By PDS Team
SPF, DKIM and DMARC are three DNS-based checks that prove your emails really come from your domain. SPF lists the servers allowed to send for you, DKIM adds a digital signature to each message, and DMARC tells inbox providers what to do when a message fails those checks. Gmail and Yahoo now require them for bulk senders, so they matter for any business that sends newsletters, offers or invoices.
If you searched for “SPF DKIM DMARC” because your emails are landing in spam, this guide explains each record in plain language, the Gmail and Yahoo rules and a safe order to set everything up.
Why do SPF, DKIM and DMARC matter for email deliverability?
They matter because inbox providers use them to decide whether a message is genuine, and messages that fail can be sent to spam or rejected.
Without authentication, anyone can put your domain in the “From” line of an email. That is how many phishing and spoofing emails work. SPF, DKIM and DMARC let receiving servers check that a message claiming to be from your business was actually sent with your permission.
Good authentication does not guarantee the inbox, because content, list quality and complaints also count. But missing or broken records are one of the most common and most fixable reasons business email goes to spam. If you send campaigns and want this handled properly, our email marketing services in Noida include authentication checks before any campaign goes out.
What is SPF and how do you set it up?
SPF (Sender Policy Framework) is a DNS text record listing the mail servers and services allowed to send email for your domain.
A typical SPF record for a domain that uses Google Workspace looks like this:
v=spf1 include:_spf.google.com ~allGoogle’s troubleshooting guidance highlights a few rules that cause most SPF problems:
- Only one SPF record per domain. If you use several services, such as Google Workspace and an email marketing tool, combine them into a single record.
- A limit of 10 DNS lookups. Each
include,aormxmechanism counts, including lookups inside the services you include. Remove services that no longer send mail for you. - The ending matters. Google’s example uses
~all. It warns that-allcan be overly restrictive for legitimate mail and that?alldoes not authenticate outgoing messages.
What is DKIM and how does it work?
DKIM (DomainKeys Identified Mail) adds a digital signature to every email, which the receiving server checks against a public key published in your DNS.
Your email service holds a private key and signs each outgoing message with it. You publish the matching public key as a DNS record, usually under a name your provider gives you, called a selector. If the message is changed in transit or was not signed by your service, the check fails.
To set up DKIM:
- Generate a DKIM key in each service that sends email for you, such as Google Workspace, Microsoft 365 or your email marketing platform.
- Add the DNS record each service gives you at your domain or hosting provider.
- Turn on signing in the service once the record is live.
- Send a test email and check that DKIM shows as “pass” in the message headers.
Every service that sends email on your behalf needs its own DKIM set-up. This is often missed for CRMs, billing tools and website contact forms.
What is DMARC and which policy should you use?
DMARC is a DNS record that tells receiving servers what to do with mail that fails authentication and where to send reports about it.
A DMARC check passes when SPF or DKIM passes and the domain it checks is aligned with the domain in the visible “From” address. The record lives at _dmarc.yourdomain.com and has three main policy options:
| Policy | What happens to failing mail | When to use it |
|---|---|---|
p=none | Delivered as normal; you only receive reports | Starting out, to find all your sending services |
p=quarantine | Sent to the recipient’s spam folder | After reports show your legitimate mail passes |
p=reject | Refused by the receiving server | Once you are confident every legitimate source passes |
Google’s recommended rollout starts with p=none and a reporting address, for example:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comAfter reviewing reports, you can move to p=quarantine for a small percentage of mail using the pct tag, then increase it over time. Google also advises setting up SPF and DKIM at least 48 hours before turning on DMARC.
What do Gmail and Yahoo require from senders?
Since February 2024, Gmail and Yahoo require bulk senders to authenticate with SPF, DKIM and DMARC, offer easy unsubscribes and keep spam complaints low.
Gmail
Google’s requirements apply in full to bulk senders, defined as those sending close to 5,000 or more messages a day to personal Gmail accounts. Once you reach that level, you are treated as a bulk sender permanently. Bulk senders must:
- Authenticate with both SPF and DKIM.
