SPF, DKIM, and DMARC are the DNS records that prove an email really came from your domain, and they shape the deliverability of every marketing automation campaign. Since 2024, Gmail has required SPF or DKIM from every sender, and all three records, aligned, from anyone sending close to 5,000 messages a day.
The rules are in the Gmail sender guidelines and in Yahoo’s sender requirements. For businesses running AI email marketing through their own SMTP, everything is configured in the domain’s DNS and at the sending provider, not in the campaign tool.
This guide explains what each record does, what Gmail and Yahoo require, records ready to copy, how to check your DNS, one-click unsubscribe, spam rate, and a table of errors with fixes.
Key Takeaways
- SPF says which servers can send for the domain, DKIM signs the message, and DMARC tells the receiver what to do when both fail.
- Above roughly 5,000 messages a day to Gmail, the domain needs SPF, DKIM, DMARC with at least p=none, alignment, and one-click unsubscribe.
- The spam rate in Postmaster Tools should stay below 0.10% and never reach 0.30%. A purchased list is the fastest way to exceed it.
SPF, DKIM, and DMARC: What They Are and Why They Matter
The three records work together, but each one answers a different question. Setting up only one of them and assuming the domain is authenticated is the most common mistake.
Three Records, Three Different Questions
SPF, defined in RFC 7208, lists the servers authorized to send email for the domain. The receiving server compares the source IP with that list and returns a result, such as pass, fail, or softfail.
DKIM, described in RFC 6376, adds a digital signature to the header. The receiver fetches the public key from DNS and checks the signature, which shows that the domain signed the message and that the signed content did not change.
DMARC completes the set: it tells the receiver what to do when a message passes neither SPF nor DKIM. DMARC passes only when one of the two passes and the authenticated domain matches the sender’s domain.
Why This Became a Requirement in 2024
Starting February 1, 2024, Gmail began requiring authentication from all senders that email personal accounts ending in @gmail.com or @googlemail.com. Yahoo announced similar requirements for the same month.
The stated reason is to protect people from spoofing and phishing. According to Google, authenticated messages are less likely to be rejected or sent to spam, and unauthenticated ones may bounce with error 5.7.26.
Gmail Requirements for Bulk Senders
Google splits the rules into two tiers: what applies to any sender and what applies to high-volume senders. The sender guidelines FAQ details who falls into the second group and what happens to those who do not comply.
Rules for All Senders
Any sender that emails personal Gmail accounts must meet the points below. As with WhatsApp bulk messaging, the sender’s reputation matters as much as the technical setup:
- Authentication: SPF or DKIM set up on the sending domains.
- Server DNS: valid forward and reverse (PTR) records for the sending IP or domain.
- Secure connection: TLS for transmitting the message.
- Spam and format: a spam rate below 0.3% in Postmaster Tools and messages formatted to the RFC 5322 standard.
Rules for Senders of More Than 5,000 a Day
A bulk sender is anyone who sends close to 5,000 messages or more in 24 hours to personal Gmail accounts. Messages from subdomains count toward the primary domain, and a sender that hits that volume once keeps the classification permanently.
This group needs SPF and DKIM, DMARC that can stay at none, an aligned sender, and one-click unsubscribe in marketing messages. Since November 2025, Gmail has ramped up enforcement, with temporary and permanent rejections.
Yahoo Requirements and What Differs Between Providers
Yahoo’s sender requirements follow the same logic as Gmail’s. A domain configured correctly once meets both providers’ rules without separate adjustments.
What Yahoo Requires
For all senders, Yahoo requires SPF or DKIM, a spam rate below 0.3%, valid forward and reverse DNS, and compliance with RFCs 5321 and 5322. For bulk sending, it requires SPF and DKIM together and a valid DMARC record that must pass.
Yahoo recommends including the rua tag in DMARC to receive reports and accepts relaxed alignment. Unsubscribe requests must be honored within 2 days, and the link in the body can lead to a preferences page.
Where Gmail and Yahoo Differ
The most practical difference is unsubscribe. Yahoo accepts the mailto method, though it recommends the RFC 8058 POST, while Gmail says mailto does not meet the one-click unsubscribe requirement.
