Email deliverability: set up SPF, DKIM and DMARC, meet the Gmail, Yahoo and Outlook rules, and stay out of spam

Email deliverability is whether your messages reach the inbox rather than spam or a rejection. Since 2024, Gmail and Yahoo have required bulk senders to authenticate with SPF, DKIM and DMARC, support unsubscribing from the message header and keep spam complaints under 0.3%. Since May 2025, Outlook.com has required authentication from domains sending it more than 5,000 emails a day. Meet those rules, then mail only people who asked.

The rules arrived in stages, and the latest stage is enforcement:

How the sender rules arrived

1. Oct 3, 2023Google announces new rulesAuthentication, easy unsubscribe and a spam-rate limit for bulk senders; the announcement requires unsubscribes to be processed within two days.
2. Feb 1, 2024Gmail requirements take effectFor everyone sending to Gmail accounts, with extra rules for bulk senders. Enforcement is gradual.
3. Feb 2024Yahoo begins enforcementSPF and DKIM, DMARC at p=none or stricter, and a working unsubscribe header for bulk senders.
4. Jun 1, 2024Gmail one-click deadlineEven for senders who already had an unsubscribe link. From June, a spam rate above 0.3% also rules out mitigation.
5. May 5, 2025Outlook.com rules take effectMore than 5,000 a day to its consumer addresses: SPF, DKIM and DMARC. Failing mail is rejected.
6. Nov 2025Gmail ramps up enforcementNon-compliant traffic can get temporary and permanent rejections.

What Gmail, Yahoo and Outlook.com require from senders

Each provider publishes its own list, and the three overlap without matching. This is the short version, with the details in each provider's words further down:

Sources: Gmail's sender guidelines and FAQ, Yahoo's Sender Hub and Microsoft's announcement.

Some rules apply to every sender, whatever the volume. Gmail requires all senders to set up SPF or DKIM, have valid forward and reverse DNS for their sending domains and IP addresses, use TLS, keep the spam rate under 0.3%, format messages to the email standard (RFC 5322) and never impersonate Gmail in the From address. Yahoo's list for all senders is similar: SPF or DKIM, valid forward and reverse DNS, a spam rate under 0.3% and the email standards.

Step 1: Find out whether you count as a bulk sender

Gmail defines a bulk sender as one that sends close to 5,000 messages or more to personal Gmail accounts within 24 hours, and says that senders who reach that once "are permanently considered bulk senders". Microsoft's rules start above 5,000 emails a day to its consumer addresses. Yahoo publishes no number.

The line is closer than it looks. Say your list has 40,000 subscribers and 45% of them use Gmail. One campaign to the whole list sends 18,000 messages to Gmail in a day, and from then on you're a bulk sender for good, even if you never send that much again.

So if you buy traffic to grow a list, set up for the bulk rules from the start. It's a one-time job, and doing it early means your first big send isn't also your first test.

Step 2: Publish SPF, DKIM and DMARC records

All three are records in your domain's DNS, at the registrar or DNS host where you manage it. Before you add anything, list every service that sends email as your domain: the store's order emails, the email platform, the help desk, the subscription app, any review or survey tool. A service you forget will fail authentication later.

Then set up each record. Your email platform shows the exact values for SPF and DKIM; the DMARC record you may have to write yourself:

The three DNS records, and alignment

Example records for a fictional yourbrand.com; your email platform gives you the exact values

SPFDKIMDMARCAlignment

SPF: who may send for your domain

A DNS TXT record on your domain that lists the services allowed to send mail for it. It must start with v=spf1. Each include names one sending service; -all at the end means fail anything else, ~all means softfail.

yourbrand.com TXT "v=spf1 include:_spf.emailplatform.example ~all"

One SPF record per domain: a second one is a permanent error. The include, a, mx, ptr and exists terms and the redirect modifier count toward a limit of 10 DNS lookups (RFC 7208).

DKIM: a signature on every message

Your sending platform signs each message, and receivers check the signature against a key you publish in your DNS. Turn on domain authentication in the platform and add the records it shows you, exactly as given.

Do it in every platform that sends as your domain, the store and the help desk included, so each one signs with your domain rather than its own.

DMARC: your policy, and the reports

A DNS TXT record at _dmarc on your domain. v=DMARC1 comes first, p= sets the policy (none, quarantine or reject) and rua= says where aggregate reports go.

_dmarc.yourbrand.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@yourbrand.com"

The record format is set by RFC 9989, the DMARC standard since May 2026. p=none is enough for Gmail and the minimum for Yahoo and Outlook.com.

Alignment: the From domain has to match

Gmail requires bulk senders to align the domain in the visible From address with the SPF or the DKIM domain. A message can pass DKIM and still fail DMARC if the signature belongs to the platform’s domain.

From: hello@yourbrand.com, DKIM signed by yourbrand.com: aligned
From: hello@yourbrand.com, DKIM signed only by emailplatform.example: not aligned

Microsoft requires alignment with SPF or DKIM, preferably both.

