---
title: "Email deliverability: SPF, DKIM, DMARC explained"
author: "Performetic Ekibi"
url: "https://www.performetic.com/en/blog/email-deliverability-spf-dkim-dmarc"
published: "2026-02-01T08:00:00.000Z"
updated: "2026-10-05T02:41:58.768Z"
---

# Email deliverability: SPF, DKIM, DMARC explained

> To reach the inbox, your domain needs SPF, DKIM and DMARC, marketing emails must support one-click unsubscribe, and spam complaints must stay low. Gmail requires all three records from senders of more than 5,000 messages a day and recommends keeping the spam rate in Postmaster Tools below 0.1%, never reaching 0.3%.

## Why do emails land in spam and how do you prevent it?

Emails usually land in spam for three reasons: your domain is not properly authenticated (SPF, DKIM, DMARC), recipients are marking your emails as spam, or your list is full of unconsented and stale addresses. The fix is to set up all three authentication records, support one-click unsubscribe, monitor your spam complaint rate and send only to consented, engaged recipients.

Email marketing returns depend on reaching the inbox. Even the best campaign is invisible in a spam folder. Major mailbox providers have tightened rules for bulk senders in recent years. This guide covers the technical setup and the habits that protect your sender reputation.

## What are SPF, DKIM and DMARC?

These three records live in your domain's DNS and prove to the receiving server that an email really came from you.

| Record | What it does | Where it goes |
|---|---|---|
| SPF | Lists the servers authorized to send email for your domain | TXT record in DNS |
| DKIM | Adds a digital signature that verifies the content was not altered in transit | DNS record provided by your sending platform |
| DMARC | Tells receiving servers what to do if SPF or DKIM fails and provides reporting | TXT record on the _dmarc subdomain |

According to Gmail, to pass DMARC a message must be authenticated by SPF, DKIM or both, and the authenticating domain must match the domain in the message's From header. This is called alignment. Emails signed only with your email service provider's domain, not aligned with yours, cannot pass DMARC.

## What do Gmail, Yahoo and Outlook require from senders?

Under Gmail's sender guidelines, since February 1, 2024 everyone sending to Gmail accounts must set up SPF or DKIM, have valid forward and reverse DNS (PTR) records, use TLS and keep the spam rate reported in Postmaster Tools below 0.3%. Senders of more than 5,000 messages a day must also:

- Set up both SPF and DKIM.
- Publish a DMARC record; the policy can be p=none.
- Align the From domain with either the SPF or DKIM domain.
- Support one-click unsubscribe in marketing messages and include a clearly visible unsubscribe link in the body.

Gmail also recommends keeping the spam rate below 0.10% and never reaching 0.30% or higher. Its FAQ lists failing to honor unsubscribe requests within 48 hours as a problem as well.

Yahoo's sender guidance for bulk senders likewise asks for a passing DMARC record with at least p=none, SPF or DKIM alignment, one-click unsubscribe, unsubscribes honored within two days and a spam rate below 0.3%. Microsoft announced in 2025 that domains sending more than 5,000 emails a day to Outlook.com consumer addresses (outlook.com, hotmail.com, live.com) must meet SPF, DKIM and DMARC requirements, and that non-compliant messages may be routed to Junk or rejected.

## How do you set up SPF, DKIM and DMARC step by step?

1. **List your sending sources.** Your store platform, email marketing tool, helpdesk and business email may all send on behalf of your domain.
2. **Merge SPF into a single record.** A domain should have only one SPF record. Microsoft notes that SPF records exceeding 10 DNS lookups may fail; remove unnecessary includes.
3. **Enable DKIM on every platform.** Add the DKIM records your email marketing tool provides and make sure signing uses your own domain.
4. **Start DMARC in monitoring mode.** Example record: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. Reports show who is sending email on behalf of your domain.
5. **Watch reports for a few weeks.** Once all legitimate sources pass, you can gradually move the policy to quarantine, then reject.
6. **Consider a subdomain for marketing.** Sending campaigns from a subdomain separates your corporate email reputation from campaign performance.

## How do you keep the spam complaint rate low?

Technical setup opens the door; recipient behavior keeps you inside. Gmail's guidelines recommend confirming each recipient's address before subscribing them, periodically asking recipients whether they want to stay subscribed and considering unsubscribing people who do not open your messages.