Both require DMARC with at least p=none and about 2 days to honor an unsubscribe. Following the stricter rule on each point is the simplest way to satisfy both providers.
How SPF Works
SPF tends to break when a company adds a new sending tool. Two rules in the RFC explain frequent errors: one record per domain and a lookup limit.
Record Syntax and Mechanisms
An SPF record is a TXT record that always starts with v=spf1. Then come the mechanisms, such as include to authorize a provider’s server and ip4 for a fixed address, and at the end, all, which covers everything else.
The qualifier before all changes the result: ~all produces softfail, and -all produces fail. Google’s SPF setup page recommends ~all and reminds senders that the record must list every service that sends email on behalf of the domain.
The 10-Lookup Limit and a Single Record
Under RFC 7208, if the domain has more than one v=spf1 record, the result is permerror. This happens when each provider asks for a record and the company creates a second one instead of merging the two.
The other limit is 10 terms that trigger a DNS lookup, such as include, a, mx, ptr, exists, and redirect. Going over 10 also returns permerror, and SPF stops authenticating. The ip4, ip6, and all mechanisms do not count toward this limit.
How DKIM Works
DKIM depends on two pieces: a private key on the sending server and a public key published in DNS. Google advises confirming that the sending provider authenticates the domain with DKIM, but the record lives in DNS.
Keys, Selector, and the _domainkey Record
Each signature carries the d= tag, with the signing domain, and the s= tag, with the selector. The receiver looks up selector._domainkey.yourdomain.com and fetches the public key there, as RFC 6376 defines.
That is why the same domain can have several DKIM keys, one per provider, each with its own selector. When the selector published in DNS is not the one in the signature, DKIM fails even with the correct key.
Key Length and Header Signing
Gmail requires a DKIM key of at least 1,024 bits and recommends 2,048 bits when the domain provider supports it. RFC 6376 also sets 1,024 bits as the minimum for long-lived keys.
For DMARC alignment, what matters is the domain in d=. If the provider signs with its own domain instead of yours, DKIM passes but does not align with the sender, and DMARC can fail.
How to Set Up DMARC and Domain Alignment
DMARC is a TXT record published at _dmarc.yourdomain.com. The original specification, RFC 7489 from 2015, was replaced in May 2026 by RFC 9989, which became an IETF standard and changed some tags.
Record Tags and the Starting Policy
The record starts with v=DMARC1, which must be the first tag, followed by p= with the policy: none, quarantine, or reject. The rua= tag sets the email address that receives aggregate reports, with the mailto: prefix.
The adkim and aspf tags set alignment, relaxed (r, the default) or strict (s). The pct tag, common in older examples, became historic in RFC 9989, which created the t tag for testing mode.
Google’s DMARC guide says to set up SPF and DKIM at least 48 hours beforehand and to start with p=none. After a week of reports with no surprises, the policy can move to quarantine and, later, to reject.
Relaxed and Strict Alignment
Alignment means the domain in the From field matches the authenticated domain. In relaxed mode, the same organizational domain is enough, such as news.yourdomain.com and yourdomain.com. In strict mode, the match must be exact.
To pass DMARC, a message needs SPF or DKIM that is authenticated and aligned. Google recommends aligning both and warns that dual alignment will likely become a requirement.
SPF, DKIM, and DMARC DNS Records Ready to Copy
The examples use uppercase placeholders. Replace yourdomain.com with the sender’s domain and the other placeholders with the values your sending provider shows in its dashboard.
The Three Records with Placeholders
The table shows SPF, DKIM, and the three DMARC phases, with @ for the root domain. Some dashboards append the domain to the name automatically, and others ask for the full name.
| Record | Type | Name (host) | Value |
|---|---|---|---|
| SPF, one provider | TXT | @ | v=spf1 include:PROVIDER-SPF ~all |
| SPF, two services | TXT | @ | v=spf1 include:PROVIDER-SPF include:OTHER-SERVICE-SPF ~all |
| DKIM | TXT | SELECTOR._domainkey | v=DKIM1; k=rsa; p=PROVIDER-PUBLIC-KEY |
| DMARC, phase 1 | TXT | _dmarc | v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com |
| DMARC, phase 2 | TXT | _dmarc | v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com |
| DMARC, phase 3 | TXT | _dmarc | v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com |
The rua address should be a dedicated mailbox or group, because report volume can be high. If it sits on another domain, Google explains that the other domain also needs an authorization record.
