The Newsletter That Quietly Stopped Arriving
Nothing announces itself when authentication is missing. Open rates sag, a customer mentions they never got the invoice, and the campaign report still says delivered.
The mail was accepted and then filed away from the inbox. That gap between delivered and seen is where SPF, DKIM, and DMARC do their work.
Three DNS Records Decide Whether Your Campaign Is Delivered
Yes, you need all three, and the requirement is now written down rather than implied. Google requires SPF, DKIM, and a published DMARC policy from anyone sending more than 5,000 messages a day to Gmail accounts, effective February 1, 2024. Yahoo announced matching standards the same month.
The minimum DMARC policy both accept is p=none, which reports without rejecting. Both also ask senders to keep spam complaints below 0.3 percent and to honor unsubscribes within 2 days. Under 5,000 messages a day the rules are softer, but the same records still separate mail that lands from mail that filters.
The Inbox Rules Changed in February 2024 and Never Changed Back
Before 2024, authentication was a best practice that many small senders skipped without obvious consequence. Gmail and Yahoo turned it into a published requirement with a volume threshold attached.
The threshold counts messages sent to that provider, not your total list. A 6,000-contact list where most addresses are Gmail crosses the Gmail line on a single send.
Enforcement rolled out gradually through the first half of 2024 rather than arriving as a single switch. That is why some senders saw nothing change and others watched delivery fall off over a few weeks.
SPF, DKIM, and DMARC in Plain Terms
SPF is a published list of the servers allowed to send mail using your domain. When your platform sends on your behalf, its servers have to appear on that list.
DKIM attaches a cryptographic signature to each message. The receiver looks up your public key in DNS and confirms the message body and key headers were not altered in transit.
DMARC sits on top of both. It tells receivers what to do when a message claiming to be from your domain fails SPF and DKIM, and it asks them to send you reports about what they saw.
The part that trips people up is alignment. DMARC does not just want SPF or DKIM to pass; it wants the domain in the visible From header to match the domain that passed.
What Each Record Is Actually For
| Record | Question it answers | Where it lives | Minimum for bulk senders | Common failure |
|---|---|---|---|---|
| SPF | Is this server allowed to send for my domain | TXT record on your domain | Present and passing | Too many DNS lookups in one record |
| DKIM | Was this message altered after signing | TXT record on a selector subdomain | Present and passing | Platform key never published in DNS |
| DMARC | What should happen when SPF and DKIM fail | TXT record at _dmarc.yourdomain | Valid policy, p=none accepted | From domain does not align with the passing check |
| List-Unsubscribe | How does a reader opt out in one click | Message header, set by your platform | Required for marketing mail | Header present but the link is a preferences page |
| Reverse DNS | Does the sending IP name itself honestly | Set by whoever owns the IP | Valid forward and reverse records | Only relevant if you run your own mail server |
The last two rows are worth reading together with the first three. Google lists them in the same set of bulk sender requirements, and a sender can pass all three DNS checks and still be flagged on the unsubscribe rule.
Your Platform Signs the Mail but Only You Own the Domain
Email platforms describe this step as domain authentication or domain verification. The platform generates the exact records for you; it cannot publish them, because they belong to your DNS zone.
That split is the reason so many accounts sit half configured. Someone finishes the platform side, sees a green checkmark on the sending address, and never opens the DNS panel at the registrar.
A useful test is to send yourself a campaign and open the raw headers in Gmail. Show original reports SPF, DKIM, and DMARC as pass or fail on that single message, which is faster than reading a dashboard.
If your domain is new, send a low volume for the first few weeks before the main campaign. Reputation attaches to the sending domain, and a cold domain that suddenly sends thousands of messages looks exactly like a compromised one.
Sending From a Gmail Address Is the Trap
Small businesses often set the From address to their own Gmail or Yahoo account because it feels more personal. DMARC makes that choice actively harmful now.
Google and Yahoo publish strict DMARC policies on their own consumer domains. A campaign platform sending as yourname at gmail.com fails alignment by design, and receivers are told to reject it.
The fix is a domain you control, even a cheap one. Sending as hello at yourbusiness.com costs a domain registration and gives you records you can actually publish.
Spam Rate Is a Number You Can Watch, Not Guess
Both Google and Yahoo name 0.3 percent as the complaint ceiling. Google Postmaster Tools shows your reported rate once you verify the domain, which takes the same DNS panel you just opened.
