SPF, DKIM and DMARC Setup and the Gmail and Yahoo Sender Rules

Since 1 February 2024, Gmail has required every sender to authenticate mail with SPF or DKIM, and anyone sending more than 5,000 messages a day to Gmail must also publish DMARC. Yahoo applies matching rules, and Outlook.com began rejecting non-compliant high-volume mail on 5 May 2025. This guide shows how to set up all three records on a new domain and stay within each provider's limits.

What the mailbox providers now require

The three largest consumer mailbox providers now publish similar rules. All senders to Gmail need SPF or DKIM, valid forward and reverse DNS, TLS and a spam rate below 0.3%. Senders of more than 5,000 messages a day need SPF, DKIM and DMARC, alignment between the From domain and SPF or DKIM, and one-click unsubscribe on marketing mail. Yahoo's rules mirror these, and Microsoft applies SPF, DKIM and DMARC checks to domains sending more than 5,000 emails a day to Outlook.com, Hotmail and Live addresses.

Even if you send a few hundred emails a day, set up all three records. They cost nothing, they protect your domain from being used in phishing, and if your volume grows you will already be compliant. Red Sift notes that Gmail treats bulk sender status as permanent once you cross the threshold, so falling back below it later does not remove the requirements.

Start with an inventory of every sender

Before writing any DNS record, list every system that sends mail using your domain in the From address. A typical small company has its email suite, a marketing platform, a CRM, a helpdesk, an invoicing or payroll tool and website forms. Each one needs to be authorised in SPF, sign with DKIM using your domain, or send from a subdomain set aside for it.

Using subdomains for bulk or automated mail, such as news.example.com for newsletters, keeps the reputation of your main domain separate from campaign performance. It also makes the SPF record for the main domain shorter, which matters because of the DNS lookup limit described next. Write the inventory down, because you will need it when you read DMARC reports.

Publish SPF without breaking the lookup limit

SPF is a single TXT record that lists the servers allowed to send for your domain. RFC 7208 caps evaluation at 10 terms that require DNS lookups. The include, a, mx, ptr and exists mechanisms and the redirect modifier all count, including nested includes inside a provider's record, while ip4, ip6 and all do not. If the limit is exceeded, receivers return a permerror and SPF fails, which can push mail to spam.

Publish a single SPF record per domain or subdomain and keep it short. Prefer ip4 and ip6 entries for fixed servers, remove includes for tools you no longer use, and move heavy senders onto subdomains. End the record with ~all while you are testing, and move to -all once DMARC reports show every legitimate source passing.

• Example: v=spf1 include:_spf.google.com ~all
• One SPF TXT record per domain or subdomain
• Count nested includes against the lookup limit
• Prefer ip4 and ip6 entries where addresses are fixed

Sign mail with DKIM

DKIM adds a cryptographic signature to each message, checked against a public key published in your DNS under a selector such as google._domainkey. Gmail requires keys of at least 1024 bits and recommends 2048 bits where your provider supports it. Each sending service should have its own selector and key so that you can rotate or revoke one without affecting the others.

Generate the key in each platform's admin settings, publish the TXT or CNAME record it gives you, then turn on signing. Check a test message's headers for dkim=pass and confirm the d= domain is your own domain rather than the provider's, because DMARC alignment depends on it. Rotate keys when staff with DNS access leave or when a provider recommends it.

Publish DMARC and read the reports

DMARC tells receivers what to do when a message fails SPF and DKIM alignment, and asks them to send you reports. Gmail, Yahoo and Outlook.com all accept p=none as the minimum policy for bulk senders. Yahoo strongly recommends an rua tag so aggregate reports reach you, and accepts relaxed alignment, meaning a subdomain can align with its parent domain.

Start with a record such as v=DMARC1; p=none; rua=mailto:dmarc@yourdomain. Use a DMARC reporting tool to turn the XML reports into a list of sending sources, and fix each legitimate one until it passes. Then move to p=quarantine and finally p=reject. At reject, receivers refuse mail that spoofs your exact domain, which is the strongest protection you can give customers against fake invoices in your name.

Unsubscribe, spam rate and PTR rules for bulk senders

Marketing and subscribed messages from bulk senders must carry List-Unsubscribe and List-Unsubscribe-Post headers that support one-click unsubscribe, plus a visible link in the body. Yahoo recommends the RFC 8058 POST method and asks senders to honour requests within 2 days, while Red Sift reports Gmail expects processing within 48 hours. Most email platforms add these headers for you, but confirm it on a test send.

Google recommends keeping the user-reported spam rate in Postmaster Tools below 0.1% and never reaching 0.3%. Red Sift notes that a sender above 0.3% loses access to Gmail's mitigation support until the rate stays below that level for seven consecutive days. Sending IPs also need valid forward and reverse DNS, and Yahoo asks for PTR names that reflect your domain rather than generic hosting names.

Enforcement since November 2025 and what failure looks like

Gmail began ramping up enforcement in November 2025. Non-compliant mail may first be rate limited with temporary 4.7.x errors and then rejected outright with permanent 5.7.x errors, according to Red Sift. Outlook.com moved straight to rejection from 5 May 2025 for high-volume senders that fail the checks, returning the error 550 5.7.515, and adding a sender to Safe Senders does not bypass it.

Watch bounce logs in your sending platforms for these codes, and register your domain in Google Postmaster Tools to see spam rate and authentication results. A sudden rise in 5.7.x bounces usually means a sender was added without SPF or DKIM, or a DNS change broke a record. Keep DNS changes in a change log so you can trace problems quickly.

Why email authentication is a security control

These records are often treated as a deliverability chore, but they are also a defence against fraud. Phishing was the most common starting point for breaches in India in IBM's 2025 study, at 18%, and Verizon's 2025 DBIR lists phishing as a top initial access vector at about 15%. Google's small business security checklist includes setting up SPF as one of its baseline steps.

A domain at p=reject cannot easily be used to send messages that look like they come from your finance team, which removes one of the cheapest tricks used in invoice and payroll fraud. Pair DMARC with staff checks on payment changes, and you close both the technical and human sides of the same attack. XDQ Labs sets up and audits email authentication for new domains as part of its security engineering work.

Frequently asked questions

Sources

1. Email sender guidelines, Gmail Help, 2026
2. Sender best practices, Yahoo Sender Hub, 2026
3. Strengthening email security: Outlook's new requirements for high-volume senders, Microsoft Tech Community, 2025
4. Gmail's enforcement ramps up: what bulk senders need to know, Red Sift, 2025
5. SPF lookup limit explained, Mailhardener, 2026
6. Security checklist for small businesses (1 to 100 users), Google Workspace Admin Help, 2026
7. India Records Highest Average Cost of a Data Breach: IBM Cost of a Data Breach Report 2025, IBM India Newsroom, 2025
8. 2025 Data Breach Investigations Report (full report), Verizon Business, 2025