Two mistakes are worth checking for first. One is a second SPF record: when you add a new platform, add its include to the existing record instead, because two records make SPF fail with a permanent error (RFC 7208). The other is a platform that signs with its own domain instead of yours: the message passes DKIM without aligning with your From domain, and unless SPF aligns instead, DMARC fails.

Gmail requires bulk senders to align the From domain with either the SPF or the DKIM domain, and Microsoft requires alignment with either, preferably both. p=none is enough for Gmail and is the minimum Yahoo and Microsoft accept, so you don't need a strict policy to comply.

Start with p=none and a reporting address. The reports show which servers send mail as your domain and whether they pass, which is how you find the service you forgot before you ever tighten the policy. The DMARC specification itself was replaced in May 2026 by RFC 9989; under it, the record sits at _dmarc on your domain, starts with v=DMARC1, and takes a p= policy and rua= addresses for aggregate reports.

Once the records are live, send a test message to a Gmail, a Yahoo and an Outlook.com address and check in its headers that SPF, DKIM and DMARC all pass: a record can look right in DNS and still fail on a real message.

Step 3: Add one-click unsubscribe and honor it within 48 hours

Gmail requires bulk senders to support one-click unsubscribe for marketing and subscribed messages and to show a clearly visible unsubscribe link in the body. Transactional messages are excluded. Since June 1, 2024, that applies even to senders who already had an unsubscribe link.

One-click is defined in RFC 8058: the message carries a List-Unsubscribe header with an HTTPS address and a List-Unsubscribe-Post header with the single value List-Unsubscribe=One-Click, both covered by the DKIM signature. The mail app then unsubscribes the reader by sending a request to that address itself, so nobody has to open a page. A footer link alone doesn't do this. Most email platforms add the headers for you, so check the setting rather than coding them.

Then process the request quickly. Gmail's FAQ says to honor unsubscribes within 48 hours, and Yahoo says within 2 days. Microsoft lists an easy, visible opt-out as recommended practice for Outlook.com, not a requirement, but there's no reason to treat Outlook readers differently.

Step 4: Keep receipts and marketing apart

A receipt and a promotion do different jobs, and Google's guidelines say to send them differently. Messages of the same category should share a From address, with Google's own example giving sales receipts, promotions and account alerts separate addresses on one domain. Don't mix content types in one message: Google names promotions inside sales receipts as an example. And if you send from more than one IP address, use a different one for each message type (Google).

Here is how the two streams split for a store that sells supplements:

Two streams, kept apart

What goes where for a supplement store

Sent because the buyer did somethingTransactional

• Order confirmations, receipts, shipping and delivery updates
• Subscription renewal notices and failed-payment emails
• Its own From address, such as orders@yourbrand.com
• No promotions inside: Google names promotions in sales receipts as content not to mix

Gmail’s one-click requirement covers marketing and subscribed messages, not transactional ones.

Sent because you chose toMarketing

• Newsletters, offers, launches and win-backs
• Anything whose main job is to sell, reminders to reorder included
• Its own From address, such as news@yourbrand.com
• One-click unsubscribe headers and a visible unsubscribe link

If you send from several IP addresses, Google says to use a different one for each message type.

A post-purchase sequence crosses the line between the two. The confirmation and shipping emails are transactional; the reorder reminder and the win-back sell. The post-purchase email flow lays out each email, so decide each one's stream as you build it.

Subscription brands have a second reason to care. A renewal notice or a failed-payment email that lands in spam is a notice the customer never saw. The supplement subscription post covers what those notices must say; this step makes sure they arrive.

Step 5: Mail only people who asked, and stop mailing the ones who stopped reading

Authentication proves who sent a message. Whether people want it is measured by the spam rate: the share of messages delivered to the inbox that recipients then mark as spam. Gmail says to keep it under 0.10% in Postmaster Tools and never to reach 0.30%. Those are small numbers, and one careless send can cross them:

Spam reports per 20,000 messages that reach the inbox

Illustrative send to Gmail addresses

Gmail’s target: under 0.10%under 20

Gmail’s ceiling: 0.30%60

One send to a two-year-old segment0.37%: over the ceiling74

Crossing the ceiling has a cost beyond that day. Gmail's FAQ says that from June 2024, bulk senders with a spam rate above 0.3% are ineligible for mitigation, the delivery support senders ask for through Google's sender contact form, and become eligible again only after the rate stays below 0.3% for 7 consecutive days.

Google's guidelines spell out the habits that keep the rate down:

• Opt-in only. Make sure recipients opted in, and don't send to people who didn't sign up. A bought or rented list breaks this on day one.
• Confirm the address. Google says to confirm each recipient's address before subscribing them, which also catches typos from a phone keyboard.
• Drop bounces. Automatically unsubscribe anyone with multiple bounced messages.

