers what to do when a message fails (nothing, quarantine or reject) and sends you reports about who is sending as your domain.

Think of SPF as the guest list, DKIM as the wax seal and DMARC as the instructions for the doorman.

The rules Gmail and Yahoo now enforce

Gmail treats anyone who sends close to 5,000 or more messages to personal Gmail accounts within 24 hours as a bulk sender, and the status is permanent once reached. Even below that line, Gmail asks every sender to use SPF or DKIM, valid forward and reverse DNS, and TLS encryption, and to keep the spam rate below 0.3%.

Microsoft applies similar rules to Outlook.com for domains sending more than 5,000 emails a day: SPF and DKIM must pass, and DMARC must be published at p=none or stronger, aligned with SPF or DKIM. Since May 5, 2025, non-compliant mail has been routed to the Junk folder, and Microsoft has said rejection will follow at a date to be announced.

How to set them up in six steps

1. List every service that sends as your domain. Your mailbox provider, newsletter tool, CRM, invoicing software, booking system and website forms. Missing one is the most common cause of failures later.
2. Publish a single SPF record. Include each legitimate service, remove the ones you no longer use and count the lookups. If you are close to the limit, move bulk mail to a subdomain with its own record.
3. Turn on DKIM in every service, using your own domain. Most platforms give you records to publish. Signing with the platform's shared domain does nothing for your domain's alignment.
4. Publish DMARC with a policy of none and a reporting address. Read the reports for a few weeks. They show every source sending as your domain, including the ones you forgot.
5. Tighten the policy. Once every legitimate source passes, move to quarantine and then reject, so spoofed mail pretending to be you is stopped.
6. Add one-click unsubscribe. Use the list-unsubscribe headers your sending platform supports, keep a visible link in the footer and process requests within two days.

How to check where you stand today

You can check your own results quickly, before touching any settings.

• Read a real message's headers. Send a normal email from each tool you use to a personal Gmail address, open it, and choose "Show original". Gmail lists the SPF, DKIM and DMARC results at the top. Anything other than PASS needs fixing.
• Register for Postmaster Tools. Google's guidelines measure your spam rate in its Postmaster Tools dashboard, so set it up for your sending domain and watch the trend after every campaign.
• Read your DMARC reports. If you already publish DMARC with a reporting address, the reports name every server sending as your domain. Unknown senders are either forgotten tools or someone impersonating you.

The numbers that keep you out of the spam folder

Authentication gets you through the door. Reputation decides where you land.

• Complaints. Google advises keeping the spam rate shown in Postmaster Tools below 0.10% and never reaching 0.30%. As an illustration, on a send to 20,000 people, 0.3% is 60 spam reports and 0.1% is 20.
• Bounces. Remove addresses that hard-bounce straight away. Repeatedly mailing dead addresses signals a stale list.
• Consent. Never buy or rent lists. Mail people who asked to hear from you, and stop mailing people who have not opened or clicked in a long time.
• Volume changes. Ramp up a new domain or a large new list gradually, rather than sending everything on day one.

U.S. law sets a floor as well. The CAN-SPAM Act requires commercial email to carry a working opt-out and a valid postal address and forbids deceptive subject lines. Yahoo's two-day unsubscribe expectation is stricter than the legal deadline, so meet the stricter standard and automate it, so a request takes effect at once in every tool that sends email.

When to keep your current email platform

An owned sending setup, such as an OWNIT bulk email tool that sends through your own Amazon SES or Postmark account on your domain, makes sense when per-subscriber fees keep climbing and you want the list in your own database. It is not always the right move.

• Your list is small. If you send to a few thousand people a month, platform fees are modest, and the authentication work above is the same either way.
• Nobody will read the reports. An owned tool can process bounces and complaints automatically, but someone still needs to read the DMARC and complaint data and act on it.
• You value a platform's compliance team. Some businesses are glad to pay a vendor that polices their sending. That is a reasonable thing to buy.

Whichever route you choose, the message itself matters once it arrives. Well-built templates that render in every inbox are covered by our HTML email design work, and if you would like help reading DMARC reports or moving off a per-subscriber plan, OWNIT's bulk email team offers a free 30-minute strategy call.