Three complaints per thousand delivered messages is a thin margin. A single re-engagement blast to addresses that have ignored you for a year can cross it in one afternoon.
The usual cause is list age rather than content. Removing contacts who have not opened anything in six months lowers complaints and shrinks the bill on contact-priced plans at the same time.
Reading a DMARC Report Without Buying a Tool
The rua address in your DMARC record is where aggregate reports arrive. They come as compressed XML attachments, usually one per receiving provider per day.
Point rua at a mailbox you check monthly rather than your main inbox. The volume is low but the attachments are unreadable without a parser, and a free parser is enough for a small sender.
What you are looking for is any source sending as your domain that you do not recognize. Everything else is confirmation that your platform is aligned and passing.
Which Setup Fits Your Sending Situation
Under 500 contacts, sending from a free provider address: Register a domain before you grow. You are below every threshold today, but you are also building reputation on an address you cannot authenticate.
A few thousand contacts on one platform: Complete domain authentication in the platform, publish SPF, DKIM, and DMARC at p=none, and verify in Postmaster Tools. That is the whole job for most small businesses.
Sending from two tools, such as a campaign platform and a helpdesk: Both need to pass under the same domain. SPF has a hard limit of 10 DNS lookups, and stacking providers is the usual way to blow through it.
Transactional receipts plus marketing campaigns: Split them onto separate subdomains, such as mail and billing. A bad campaign week then cannot drag your invoices into the spam folder.
Already at p=none with clean reports for a month: Move to p=quarantine. You have the evidence that legitimate mail passes, and you close the door on people spoofing your domain.
Where Small Senders Get Stuck
The SPF lookup limit is the quiet one. Every include in your SPF record costs a lookup, and the eleventh lookup makes the record permanently fail rather than degrade.
Publishing two SPF records for one domain also fails. When you add a second provider, you merge its include into the existing record instead of creating a new line.
DKIM keys go stale when platforms rotate selectors. If deliverability drops months after a clean setup, re-check the DKIM record against what the platform currently shows.
Finally, a preferences page is not a one-click unsubscribe. The header has to remove the address without asking the reader to log in or choose options.
One Afternoon of DNS Work Protects Every Send After It
None of this is ongoing labor. You publish three records, verify them once, and then watch a complaint rate that mostly reflects how clean your list is.
The order that works is domain first, records second, volume third. Get the domain and its records in place while your list is small and the reputation you build is yours to keep.
If you are moving between platforms, re-check every record after the move rather than assuming they carried over. Our guide on switching email marketing platforms without losing subscribers covers the sequence, and double opt-in versus single opt-in covers the list hygiene that keeps complaints under the line.
FAQ
Do I need SPF, DKIM, and DMARC if I only send a small newsletter?
Every sender does in practice, and bulk senders are required to. Google requires SPF, DKIM, and a DMARC policy from anyone sending more than 5,000 messages a day to Gmail accounts, effective February 2024. Below that line the records are still what keeps your mail out of the spam folder.
What is the difference between SPF, DKIM, and DMARC?
SPF lists which servers may send for your domain. DKIM signs each message so the receiver can prove it was not altered. DMARC tells receivers what to do when a message fails those checks and where to send the reports.
Is p=none good enough for DMARC?
Google and Yahoo both accept a policy of p=none as the minimum for bulk senders. That publishes a valid DMARC record and starts the reports flowing without rejecting anything. Move to quarantine or reject later, once the reports show your legitimate mail passing.
What spam complaint rate will get my email blocked?
Both Google and Yahoo ask senders to keep the spam complaint rate below 0.3 percent as measured in Postmaster Tools. That is roughly 3 complaints per 1,000 delivered messages. Cleaning inactive addresses usually moves that number faster than anything else.
Can my email marketing platform set this up without me touching DNS?
No. Your platform can sign and authenticate on your behalf, but SPF, DKIM, and DMARC live as DNS records on the domain you send from. Someone with access to that domain has to paste in the records the platform generates.
Some links may be affiliate links. We may earn a commission at no extra cost to you.
This article was written with AI assistance. It is researched and fact-checked, not based on personal hands-on testing unless explicitly stated.
Comments
Post a Comment