Add one habit of your own: send to engaged readers first. Mail recent buyers and clickers on your normal schedule, mail people who haven't clicked in months less often, and remove them after a final re-permission email if they still don't respond. The cut feels like losing reach, but you lose readers who weren't reading, and a message you no longer send them is one that can't be reported as spam.

Reorders depend on the inbox too, so watch them next to the spam rate; the customer retention post shows how to read repeat purchases by cohort.

Step 6: Warm up gradually, then watch email deliverability every week

Volume is something you build, not switch on. Google's guidelines have a section titled "Increase sending volume slowly to avoid delivery problems": start with a low volume to engaged users and increase it slowly, send at a consistent rate rather than in bursts, and avoid sudden spikes if you have no history of sending large volumes. That applies to a new domain, a new platform and the launch of a new offer alike: build up to the full list over weeks rather than sending to all of it on day one.

Then watch two places every week. In Google's Postmaster Tools, check the compliance status, spam rate, domain and IP reputation, authentication and delivery errors. Its data typically updates within 24 hours, uses UTC, and can be incomplete on low-volume days (Google). Since Gmail began ramping up enforcement in November 2025, including temporary and permanent rejections, a rise in delivery errors deserves the same attention as a rise in spam reports. In your platform's bounce log, look for 550 5.7.515, the code Outlook.com uses to reject mail that doesn't meet its authentication rules.

If you're already landing in spam, shrink before you grow. For a couple of weeks, mail only people who clicked or bought recently, confirm that every message passes SPF, DKIM and DMARC with your From domain aligned, and check Postmaster Tools daily. Don't move to a new domain to escape the old one's reputation: the list and the habits that caused the problem move with you.

Here is the whole sequence in one place, with what goes wrong at each stage:

From DNS records to a steady inbox

1. 1Authenticate
2. 2Test
3. 3Warm up
4. 4Monitor
5. 5Fix

1Publish and align the records

What happens: SPF, DKIM and DMARC published, with every sending service signing as your domain.

Why it matters: Bulk senders need all three at Gmail and Yahoo, and Outlook.com rejects high-volume mail without them.

What goes wrong:

• Two SPF records after adding a platform
• A help desk or store still signing with its own domain

2Send test messages

What happens: Send to a Gmail, a Yahoo and an Outlook.com address and check in the headers that SPF, DKIM and DMARC pass.

Why it matters: A record can look right in DNS and still fail on a real message.

What goes wrong:

• Testing only the email platform, not the store’s receipts

3Raise volume gradually

What happens: Start with engaged subscribers and build to the full list over weeks, at a steady rate.

Why it matters: Google advises a low starting volume, a consistent rate and no sudden spikes without a history of large sends.

What goes wrong:

• A launch email to the whole list from a new domain
• Bursts of sends after weeks of silence

4Watch the numbers weekly

What happens: Postmaster Tools for spam rate, reputation, authentication and delivery errors; the bounce log for rejections such as 550 5.7.515.

Why it matters: Gmail’s data arrives within about a day, so a problem shows up after the send, not during it.

What goes wrong:

• Looking only at open rates
• Low-volume days with incomplete data read as a trend

5Fix the cause, not the symptom

What happens: Spam rate up: find the segment and stop mailing it. Authentication failing: correct the DNS. Rejections: read the code.

Why it matters: Above 0.3%, a Gmail bulk sender needs 7 days back under the line before mitigation is possible again.

What goes wrong:

• Switching platforms or domains to escape a bad reputation, which leaves the cause in place

Read more: Post-Purchase Email Flow: 7 Emails for Supplements

The claims in your emails follow the same rules as your VSL

Deliverability gets the email into the inbox. What it says still has to hold up. A promotional email for a supplement is advertising, like the VSL it links to, so make only the claims you'd make on the VSL page itself; the supplement advertising rules post covers the standard, in a summary that isn't legal advice. If you add text messages, consent works differently there, and the SMS compliance post covers it.

A subject line that overpromises has a cost of its own. A reader who feels tricked may report the email as spam, and spam reports are exactly what Gmail's threshold counts.

An email deliverability checklist for your next campaign

Run it before a launch, after any change to your sending setup, and once a month:

Email deliverability checklist

• One SPF record starting with v=spf1, listing every service that sends as you, within 10 DNS lookups
• DKIM turned on in every platform that sends as your domain
• A DMARC record at _dmarc with at least p=none and a reporting address
• Test messages to Gmail, Yahoo and Outlook.com pass SPF, DKIM and DMARC, with the From domain aligned
• One-click unsubscribe headers and a visible unsubscribe link on every marketing email
• Unsubscribes processed within 48 hours
• Receipts and marketing sent from separate From addresses, with no promotions in receipts
• New subscribers confirmed; addresses with repeated bounces removed automatically
• Spam rate in Postmaster Tools under 0.10% over the last week
• No 550 5.7.515 rejections in the bounce log
• Every claim in the email one you could make on the VSL page

0 of 11 done