Receiving servers use SPF, DKIM, DMARC results to check that a message came from your domain. Gmail and Yahoo ask every sender to pass SPF or DKIM. Those two and Outlook.com require high-volume senders to pass both and publish a DMARC record. Google and Yahoo also set 0.3% as the spam-complaint line.
By Donnie Strompf. Updated October 2026.
I’m Donnie Strompf and I’ve done SEO since 2008. The requirements below come from the mailbox providers’ own pages, read October 15, 2026. They say nothing about how any agency sets up client domains, so use them as a checklist for your own domain or as questions for whoever sends your email.
Key takeaways
- SPF lists who may send mail for your domain, DKIM signs each message, and DMARC tells receivers what to do when those checks fail.
- Gmail requires SPF or DKIM from all senders. At 5,000 or more messages a day to Gmail it also requires SPF and DKIM together with a DMARC record and one-click unsubscribe.
- Outlook.com applies its authentication rules to domains that send more than 5,000 emails a day.
- Keep Gmail spam reports below 0.1% and never reach 0.3%. Yahoo’s line is 0.3%.
- Passing authentication shows a message came from you. Recipients’ reactions still decide whether later mail is welcome.
- Every tool that sends as your domain needs entries in your domain’s DNS, so know who controls it.
What do SPF, DKIM, DMARC each do?
SPF checks which servers may send, DKIM checks a signature, and DMARC checks that the domain in the From line matches.
| Check | What it does | Where it lives |
|---|---|---|
| SPF | Lists the servers allowed to send for your domain | A record in your DNS |
| DKIM | Signs each message so receivers can verify it | A public key in your DNS |
| DMARC | Sets what receivers do when checks fail, and where reports go | A record at _dmarc.yourdomain |
SPF is defined in RFC 7208 (IETF, April 2014, read October 15, 2026). The standard caps the lookups a check may trigger at 10, and a record over the cap returns a permanent error. Microsoft’s FAQ warns that stacking many include statements can cause this failure.
DKIM is defined in RFC 6376 (IETF, September 2011). The sender signs with a private key and receivers fetch the matching public key from the sender’s DNS under a named selector. Google requires a key of 1024 bits or longer for mail to personal Gmail and recommends 2048 bits where your provider supports it (Google, read October 15, 2026).
DMARC ties the two checks to the domain people see in the From line. A message passes when SPF or DKIM passes and the authenticating domain matches the From domain, which is called alignment.
The p= value is none, quarantine or reject, and p=none asks receivers to take no specific action. The IETF published the current DMARC standard, RFC 9989, on May 19, 2026. It replaces RFC 7489 (IETF).
Microsoft advises moving gradually from none to quarantine to reject, and only after every legitimate sender is aligned. A stricter policy can stop others spoofing your domain. It can also reject your own mail from any sender you forgot to align.
Which sender rules apply to a small business?
Google’s email sender guidelines (read October 15, 2026) cover mail to personal Gmail addresses, meaning @gmail.com and @googlemail.com. Every sender needs SPF or DKIM. Senders of 5,000 or more messages a day need SPF and DKIM plus DMARC, and their marketing and subscribed messages need one-click unsubscribe. Google also recommends all three methods for every domain, whatever the volume.
Yahoo’s sender requirements (read October 15, 2026) ask all senders for SPF or DKIM and a spam rate below 0.3%. Bulk senders need both, a passing DMARC policy of at least p=none, a one-click unsubscribe header and unsubscribes honored within 2 days. Yahoo’s page does not define bulk sender. It says enforcement began in February 2024.
