You wrote a great email, hit send to your customer list and heard nothing back. Often the problem is not the message. It is that the message never reached the inbox. Since 2024 the largest mailbox providers have required senders to prove who they are and make unsubscribing easy, and they now enforce those rules with rejections, not just spam folders.
The short version
If you send marketing or bulk email, you need:
- SPF, DKIM and DMARC set up correctly on your domain
- One-click unsubscribe in marketing messages, honored quickly
- Low spam complaint rates
- A sending address on your own domain, not a free Gmail or Yahoo address
The three authentication records, explained
Think of email authentication as an ID check for your messages.
| Record | What it does | Plain-English analogy |
|---|---|---|
| SPF (Sender Policy Framework) | Lists the servers allowed to send email for your domain | A guest list at the door |
| DKIM (DomainKeys Identified Mail) | Adds a digital signature proving the message was not altered and came from your domain | A tamper-evident seal |
| DMARC (Domain-based Message Authentication, Reporting and Conformance) | Tells receivers what to do if SPF or DKIM fail and sends you reports | The policy that says what happens to anyone not on the list |
All three are DNS records on your domain. Every service that sends email for you, such as your CRM, newsletter platform, website forms and invoicing software, must be included in SPF and should sign with DKIM for your domain.
What Gmail, Yahoo and Microsoft require
Gmail
Google's rules, announced in October 2023 and phased in from February 2024, apply most strictly to bulk senders, defined as sending roughly 5,000 or more messages to personal Gmail accounts in a day. Bulk senders must:
- Authenticate with SPF and DKIM, and publish a DMARC policy (at least p=none) with alignment
- Include one-click unsubscribe in marketing messages and process unsubscribes within two days
- Keep spam rates below 0.1% and never reach 0.3% or higher
Google says it began ramping up enforcement in November 2025, including temporary and permanent rejections of non-compliant mail.
Yahoo
Yahoo's requirements, also effective from February 2024, are similar: SPF and DKIM, a passing DMARC policy of at least p=none, one-click unsubscribe honored within two days, and a spam rate below 0.3%.
Microsoft Outlook.com and Hotmail
Microsoft began enforcing requirements for domains sending more than 5,000 messages per day to its consumer mailboxes on May 5, 2025. Those senders need SPF, DKIM and DMARC (at least p=none, aligned with SPF or DKIM). Non-compliant messages can be rejected with the error "550 5.7.515 Access denied." Microsoft also recommends one-click unsubscribe and low complaint rates.
Even if you send fewer than 5,000 emails a day, follow these rules anyway. They are the baseline that mailbox providers use to decide who is trustworthy.
Common reasons small businesses land in spam
- Sending from a free email address such as a Gmail account through a marketing platform
- Missing DKIM for a third-party tool, so messages fail alignment
- Multiple SPF records on one domain, which breaks SPF entirely
- Old or purchased lists with invalid addresses and spam traps
- No easy unsubscribe, so people hit "report spam" instead
- Sudden volume spikes from a new domain without warming up
A deliverability checklist
- Send marketing email from your own domain, ideally a subdomain such as news.yourdomain.com.
- Publish one SPF record that includes every legitimate sending service.
- Enable DKIM signing in each sending platform.
- Publish a DMARC record starting at p=none, review reports, then move toward quarantine or reject.
- Add one-click unsubscribe headers and a visible unsubscribe link to marketing email.
- Only email people who opted in, and remove bounces and long-inactive contacts.
- Monitor complaint rates with tools like Google Postmaster Tools.
- Increase volume gradually on new domains or IP addresses.
What about texting?
Text messaging has its own, even stricter rules on consent and registration. Read our SMS marketing compliance guide before adding texts to your campaigns.
Digital Warehouses runs email marketing campaigns with authentication, list segmentation and sending handled for you, and designs reusable email templates for your brand.
Frequently Asked Questions
What are SPF, DKIM and DMARC?
They are DNS records that authenticate your email. SPF lists the servers allowed to send for your domain, DKIM adds a signature proving the message is genuine and unaltered, and DMARC tells receiving servers what to do when checks fail and sends reports to the domain owner.
Do I need DMARC if I send only a few emails?
Gmail and Yahoo require DMARC for bulk senders, and Microsoft requires it for high-volume senders, but every business benefits from it. DMARC also helps protect your domain from being spoofed in phishing emails.
What spam rate does Gmail allow?
Google asks senders to keep spam rates below 0.1% and to prevent them from ever reaching 0.3% or higher.
What is one-click unsubscribe?
It is a standard (RFC 8058) that lets recipients unsubscribe directly from the email client's unsubscribe button without visiting a website or logging in. Gmail and Yahoo require it for bulk marketing email and expect requests to be honored within two days.
Why are my emails going to spam?
Common causes include missing or misaligned SPF, DKIM or DMARC, sending from a free email address, old or purchased lists, high complaint rates and sudden spikes in volume.
