Email deliverability: SPF, DKIM, DMARC and sender rules explained
Email deliverability starts with authentication. SPF lists the servers allowed to send email for your domain, DKIM signs each message so receivers can check it really came from you, and DMARC tells receivers what to do when those checks fail. Since February 2024, Gmail and Yahoo require every sender to use SPF or DKIM and keep spam complaints below 0.3%, and bulk senders must use SPF, DKIM and DMARC together, align their From domain and offer one-click unsubscribe. Meet those rules, and your email has a fair chance of reaching the inbox.
- Authenticate your sending domain: SPF and DKIM at minimum, plus DMARC for bulk senders.
- Marketing email needs a one-click unsubscribe and a visible unsubscribe link.
- Keep spam complaints well below 0.3%; Gmail recommends staying under 0.1%.
- Clean lists and relevant, expected email matter as much as the technical setup.
Why the rules exist
Gmail and Yahoo handle a large share of the world’s email. Their sender rules are designed to cut spam and spoofing by making sure mail really comes from the domain it claims, that people can leave lists easily, and that senders who annoy recipients are filtered. If your business email or newsletters suddenly land in spam, these rules are the first place to look.
SPF, DKIM and DMARC in plain English
- SPF is a DNS record listing the servers allowed to send email for your domain.
- DKIM adds a digital signature to each email, so the receiver can check it wasn’t changed and really came from your domain.
- DMARC is a DNS record that tells receivers what to do when SPF or DKIM checks fail for mail using your domain in the From address, and where to send reports. Starting with a policy of p=none lets you monitor before enforcing.
Your email platform usually provides the exact records to add to your domain’s DNS. Set them up for every service that sends as your domain, including your website’s contact forms.
What Gmail requires
| Requirement | All senders to Gmail | Over 5,000 messages a day |
|---|---|---|
| Authentication | SPF or DKIM | SPF and DKIM |
| DMARC | Not required | Required (policy can be none) |
| From-domain alignment | Not required | Required with SPF or DKIM |
| One-click unsubscribe | Not required | Required for marketing and subscribed mail |
| Spam rate in Postmaster Tools | Below 0.3% | Below 0.3% (aim for under 0.1%) |
| DNS, TLS and formatting |