Microsoft’s Outlook.com announcement (Microsoft Community Hub, April 2, 2025, updated April 30, 2025) covers domains sending more than 5,000 emails a day to hotmail.com, live.com and outlook.com addresses. SPF and DKIM must pass, and DMARC must be at least p=none and align with SPF or DKIM. Microsoft describes sending non-compliant mail to Junk or rejecting it with error 550 5.7.515, with enforcement starting May 5, 2025. The post is dated 2025, so check Microsoft’s sender support pages for later changes.
| Rule | Gmail | Yahoo | Outlook.com |
|---|---|---|---|
| High-volume cutoff | About 5,000 a day | Not defined | Over 5,000 a day |
| Any sender | SPF or DKIM | SPF or DKIM | Advised |
| High-volume authentication | SPF, DKIM, DMARC | SPF, DKIM, DMARC | SPF, DKIM, DMARC |
| Minimum DMARC policy | p=none | p=none | p=none |
| One-click unsubscribe | Marketing mail | Marketing mail | Visible link advised |
| Spam-rate line | Under 0.1%, never 0.3% | Under 0.3% | No figure given |
Google counts every message from the same primary domain to personal Gmail accounts in 24 hours. Sending 2,500 from yourdomain.com and 2,500 from news.yourdomain.com adds up to 5,000. A domain that reaches the count once is permanently treated as a bulk sender (Google sender guidelines FAQ, read October 15, 2026).
How is the 0.3% spam-complaint line measured?
Google calculates the user-reported spam rate daily. It tells senders to stay below 0.1% and prevent it from ever reaching 0.3%.
Bulk senders above 0.3% are ineligible for mitigation until they stay below it for 7 consecutive days. Yahoo calculates its 0.3% from mail delivered to the inbox. A 0.3% rate means 3 spam reports per 1,000 counted messages.
You can read Gmail’s figure in Google Postmaster Tools. It covers personal Gmail recipients only, needs a DNS record to verify your domain, and can show no data when daily volume is low. Google does not track open rates, and it says a low open rate does not reliably point to a spam problem.
Google’s list of practices that keep complaints down is short. Send only to people who opted in, confirm each address before subscribing, and do not buy addresses or tick subscribe boxes for people. Microsoft adds that you should remove invalid addresses monthly or quarterly.
What do the failure messages mean?
Rejected mail comes back with a code that names the problem. These Gmail and Outlook.com codes point to authentication problems.
| Code | Sender | Meaning | First check |
|---|---|---|---|
| 4.7.27 | Gmail | SPF did not pass | SPF record |
| 4.7.30 | Gmail | DKIM did not pass | DKIM switched on |
| 4.7.31 | Gmail | No DMARC record or policy | _dmarc record |
| 4.7.32 | Gmail | From domain not aligned | Domain your platform signs with |
| 5.7.26 | Gmail | Message not authenticated | All three records |
| 5.7.515 | Outlook.com | Authentication level too low | All three records |
Codes starting with 4 are temporary rate limits and codes starting with 5 are blocks. Google lists the 4.7 codes in its sender guidelines FAQ, names 5.7.26 in its sender guidelines, and Microsoft names 5.7.515 in its announcement. Fix the record the code names, then send a small test before resuming a full send.
How can I check my own domain?
Work through this list with your DNS login and your email platform’s help pages open.
- List every tool that sends mail as your domain: your mailbox provider, email platform, CRM, booking system and invoicing software. Google’s Workspace guidance and Microsoft’s FAQ both say third-party senders must be authenticated for your domain.
- Find your SPF record and confirm each sender from step 1 is included, with the chain staying inside 10 lookups.
- Confirm DKIM is on for each sender and that the key is 1024 bits or longer, 2048 where supported.
- Look up the TXT record at _dmarc.yourdomain. If it is missing, publish one with p=none and an rua address that points to a mailbox set up for reports (Google Workspace Help, read October 15, 2026).
- Send a test to a Gmail address, open the full headers from the More menu under Show original, and paste them into Google’s Admin Toolbox Messageheader tool, which Google’s help page names for analyzing headers.
- Check that marketing emails carry both List-Unsubscribe and List-Unsubscribe-Post headers, which RFC 8058 (IETF, January 2017) defines. Ask your platform if it does this for you.