Step by Step in Any DNS Dashboard
The menus vary from one dashboard to another, but the sequence is the same at the registrar or host where the domain’s DNS points:
- Log in to the dashboard where the domain’s DNS is managed, which is not always where the domain was bought.
- Open the DNS records area and look for a TXT record that already starts with v=spf1, so you edit it instead of creating another.
- Add DKIM and DMARC as TXT records, with the short name and the value without extra quotes.
- Save, wait for propagation, and check that the dashboard did not duplicate the domain in the name, as in _dmarc.yourdomain.com.yourdomain.com.
How to Check SPF, DKIM, and DMARC
Checking takes two steps. The first shows whether the records are published correctly. The second shows whether a real message, sent through the provider, passed the checks.
Looking Up the Records in DNS
The Google Admin Toolbox Dig tool looks up TXT records right in the browser. Search the root domain to see SPF, _dmarc.yourdomain.com for DMARC, and SELECTOR._domainkey.yourdomain.com for DKIM.
In a terminal, the command dig TXT _dmarc.yourdomain.com runs the same lookup. Two v=spf1 records or no DMARC record point to a DNS problem, not to the provider or the campaign tool.
Reading the Header of a Test Message
The definitive test is to send a message to a personal Gmail account and open the Show original option, which displays the full header. There you will find DKIM-Signature, with the selector in the s= tag and the signing domain in the d= tag.
In the Gmail app, the message’s security details show the mailed-by and signed-by fields. If signed-by shows the provider’s domain instead of yours, DKIM is not aligned yet.
One-Click Unsubscribe and Spam Rate
Authenticating the domain is half the work. The other half comes after delivery: how often people mark the message as spam and how easy it is to leave the list, two factors that weigh on reputation.
RFC 8058 List-Unsubscribe Headers
One-click unsubscribe under RFC 8058 uses two headers: List-Unsubscribe, with an HTTPS URL, and List-Unsubscribe-Post, with the value List-Unsubscribe=One-Click. Gmail shows this format in its guidelines:
- First header:
List-Unsubscribe: <https://yourdomain.com/unsubscribe/CONTACT-ID> - Second header:
List-Unsubscribe-Post: List-Unsubscribe=One-Click
The RFC requires both headers to be covered by a valid DKIM signature. According to Google’s FAQ, the requirement applies to marketing and promotional messages. Password resets, reservations, and form confirmations are excluded.
Spam Rate and Postmaster Tools
Postmaster Tools shows the spam rate, reputation, and authentication of messages sent to personal Gmail accounts. To see the data, the domain must be verified with a TXT or CNAME record in DNS.
The rate is calculated daily. Google asks that it stay below 0.10% and never reach 0.30%. Above 0.30%, the sender loses access to mitigation support, which only returns after 7 consecutive days below the limit.
Marketing Emails Going to Spam: Diagnosis and Fixes
When marketing email lands in spam or bounces with an error, Gmail’s response code usually says which requirement failed. The table gathers the codes Google publishes and the fix for each one.
Table of Problems, Causes, and Fixes
Codes that start with 4 are temporary failures with rate limiting, and codes that start with 5 are blocks, according to Google’s FAQ:
| Symptom or code | Likely cause | How to fix |
|---|---|---|
| 4.7.27 or 5.7.27 | SPF did not pass: the sending server is not in the record | Add the provider to SPF, keeping a single v=spf1 record |
| 4.7.30 or 5.7.30 | DKIM did not pass | Publish the key under the right selector and turn on signing at the provider |
| 4.7.31 | Domain with no DMARC or no policy | Publish _dmarc with at least p=none |
| 4.7.32 | From not aligned with SPF or DKIM | Sign DKIM with your domain or use your domain in the Return-Path |
| 4.7.23 or 5.7.25 | Sending IP without a valid PTR | Ask the SMTP provider for correct reverse DNS |
| 4.7.29 or 5.7.29 | Sending without TLS | Turn on TLS for the SMTP connection |
| 4.7.28 | Volume above the domain or IP quota | Pause for 10 minutes and resume with a single connection |
| SPF with permerror | Two v=spf1 records or more than 10 lookups | Merge into one record and reduce the includes |
List Quality, Volume, and Privacy Law
When authentication passes and the message still goes to spam, the problem is usually the list. Google asks senders to email only people who subscribed and advises against buying addresses and pre-checking the subscription box.
