SPF, DKIM and DMARC in Plain Words: Keep Your Emails Out of Spam

You wrote a good email, hit send, and a chunk of your list never saw it because it landed in spam or got rejected. For a small list, that hurts. The fix usually isn’t a clever subject line. It’s three DNS records with ugly names: SPF, DKIM and DMARC.

This guide explains what each one does in plain words, what Gmail and Yahoo ask of senders, and how to get set up without becoming a network engineer.

Why Deliverability Matters More Than List Size

Inbox providers are trying to protect their users from spam and from people pretending to be someone else. Since February 2024, both Gmail and Yahoo have published firmer requirements for anyone sending email to their users. Some rules apply to every sender; stricter ones kick in for bulk senders. Gmail draws that line at 5,000 or more messages a day to personal Gmail accounts.

You may be nowhere near 5,000 a day. Set things up properly anyway. The basic rules already apply to you, your list will (hopefully) grow, and authenticated mail from your own domain simply looks more trustworthy than mail that can’t prove where it came from.

SPF, DKIM and DMARC in Plain Words

Think of sending email like mailing a letter from your business address.

SPF: The Approved Senders List

SPF (Sender Policy Framework) is a short text record on your domain that lists which servers are allowed to send mail on your behalf. When your email service sends a newsletter “from” your domain, the receiving server checks that list. If the sending server isn’t on it, that’s a red flag.

DKIM: The Tamper-Proof Seal

DKIM (DomainKeys Identified Mail) adds a digital signature to each message. Your email service signs outgoing mail with a private key, and you publish the matching public key in your DNS. The receiving server checks the signature to confirm the message really came from an authorized sender and wasn’t altered on the way. Google’s guidelines call for a DKIM key of at least 1024 bits when sending to personal Gmail accounts and recommend 2048 bits if your provider supports it.

DMARC: The Instructions and the Report

DMARC (Domain-based Message Authentication, Reporting and Conformance) ties the two together. It tells receiving servers what to do when a message claiming to be from your domain fails the checks, and it can send you reports. A policy of p=none means “just monitor, don’t block anything yet,” which both Gmail and Yahoo accept for bulk senders as a starting point.

The key idea is alignment: the domain in your visible From address needs to match the domain that passed SPF or DKIM. That’s why sending from a free webmail address (like a Gmail address) through an email service is a problem. You can’t authenticate a domain you don’t own.

What Gmail and Yahoo Ask For

Here’s a simplified summary of the published requirements in place since February 2024. Check the official pages linked below, because providers update them.

For All Senders

Set up SPF or DKIM for your sending domain.
Keep your spam complaint rate below 0.3%. Gmail recommends staying below 0.1% and never reaching 0.3%.
Use properly formatted messages and valid reverse DNS on sending servers (your email service handles this part).

For Bulk Senders

Set up both SPF and DKIM, plus a DMARC record (a policy of p=none is acceptable).
Make sure your From domain aligns with the SPF or DKIM domain.
For marketing and subscribed messages, support one-click unsubscribe in the message header and show a clearly visible unsubscribe link in the body. Yahoo asks senders to honor unsubscribes within two days.
Keep spam complaints below 0.3%.

How to Set It Up Without Panic

Most email services walk you through this. The exact screens differ, but the steps look like this:

Use your own domain for sending. Send from something like hello@yourdomain.com, not a free webmail address.
Find your email service’s domain authentication page. Search its help center for “domain authentication” or “authenticate domain.” It will give you DNS records to add.
Add the records at your DNS host. That’s usually where you bought your domain or where your site is hosted. Copy the values exactly. If you already have an SPF record, edit it rather than adding a second one; a domain should have only one SPF record.
Add a basic DMARC record. A common starting point is a TXT record at _dmarc.yourdomain.com with v=DMARC1; p=none; plus an address for reports. Ask your email service or host if you’re unsure.
Wait, then verify. DNS changes can take a little while to spread. Then use the verify button in your email service.
Send yourself a test. In Gmail, open the message, choose “Show original,” and look for SPF, DKIM and DMARC showing PASS.

If you send to Gmail users in volume, Google’s free Postmaster Tools lets you watch your spam rate and domain reputation over time.

Habits That Keep You Out of Spam

Authentication proves who you are. It doesn’t make people want your email. Complaint rates come from how you treat subscribers:

Only email people who asked to hear from you. Never buy or import lists.
Tell people what they’ll get and how often when they sign up, then stick to it.
Make unsubscribing easy. Someone who leaves quietly is far better for you than someone who clicks “Report spam.”
Remove addresses that bounce and, from time to time, people who haven’t opened anything in a long while.

None of this is glamorous, and it won’t make your list grow overnight. It’s the kind of quiet maintenance that keeps the work you put into each email from vanishing.

Do This Today

Send a test email from your email service to a Gmail address you own, open “Show original,” and write down whether SPF, DKIM and DMARC say PASS. If any of them fail, open your email service’s domain authentication guide and add the missing record.