- **Send only to consented addresses.** Bought or scraped lists are the fastest route to complaints.
- **Segment by engagement.** Move subscribers who have not engaged in a long time out of main campaigns into a separate win-back flow.
- **Make unsubscribing easy.** A hidden unsubscribe link pushes people toward the spam button.
- **Set expectations.** Tell subscribers on the signup form how often and what kind of email you will send.
- **Ramp up volume gradually.** On a new domain or IP, increase volume in stages instead of jumping straight to large sends.

You can find the flow structure for what to send in our [email automation guide](/en/blog/ecommerce-email-automations); automations usually earn higher engagement than bulk campaigns and support your reputation.

## What should your sender name, subject line and content look like?

The message itself matters as much as authentication. Gmail's guidelines say subject lines, headers and display names should accurately represent the sender and content and should not be misleading; for example, do not start subject lines with "Re:" or "Fwd:" unless the message really is a reply or forward. The From header should contain only one email address, and HTML emails should follow HTML standards. In practice:

- Keep the sender name consistent with your brand and avoid changing it often.
- Avoid subject line promises the content does not deliver.
- Balance text and images instead of sending a single large image.
- Use a reply-capable address; customer replies are an engagement signal too.

## How do you monitor deliverability?

- **Google Postmaster Tools:** spam rate, domain reputation and authentication status for mail sent to Gmail.
- **DMARC reports:** the sources sending on behalf of your domain and their authentication results.
- **Sending platform metrics:** bounce rate, unsubscribe rate and complaints.
- **Inbox placement tests:** sending to seed accounts at different providers to see where your email lands.

Open rate alone is not reliable because of privacy features; read it together with clicks and orders.

If you want to review the technical health and revenue contribution of your email channel alongside your paid channels, you can request a free growth analysis through our [contact page](/en/contact).

## Key takeaways

- SPF, DKIM and DMARC are the three DNS records that authenticate your email, and they are now a baseline for bulk senders.
- To pass DMARC, the From domain must align with the SPF or DKIM domain.
- Gmail recommends keeping the spam rate below 0.10% and never reaching 0.30%.
- Marketing emails should support one-click unsubscribe, and requests should be honored quickly.
- Sending only to consented, engaged recipients and pruning inactive ones is the foundation of sender reputation.

## FAQ

### Do I need DMARC if I send fewer than 5,000 emails a day?

Gmail requires SPF or DKIM from all senders, while the DMARC requirement applies to those sending more than 5,000 messages a day. Gmail still recommends setting up all three for your domains. DMARC also shows you who is impersonating your domain, so it is worth having at smaller volumes too.

### Should my DMARC policy be p=none or reject?

Start with p=none in monitoring mode and use the reports to confirm that all legitimate sending sources pass. Then move gradually to quarantine and reject. Jumping straight to reject can block your own legitimate emails that are not yet authenticated.

### What is one-click unsubscribe?

It lets recipients leave your list with one click from their mail app, using the List-Unsubscribe and List-Unsubscribe-Post headers. Gmail requires it for marketing messages from senders of more than 5,000 emails a day, along with a visible unsubscribe link in the body. Most email marketing tools add these headers automatically.

### My emails suddenly started going to spam. What should I check first?

Check your spam rate and authentication status in Google Postmaster Tools first. Then look for authentication failures in DMARC reports, which segment your recent campaigns went to, and your bounce rate. If you mailed long-inactive recipients, send only to engaged segments for a while.

## Sources

- [Email sender guidelines (Gmail Help)](https://support.google.com/a/answer/81126)
- [Email sender guidelines FAQ (Gmail Help)](https://support.google.com/a/answer/14229414)
- [Sender Best Practices (Yahoo Sender Hub)](https://senders.yahooinc.com/best-practices/)
- [Outlook's New Requirements for High-Volume Senders (Microsoft Tech Community)](https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook%E2%80%99s-new-requirements-for-high%E2%80%90volume-senders/4399730)
- [RFC 7489: DMARC (RFC Editor)](https://www.rfc-editor.org/rfc/rfc7489)