- Publish a DMARC record, with a policy of at least
p=none. - Align the “From” domain with either the SPF or the DKIM domain.
- Offer one-click unsubscribe in marketing and promotional messages, using the List-Unsubscribe headers described in RFC 8058, and act on requests within 48 hours.
- Keep the spam rate reported in Postmaster Tools below 0.1% and never let it reach 0.3% or higher.
Google also states that all senders to personal Gmail accounts, not only bulk senders, must follow its email sender guidelines.
Yahoo
Yahoo asks all senders to use at least SPF or DKIM, keep the spam rate below 0.3% and have valid forward and reverse DNS for sending IPs. Bulk senders must use both SPF and DKIM, publish a DMARC policy of at least p=none, support one-click unsubscribe with a visible unsubscribe link in the body, and honour unsubscribes within two days.
SPF DKIM DMARC set-up: what is the right order?
Set up SPF first, then DKIM for every sending service, then DMARC in monitoring mode, and only tighten the policy once reports look clean.
| Step | Task | Check |
|---|---|---|
| 1 | List every service that sends email using your domain | Include website forms, CRM, billing and marketing tools |
| 2 | Create or fix a single SPF record | One record, within 10 lookups |
| 3 | Turn on DKIM in each service | Test emails show DKIM pass |
| 4 | Wait at least 48 hours, then add DMARC with p=none | Reports start arriving at your rua address |
| 5 | Review reports and fix failing sources | Legitimate mail passes and aligns |
| 6 | Move to p=quarantine gradually, then consider p=reject | No genuine mail lost |
| 7 | Add one-click unsubscribe to marketing mail | Requests processed within two days |
Your DNS is usually managed at your domain registrar or hosting provider. If you are unsure where your records live or need help editing them, our web hosting services team can manage DNS changes safely.
SPF, DKIM and DMARC FAQs
Do I need all three: SPF, DKIM and DMARC?
Yes, if you send marketing or bulk email. Gmail requires bulk senders to use SPF, DKIM and DMARC, and Yahoo has similar rules. Even smaller senders benefit, because the three records together make it much harder for others to spoof your domain and give inbox providers more reasons to trust your messages.
Why are my emails going to spam even with SPF and DKIM?
Authentication is only one signal. Emails can still land in spam because of a missing DMARC record, poor alignment with the “From” domain, high complaint rates, purchased or old lists, or content that looks spammy. Check your headers for pass results, then review your list quality, unsubscribe process and how often recipients mark your messages as spam.
What does p=none mean in DMARC?
The p=none policy tells receiving servers not to take action on mail that fails DMARC. Messages are delivered as usual, but you receive reports showing which sources pass or fail. It is the safe first step, and it is the minimum policy that Gmail and Yahoo accept from bulk senders.
Can I have two SPF records?
No. Google’s guidance says each domain can have only one SPF record, and multiple records can cause your email to be marked as spam. If you use several services, merge their include statements into a single record and keep the total within the 10 DNS lookup limit.
What is one-click unsubscribe?
One-click unsubscribe lets recipients leave your list directly from their email app, without visiting a page or logging in. It works through List-Unsubscribe headers defined in RFC 8058. Gmail requires it for marketing and promotional mail from bulk senders, and both Gmail and Yahoo expect requests to be honoured within about two days.
Do these rules apply if I only send a few emails a day?
The strictest Gmail rules apply to senders of close to 5,000 or more messages a day to personal Gmail accounts. However, Google says all senders must follow its basic sender guidelines, and Yahoo asks all senders to use SPF or DKIM. Setting up all three records is a good idea for any business domain.
Need help with email deliverability?
If your campaigns or business emails are landing in spam, our email marketing services in Noida can check your SPF, DKIM and DMARC set-up and fix what is missing. We work with businesses across Delhi NCR and India. Contact our team for an email authentication check.
