- Gmail requires every sender to set up SPF or DKIM; senders of more than 5,000 messages a day to Gmail need SPF, DKIM and DMARC.
- Yahoo's bulk sender rules also require SPF, DKIM and a DMARC policy of at least p=none that passes.
- Marketing messages need one-click unsubscribe and a visible unsubscribe link; Yahoo asks for unsubscribes to be honoured within 2 days.
- Both providers ask senders to keep spam complaint rates below 0.3%.
What do you need for email to reach the inbox in Gmail and Yahoo?
Authenticate your domain with SPF and DKIM, publish a DMARC policy, keep spam complaints low, and give marketing recipients one-click unsubscribe. Google and Yahoo both made these sender requirements stricter from February 2024, and senders that do not meet them risk rate limits, rejected messages or the spam folder. The basics are a one-time DNS setup plus good list habits.
Our email marketing team sets this up for clients before any campaign goes out. Here is what each part does.
What is SPF?
Sender Policy Framework is a DNS record that lists the servers allowed to send email for your domain. When a message arrives, the receiving server checks whether it came from one of those servers. Every service that sends as your domain, such as your mailbox provider, marketing platform, CRM and website contact form, needs to be included.
What is DKIM?
DomainKeys Identified Mail adds a digital signature to each message. The public key sits in your DNS, so receivers can confirm the message really came from your domain and was not changed on the way. Each sending service usually gives you its own DKIM record to publish.
What is DMARC?
DMARC tells receivers what to do when a message fails authentication, and sends you reports about who is sending as your domain. It also checks alignment: the domain in the visible From address must match the domain that passed SPF or DKIM. Policies range from none (monitor only) to quarantine and reject.
What does Gmail require?
Google's email sender guidelines set requirements for all senders to Gmail accounts from 1 February 2024:
- SPF or DKIM authentication for your sending domain.
- Valid forward and reverse DNS (PTR records) for sending domains or IPs.
- A TLS connection for transmitting email.
- Spam rates reported in Postmaster Tools below 0.3% (Google).
- Messages formatted to the RFC 5322 standard, with no impersonation of Gmail From headers.
According to the same Google page, senders of more than 5,000 messages a day to Gmail accounts must also set up both SPF and DKIM, set up DMARC (the policy can be none), align the From domain with SPF or DKIM, and support one-click unsubscribe with a clearly visible unsubscribe link in marketing and subscribed messages.
What does Yahoo require?
Yahoo's sender best practices ask bulk senders to implement both SPF and DKIM, publish a valid DMARC policy of at least p=none that passes, support one-click unsubscribe (the RFC 8058 POST method is highly recommended), honour unsubscribes within 2 days, and keep the spam rate below 0.3%.
How do you set it up step by step?
- List every service that sends as your domain, including the ones people forget, such as invoicing tools and website forms.
- Publish one SPF record that includes all of them. A domain should have only one SPF record.
- Enable DKIM in each service and publish the records they give you.
- Publish DMARC with p=none and a reporting address, then read the reports for a few weeks.
- Fix any legitimate source that fails, then consider moving to quarantine and reject.
- Turn on one-click unsubscribe in your marketing platform and check unsubscribes sync to your CRM.
DNS changes are quick but easy to get wrong, so our cloud and DevOps team checks records before and after every change.
Which mistakes break authentication most often?
- Two SPF records on one domain. Receivers treat this as an error, so merge them into one.
- Too many DNS lookups in SPF. The SPF standard limits lookups to 10; long chains of includes can exceed it and fail.
- A new tool sending without DKIM. A help desk or invoicing app added later often sends unsigned mail as your domain.
- Jumping straight to p=reject. Without reading reports first, you can block your own legitimate email.
- Forgetting website forms. Contact form notifications sent from the web server often fail SPF and land in spam.
Should marketing email use a subdomain?
Many businesses send bulk marketing from a subdomain, such as news.yourdomain.com, and keep the main domain for everyday mail. It separates reputation, so a campaign that draws complaints does not hurt invoices and sales replies. Each subdomain still needs its own SPF, DKIM and DMARC alignment.
How do you keep deliverability healthy?
- Register your domain in Google Postmaster Tools and watch the spam rate.
- Send only to people who opted in, and remove addresses that bounce or never engage.
- Increase volume gradually when you start sending from a new domain or service.
- Keep the unsubscribe link easy to find; people who cannot leave mark mail as spam instead.
Authentication also protects your brand, because DMARC at enforcement makes it much harder for others to send phishing email as your domain. If your website forms send notifications, check those too as part of regular website maintenance.
Frequently asked questions
Do the Gmail rules apply to small senders?
Yes, in part. Google's requirements for all senders to Gmail accounts include SPF or DKIM, valid forward and reverse DNS, a TLS connection, correctly formatted messages and spam rates below 0.3%. The stricter rules, such as SPF and DKIM together plus DMARC and one-click unsubscribe, apply to senders of more than 5,000 messages a day.
Is a DMARC policy of p=none enough?
It meets the minimum that Google and Yahoo set for bulk senders, and it is the right place to start because it only monitors. Once reports show all your legitimate sending services pass, you can move to quarantine and then reject, which gives stronger protection against people spoofing your domain.
Why are my emails going to spam even with SPF and DKIM?
Authentication is only the entry ticket. Spam placement also depends on complaint rates, sending to old or purchased lists, sudden volume spikes, misleading subject lines, and missing unsubscribe options. Check Google Postmaster Tools, clean your list, and send content people actually signed up for.
What is one-click unsubscribe?
It is a standard, described in RFC 8058, that lets mailbox providers show an unsubscribe button which works with a single click, using List-Unsubscribe headers. Most email marketing platforms add it automatically, but check it is enabled, and that your own systems also honour unsubscribes quickly.
Last updated