•
•
•
•
•
•
•
How the three records work together, what Gmail, Yahoo and Outlook now require, and a safe rollout plan
Email authentication is the set of technical standards that lets receiving mail servers verify that a message claiming to come from your domain really does. The three core standards are SPF, DKIM and DMARC. Without them, your marketing and transactional emails are more likely to land in spam, and criminals can more easily spoof your domain in phishing attacks.
From February 2024, Google and Yahoo began enforcing requirements for bulk senders. Google defines bulk senders as those sending close to 5,000 or more messages a day to Gmail accounts. Key requirements include:
p=none).Microsoft announced similar requirements for high-volume senders to Outlook.com consumer addresses in 2025. Even small senders benefit from following the same rules.
Sender Policy Framework (SPF) is a DNS TXT record listing the servers and services allowed to send email for your domain.
v=spf1 include:_spf.google.com include:sendgrid.net ~allinclude: authorises a provider's servers.~all (soft fail) or -all (hard fail) tells receivers what to do with mail from other servers.Watch out for: SPF allows a maximum of 10 DNS lookups. Too many include: entries cause SPF to fail. Also, SPF checks the hidden envelope sender, not the visible From address, which is why DMARC alignment matters.
DomainKeys Identified Mail (DKIM) adds a cryptographic signature to each message. The sending server signs with a private key; the receiver checks it using a public key published in DNS, for example at selector1._domainkey.example.com.
Domain-based Message Authentication, Reporting and Conformance (DMARC) tells receivers what to do when a message fails authentication and alignment, and where to send reports.
v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com; adkim=r; aspf=r| Policy | Effect |
|---|---|
p=none | Monitor only; no action taken |
p=quarantine | Failing mail goes to spam |
p=reject | Failing mail is refused |
A message passes DMARC if it passes SPF or DKIM and that passing domain aligns with the visible From domain.
p=quarantine, optionally using pct= to apply gradually.news.example.com to separate reputation from transactional mail.Authentication gets you through the door; engagement keeps you there.
Yes. They solve different problems, and mailbox providers now expect all three from bulk senders.
p=reject stop my own emails?It can if some legitimate services are not authenticated. That is why you monitor at p=none first.
Usually minutes to a few hours, depending on TTL settings.
No. It is a requirement, not a guarantee. Reputation and engagement still decide placement.
SPF, DKIM and DMARC are now baseline hygiene for any organisation that sends email. Set them up correctly, move DMARC to enforcement carefully, and pair authentication with good list practices to protect both deliverability and your brand.