Email Deliverability in 2025: SPF, DKIM, DMARC and the New Sender Rules

If your marketing emails, invoices or CRM notifications land in spam, the cause is often technical rather than the content. In February 2024 Gmail and Yahoo began enforcing stricter requirements for bulk senders, and many businesses discovered that their domain setup was incomplete.

The three records

What Gmail and Yahoo require

For all senders, both providers expect basic authentication and valid DNS. For bulk senders, Google defines bulk as sending 5,000 or more messages a day to Gmail accounts, the requirements include:

• Authenticate email with both SPF and DKIM.
• Publish a DMARC record, with a policy of at least p=none.
• Make sure the domain in the From address aligns with the SPF or DKIM domain.
• Offer one-click unsubscribe for marketing and subscribed messages, and honor unsubscribes within two days.
• Keep spam complaint rates below 0.3%, and ideally well below 0.1%.

Common mistakes

• More than one SPF record. A domain must have a single SPF record; combine all senders into one.
• Forgotten senders. CRM, marketing platform, helpdesk and invoicing tools all need to be authorized and DKIM-signed.
• Too many DNS lookups. SPF allows a maximum of ten DNS lookups; exceeding it makes SPF fail.
• No DMARC reports. Without a reporting address you cannot see who is sending as your domain.

A safe rollout

1. List every service that sends email as your domain, including CRM and marketing tools.
2. Set up SPF and DKIM for each one, following the provider’s instructions.
3. Publish DMARC with p=none and a reporting address, and review reports for a few weeks.
4. When legitimate mail passes consistently, move to p=quarantine, then p=reject if appropriate.

Beyond DNS

Authentication gets you through the door; reputation keeps you there. Send only to people who opted in, clean bounced and inactive addresses, make unsubscribing easy and send content people expect. Platforms such as Salesforce Marketing Cloud, Account Engagement and HubSpot each provide domain authentication settings that should be completed before large campaigns.

What the records look like

An SPF record is a TXT record on your domain, for example v=spf1 include:_spf.google.com include:spf.protection.outlook.com -all, listing each authorized sending service. DKIM records are published under a selector, such as selector1._domainkey.yourdomain.com, and are supplied by each sending platform. A starting DMARC record lives at _dmarc.yourdomain.com, for example v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com.

These are examples only. Use the exact values your providers give you, and combine SPF entries into a single record.

Reading DMARC reports

Aggregate DMARC reports arrive as XML files listing which servers sent mail as your domain and whether they passed SPF, DKIM and alignment. They are hard to read raw, so most teams use a DMARC reporting tool. Look for legitimate services that fail, which you need to fix, and unknown sources, which may be spoofing.

Marketing platform checklist

1. Authenticate your sending domain in the platform, which usually means adding DKIM and sometimes SPF or return-path records.
2. Send from your own domain, not a generic platform address.
3. Enable one-click unsubscribe headers for marketing email.
4. Warm up new sending domains or IP addresses gradually.
5. Remove hard bounces immediately and suppress long-inactive contacts.
6. Monitor spam complaint rates, for example in Google Postmaster Tools.

Transactional email matters too

Invoices, password resets and CRM notifications are often sent by different systems than marketing email. They must also be authenticated, and it is good practice to send them from a separate subdomain so a marketing complaint spike does not hurt delivery of critical messages.

Frequently asked questions