SPF, DKIM and DMARC explained: what bulk email senders must set up

SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail) and DMARC (Domain-based Message Authentication, Reporting and Conformance) are three checks, published in your domain’s DNS (Domain Name System) records, that let a mailbox provider confirm an email really comes from your domain. SPF lists the servers allowed to send for you. DKIM adds a signature to each message. DMARC ties both to the address people see in the From line and tells receivers what to do when checks fail.

As of November 2026, Gmail and Yahoo require all three from bulk senders and at least SPF or DKIM from everyone else.

What each protocol does

Protocol	What it checks	What you publish in DNS
SPF	Whether the sending server may use your domain as the envelope sender, the return address servers use	One TXT record listing permitted senders
DKIM	Whether the message carries a valid cryptographic signature from the signing domain	A public key; your sending platform signs with the matching private key
DMARC	Whether the domain in the visible From address matches a domain that passed SPF or DKIM	A TXT record at _dmarc under your domain, holding a policy and a report address

Two SPF limits trip up teams that use several sending tools. The SPF specification, RFC 7208 (opens in a new tab), allows one SPF record per domain and caps the terms that trigger DNS lookups, such as include, at 10 per check. Go over and the check returns a permanent error.

For DKIM, both Gmail’s email sender guidelines (opens in a new tab) and Yahoo’s sender FAQ (opens in a new tab) require a key of at least 1024 bits and recommend 2048.

How DMARC ties them together

SPF and DKIM never look at the From address your subscribers see, and anyone can pass both for a domain they own. DMARC closes that gap with alignment: the From domain has to match the domain that passed SPF or the domain in the DKIM signature. In the default relaxed mode, a shared organizational domain is enough, so news.example.com aligns with example.com. These definitions come from RFC 9989, the current DMARC specification (opens in a new tab), published in May 2026 to replace RFC 7489.

A message passes DMARC when at least one of the two checks passes and aligns. If your email service provider (ESP) signs mail with its own domain, a message can pass DKIM and still fail DMARC, so ask the ESP how to authenticate with your domain.

A minimal DMARC record looks like this:

_dmarc.example.com.  IN  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

The p tag sets the policy, and rua names the mailbox that receives aggregate reports.

What Gmail and Yahoo require

Google’s sender guidelines FAQ (opens in a new tab) defines a bulk sender as one that sends close to 5,000 or more messages to personal Gmail accounts within 24 hours, counting subdomains together with the primary domain. Once you qualify, the status is permanent. Yahoo’s sender requirements (opens in a new tab) are similar, but Yahoo’s FAQ says it will not name a volume threshold.

Both providers ask bulk senders for:

• SPF and DKIM on every message. Other senders need at least one, and both providers recommend DMARC to everyone.
• A DMARC record with a policy of at least p=none, and a From domain aligned with SPF or DKIM.
• One-click unsubscribe in marketing and subscribed messages, plus a visible unsubscribe link in the body. Both expect unsubscribe requests to be honored within two days.
• A spam complaint rate under 0.3%. Google advises staying under 0.1%.

Google’s FAQ says enforcement has been ramping up since November 2025, with non-compliant mail facing temporary and permanent rejections. Microsoft announced similar authentication rules for Outlook.com consumer addresses, aimed at domains that send more than 5,000 emails a day, in an April 2025 post on high-volume senders (opens in a new tab).

These are provider policies, not laws. Commercial email laws such as the US CAN-SPAM Act apply separately, so check your consent practices with a qualified professional.

Roll out DMARC in stages

1. Authenticate first. Set up SPF and DKIM for every tool that sends as your domain. Google’s recommended DMARC rollout (opens in a new tab) says to do this at least 48 hours before you add DMARC.
2. Monitor at p=none. Mail is delivered as normal while reports show every source using your domain. Google suggests at least a week. RFC 9989 notes it can take many months.
3. Fix legitimate failures. Repair every genuine source that fails or does not align before you enforce a policy.
4. Move to p=quarantine. Failing mail goes to the spam folder, where recipients can still find it.
5. Move to p=reject. Failing mail is refused and never delivered, so wait for clean reports.

As of November 2026, Google’s guide phases in the stricter policies with the pct tag, which applies a policy to a percentage of messages. RFC 9989 removed pct because receivers applied it inconsistently, and added a t=y testing flag instead. Our read: do not count on exact percentages.

RFC 9989 also says a domain at p=reject must not rely on SPF alone, because forwarded mail usually fails SPF while DKIM signatures generally survive.

Check your setup

• Send a test to a Gmail address. Open the message and expand the details under the sender’s name. Gmail’s help page on authenticated messages (opens in a new tab) says an authenticated message shows a mailed-by line and a signed-by line with your domain. In other mail clients, look for spf=pass and dkim=pass in the Authentication-Results header.
• Use Postmaster Tools. Google’s Postmaster Tools FAQ for senders (opens in a new tab) describes dashboards for compliance status, authentication and spam rate.
• Parse your DMARC reports. RFC 9989 points out that aggregate reports are formatted for software, so use a reporting tool.

Passing every check does not guarantee the inbox. The same Gmail help page notes that spammers can authenticate their mail too, so complaint rates and reputation still count.