Volume matters too: Google advises starting with engaged contacts, sending at a steady pace, and reconfirming the list’s interest from time to time, as in customer reactivation. The logic resembles the WhatsApp quality rating and the risk of a banned WhatsApp number.
Brazil’s data protection law (LGPD) (in Portuguese) requires a legal basis to process a contact’s email address, and consent can be withdrawn at any time through a free, easy procedure. Similar rules apply under GDPR in the EU. This applies to email just as it does to WhatsApp opt-in.
SPF, DKIM, and DMARC in ConverZAP Email Marketing
At ConverZAP, a Tech Provider verified by Meta, the email marketing module has no sending server of its own for campaigns. Email goes out through the customer’s SMTP account, with the server, username, password, and sender set up once in Integrations.
Sending Through Your SMTP: Who Handles What
Because sending uses the customer’s provider, SPF, DKIM, and DMARC are configured in the domain’s DNS and in that provider’s dashboard. In this model, DKIM signing, PTR, and TLS depend on the provider’s server.
The platform handles the campaign side:
- Unsubscribe: every email goes out with the one-click unsubscribe header and a footer link.
- Clean list: unsubscribed contacts are left out, and duplicate addresses get one email only.
- Pacing: from 1 to 1,000 sends per minute, with scheduling, pausing, and a test send first.
The solution page lists the limits: ConverZAP does not promise inbox placement and does not record bounces that arrive after sending; those stay in the provider’s dashboard. It is worth confirming that the provider’s DKIM covers the unsubscribe headers, as RFC 8058 requires.
From Email to WhatsApp in the Same Funnel
Email is also a step in automations, alongside tags, a stage in the WhatsApp CRM, and, for contacts who opted in, a WhatsApp message template. The sequence stops when the person replies, as in automated follow-up.
The button leads to a landing page connected to WhatsApp or to a WhatsApp link with a message, and the AI agent handles lead qualification on the official WhatsApp Business API. The lead moves through the funnel, as in an AI agent integrated with a CRM.
Businesses that already have a domain and provider configured can test sending and one-click unsubscribe with a 7-day free trial, no credit card required. The module is part of the platform’s AI marketing solutions.
SPF, DKIM, and DMARC: Frequently Asked Questions
Anyone sending to personal Gmail accounts needs SPF or DKIM at any volume. All three together are mandatory at around 5,000 messages a day, but Google recommends setting up SPF, DKIM, and DMARC on every domain, even at low volume.
Yes. The Gmail sender guidelines accept DMARC with a none policy for bulk senders. Google recommends starting at none, reading the aggregate reports, and moving to quarantine or reject once all legitimate mail is authenticated and aligned.
It depends on DNS propagation at the domain provider. Google asks for SPF and DKIM to be authenticating for at least 48 hours before turning on DMARC and suggests a week at p=none before tightening the policy.
A single TXT record at _dmarc covers both providers. Yahoo requires a valid DMARC record that passes, with at least p=none and the rua tag recommended. Gmail accepts the same setup, as long as the From domain is aligned with SPF or DKIM.
Authentication proves the origin, not the quality of the list. A spam rate above 0.10%, volume spikes, and contacts without permission still hurt delivery. That is why B2B outbound prospecting and lead generation lists need a legal basis and permission before sending.
It is not recommended. Google advises against buying addresses and emailing people who did not subscribe, and Yahoo gives the same warning. People who never subscribed may mark the message as spam, and future messages then tend to land there.
