Email Deliverability: SPF, DKIM and DMARC Explained

Why Good Email Lands in Spam

Scammers can put any name on the From line of an email. Inbox providers know this. So they look for proof that a message really came from the domain it claims.

If your domain does not offer that proof, your quotes and invoices can land in spam. Or they may not arrive at all. Three DNS records provide the proof. They are SPF, DKIM and DMARC.

SPF in Plain Words

SPF stands for Sender Policy Framework. It is a TXT record that lists the services allowed to send email as your domain.

An SPF record always starts with v=spf1. After that, it lists senders. For example, Google Workspace uses include:_spf.google.com. It ends with a rule for everyone else.

• -all means mail from anyone else should fail.
• ~all is a softer version. It means mail from others is probably not allowed.

Two rules matter most. First, a domain must not have more than one SPF record. If you add a service, add it to the record you have. Second, SPF allows only 10 DNS lookups when it is checked. Each include uses at least one. Too many services can break the record.

DKIM in Plain Words

DKIM stands for DomainKeys Identified Mail. It adds a hidden digital signature to each message you send. The signature sits in a header called DKIM-Signature.

The matching public key lives in your DNS. It sits at a name like selector1._domainkey.yourshop.com. The receiving server uses that key to check the signature. If the message was changed on the way, the check fails.

You usually turn DKIM on inside your email provider. The provider then gives you the DNS record to add.

DMARC in Plain Words

DMARC stands for Domain-based Message Authentication, Reporting and Conformance. It ties SPF and DKIM together. It tells inboxes what to do when a message fails, and where to send reports.

A DMARC record is a TXT record at _dmarc.yourshop.com. The key part is the policy, written as p=:

• p=none means take no special action. Just watch and report.
• p=quarantine means treat failing mail as suspicious, such as sending it to spam.
• p=reject means refuse failing mail.

The rua tag sets an address for summary reports. Google suggests using a separate mailbox or group for these, since they can add up.

What Gmail, Yahoo and Outlook.com Now Require

The big inbox providers have set clear rules.

Gmail asks all senders to set up SPF or DKIM and to keep spam rates in Postmaster Tools below 0.3%. Senders of 5,000 or more messages a day to Gmail must set up SPF, DKIM and DMARC. The DMARC policy can be p=none. Marketing messages must support one-click unsubscribe.

Yahoo asks all senders to use at least SPF or DKIM and to keep spam rates below 0.3%. Bulk senders need both SPF and DKIM, plus a DMARC policy of at least p=none. They must support one-click unsubscribe and honor it within two days.

Outlook.com set similar rules for domains sending over 5,000 emails a day. Those domains need SPF, DKIM and DMARC with at least p=none. Microsoft said that after May 5, 2025, mail from domains that do not comply would first go to Junk.

Even Small Senders Should Set These Up

Most local businesses send far fewer than 5,000 emails a day. Set these records up anyway. Microsoft notes that all senders benefit from strong authentication. It also protects your name from people who fake your domain.

Setup Order

Do this in order, and give each step a few days:

1. List every service that sends email as your domain. Include your inbox, website forms, invoicing, scheduling and marketing tools.
2. Build one SPF record that includes all of them.
3. Turn on DKIM in each service that supports it and add its DNS record.
4. Add a DMARC record with p=none and a report address.
5. Read the reports. Fix any real service that fails.
6. Move the policy to p=quarantine, then later to p=reject.

Google's own guide suggests this slow path. Start with none, then raise the policy as your results improve.

Other Habits That Help

• Only email people who asked to hear from you.
• Put a clear unsubscribe link in every marketing email.
• Remove addresses that bounce.
• Send from your own domain, not a free address.

Getting Help

These records are short, but a small typo can block your own mail. If you would like them checked or set up, T3CHS handles SPF, DKIM and DMARC as part of our business email setup.

Common Questions

Do I need DMARC if I only send a few emails a day?

The strict rules target bulk senders, but a DMARC record still helps inboxes trust your mail and protects your domain from fakes.

Why are my invoices going to customers' spam folders?

Often your invoicing tool is not in your SPF record or does not sign with DKIM. Add it, then check your DMARC reports.

Can I have more than one SPF record?

No. RFC 7208 says a domain must not have multiple SPF records. Combine every sender into one.

What DMARC policy should I start with?

Start with p=none so nothing gets blocked while you watch the reports. Google recommends moving up to quarantine or reject once things look clean.

What is one-click unsubscribe?

It lets people leave a marketing list with a single click. Gmail and Yahoo require it for bulk marketing mail.

Sources

1. Google: Email Sender Guidelinessupport.google.com
2. Yahoo: Sender Best Practicessenders.yahooinc.com
3. Microsoft: Outlook Requirements for High Volume Senderstechcommunity.microsoft.com
4. RFC 7208: Sender Policy Frameworkrfc-editor.org
5. RFC 6376: DKIM Signaturesrfc-editor.org
6. RFC 7489: DMARCrfc-editor.org
7. Google Workspace Admin Help: Set Up SPFknowledge.workspace.google.com
8. Google Workspace Admin Help: Set Up DMARCknowledge.workspace.google.com

Last reviewed September 27, 2026.