Since February 2024, Gmail and Yahoo require senders to authenticate their emails with SPF, DKIM, and DMARC. Without proper configuration, your emails — including transactional ones like password resets and invoices — will land in spam or be rejected entirely. Here's how to fix it in 10 minutes.
What Are SPF, DKIM, and DMARC?
| Record | What It Does | Analogy |
|---|---|---|
| SPF | Lists which servers are allowed to send email for your domain | A guest list for your mailbox |
| DKIM | Adds a digital signature to verify the email wasn't tampered with | A wax seal on a letter |
| DMARC | Tells receivers what to do if SPF or DKIM fails, and where to send reports | Instructions for the bouncer |
Step 1: Configure SPF
SPF is a DNS TXT record that lists authorized sending servers. Add this to your domain's DNS:
example.com TXT "v=spf1 ip4:YOUR_SERVER_IP include:_spf.google.com ~all"Key rules:
- Only one SPF record per domain (multiple records = failure)
- Use
include:for third-party senders (Google Workspace, Mailchimp, SendGrid) - Use
~all(softfail) during testing, switch to-all(hardfail) in production - Maximum 10 DNS lookups — too many
include:statements will break SPF
Common SPF for Popular Services
| Service | SPF Include |
|---|---|
| Google Workspace | include:_spf.google.com |
| Microsoft 365 | include:spf.protection.outlook.com |
| Mailchimp | include:servers.mcsv.net |
| SendGrid | include:sendgrid.net |
| Amazon SES | include:amazonses.com |
Step 2: Set Up DKIM
DKIM adds a cryptographic signature to your outgoing emails. The receiving server verifies this signature using a public key published in your DNS.
DKIM requires two things:
- A private key on your mail server that signs outgoing emails
- A DNS TXT record with the public key that receivers use to verify
The DNS record looks like:
mail._domainkey.example.com TXT "v=DKIM1; k=rsa; p=MIIBIjANBg...your_public_key..."If you use a hosted email service (Google Workspace, Microsoft 365), they provide the DKIM keys — you just need to add the DNS records.
Step 3: Enable DMARC
DMARC tells receiving servers what to do when SPF or DKIM checks fail:
_dmarc.example.com TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; pct=100"DMARC policies:
| Policy | Action | When to Use |
|---|---|---|
p=none | Monitor only, no action | Start here — collect reports first |
p=quarantine | Send to spam | After verifying SPF/DKIM work |
p=reject | Block the email entirely | Full protection once confident |
Recommended approach: Start with p=none for 2 weeks to monitor reports, then move to p=quarantine, and finally p=reject.
Step 4: Verify Your Configuration
After setting up all three records, verify them:
- Run a PrivacyChecker scan — our Email Deliverability module grades your SPF, DKIM, and DMARC (A-F)
- Send a test email to a Gmail account and check the headers for "PASS" status
- Use
dig TXT example.comto verify DNS records are published
Gmail and Yahoo Requirements (2024+)
Since February 2024, bulk senders (5,000+ emails/day) must:
- Authenticate with SPF and DKIM
- Have a DMARC policy published (even
p=none) - Include one-click unsubscribe (List-Unsubscribe header)
- Keep spam complaint rates below 0.3%
- Use TLS encryption for email transmission
Even small senders benefit from proper authentication — it improves deliverability for everyone.
Troubleshooting
| Problem | Likely Cause | Fix |
|---|---|---|
| SPF fails | Missing include: for a sending service | Add the service's SPF include |
| DKIM fails | DNS record not propagated or key mismatch | Wait 24-48h for propagation, verify key |
| DMARC fails | SPF and DKIM both failing, or domain alignment issue | Fix SPF/DKIM first, check alignment |
| Emails still in spam | IP reputation, content issues, or missing PTR record | Check IP blacklists, improve content |
Your Email Grade
PrivacyChecker grades your email authentication setup from A to F and provides specific fix recommendations. A properly configured domain should achieve at least a B grade. Most websites we scan start at D or F — fixing SPF, DKIM, and DMARC typically takes under 10 minutes and has an immediate impact.