- Add your sending domain to Postmaster Tools and verify it.
- Review your list for purchased, stale or unconfirmed addresses.
Does passing authentication put every email in the inbox?
Passing authentication does not guarantee inbox placement. Recipients can still report unwanted messages as spam. Google says authenticated messages are less likely to be rejected or marked as spam, which is a lower bar than a guarantee. Microsoft’s FAQ says user perception still matters when recipients report authenticated mail, so the content you send, how often you send it and how easily people can opt out all stay in play.
The same sources set limits on providers. Google says it does not accept allowlist requests from email providers, and Yahoo asks for an active complaint feedback loop on every DKIM domain. Neither sets up your DNS for you.
What should I ask my email platform or agency?
Ask in writing, and ask every provider, including us. Ask for the DNS entries, signing domain and reports so you can verify the setup yourself.
- Which domain do you sign DKIM with, and is it mine?
- Which entries do you need in my DNS, and who holds the DNS login?
- Can I receive the DMARC reports?
- Are List-Unsubscribe headers added to marketing sends?
- Where do I see my Gmail spam rate?
Domain and DNS access is one of the accounts to hold yourself, which who owns your website and marketing accounts covers. Separate from these rules, US law adds its own opt-out requirements under CAN-SPAM, which the FTC’s compliance guide for business sets out. Our email marketing services page describes the service, and the pricing page lists the published ranges. Our guide to how much digital marketing costs for a small business sets out the ranges.
Related reading
- Email Automation Triggers for Service Businesses That Want More Bookings
- Klaviyo vs Mailchimp vs HubSpot vs Constant Contact: how the email platforms differ
Next step
Mail that reaches the inbox is one half of the job, and being found is the other. The SEO fundamentals guide covers how search works. The free AI-visibility audit comes first, then a 15-minute call.
Get your free AI-visibility audit
FAQ
Do I need DMARC if I send fewer than 5,000 emails a day?
Google recommends setting up all three checks for every domain, and Yahoo urges all senders to publish a DMARC policy. Microsoft says smaller senders benefit from the same practices. A p=none record is free, starts the reports and meets the minimum policy the three providers name for high-volume senders.
What is the rua address in a DMARC record?
It is the mailbox that receives aggregate DMARC reports, which show who sends mail using your domain and whether it aligns. Google recommends a dedicated mailbox or group because volume can be high. Microsoft sends aggregate reports to that address and has no plans to send the detailed forensic kind.
Can I send marketing email from a Gmail or Yahoo address?
Google calls a gmail.com From address on mail that did not leave Gmail’s servers spoofing, and bulk senders doing it get failure notices. A free-mail address also gives you no domain of your own to authenticate. Send marketing from an address on a domain you own and align your platform to it.
My platform sends the email for me. Do I still touch DNS?
You do. Microsoft’s FAQ says authentication is tied to your domain even when a vendor sends, and Google says your SPF record should include every third-party sender. Ask the vendor for the exact SPF include and DKIM entries, add them at your DNS host, and keep the login in your company’s hands.
How long should I wait before adding DMARC?
Google Workspace Help says SPF and DKIM should be authenticating messages for at least 48 hours before you turn DMARC on. Google adds that enabling DMARC before SPF or DKIM is set up will probably cause delivery issues. Start at p=none and read the reports before you tighten the policy.
Does a booking confirmation need one-click unsubscribe?
Google requires it only for marketing and promotional mail and lists reservation confirmations, password resets and form confirmations as transactional examples. It adds that recipients, not Google, decide how a message is classified. A mailto link or preferences page alone does not meet the rule, so use List-Unsubscribe headers on anything that promotes.
Marketing that works, in your inbox
AI search & SEO news, what’s working right now, and guides we actually use with clients. A couple of emails a month, no spam.
Unsubscribe anytime. We treat your inbox the way we treat our clients’ brands.