SPF, DKIM, DMARC: A Guide to Business Email Delivery
Business emails landing in spam? Here is how to set up SPF, DKIM and DMARC, and what Gmail and Yahoo's bulk sender rules actually require.
rabbitclip teamPublished: 6 min read
Short answer
For business email to reach the inbox, three DNS records need to be set up correctly on your domain. SPF states which servers are allowed to send email on your behalf; DKIM signs outgoing mail with a digital signature; DMARC decides what a receiving server should do if either check fails, and sends you a report. Gmail and Yahoo now require all three from any address sending more than 5,000 messages a day.
These three records sound technical, but their effect is commercial. An invoice reminder or a campaign email sent from a misconfigured domain never reaches the recipient; it disappears into the spam folder. If a flooring manufacturer's quotes stop arriving with clients, the fault is rarely the wording, it is usually these three records.
What does SPF do, and what does it not do?
SPF, Sender Policy Framework, adds a DNS record listing which servers may send email on behalf of your domain. The receiving server checks whether the incoming message actually came from one of those servers; if not, it treats it as suspicious.
SPF alone is not enough. It only verifies the sending server, it does not guarantee the message content stayed unchanged, and it usually breaks when a message is forwarded. Google Workspace recommends setting the SPF record with the correct syntax and never publishing more than one SPF record per domain.
What does DKIM do?
DKIM, DomainKeys Identified Mail, signs every outgoing message with a private key; the receiving server checks that signature against a public key published in your domain's DNS. If the signature matches, the message was not altered in transit.
DKIM usually survives the forwarding cases that break SPF, which is why the two are set up together. Google Workspace recommends a 2048-bit DKIM key, rotated on a regular schedule.
Why is DMARC necessary?
DMARC, Domain-based Message Authentication, Reporting and Conformance, looks at the outcome of both SPF and DKIM checks; if both fail, it tells the receiving server what to do, reject, quarantine or deliver anyway, and sends you a report. According to dmarc.org, DMARC's purpose is to minimise false positives, reduce successful phishing, and give organisations visibility into how their domain is being used.
Without DMARC, even with SPF and DKIM in place, someone spoofing your domain to send email can go entirely unnoticed. A DMARC record both blocks that and reports it back to you.
What do Gmail and Yahoo's bulk sender rules actually require?
Since February 2024, Gmail has required DMARC alongside SPF or DKIM for any address sending more than 5,000 messages a day to personal Gmail accounts; it also requires valid forward and reverse DNS records for the sending domain, and a spam rate reported in Postmaster Tools that stays below 0.3%. Senders below that volume still need at least one of SPF or DKIM.
Yahoo sits on similar ground: bulk senders are expected to authenticate with SPF, DKIM and DMARC in alignment, offer a one-click unsubscribe link, and keep complaint rates low. Because the two providers' rules overlap so closely, infrastructure set up correctly once tends to work for both.
How do you test email deliverability?
Verification matters once the records are live. Google Postmaster Tools and Yahoo's Sender Hub show your domain's spam rate, authentication pass rate and delivery status; sending a test message and checking the SPF/DKIM/DMARC result in its headers is a quick manual check too.
If DMARC is new to you, the policy should move in stages: start in monitoring mode to collect reports and fix problem sources, then move to quarantine, and only then to reject. Starting straight at reject risks blocking legitimate mail along with the bad.
Common mistakes when setting up SPF, DKIM and DMARC
The most common mistake is publishing more than one SPF record on the same domain. If a manufacturing business adds a separate SPF record for its email provider and another for its marketing tool, the two conflict and both get treated as invalid; the fix is listing every sending server together in a single SPF record.
The second mistake is starting DMARC straight at a reject policy. If a workwear manufacturer's accounts team sends invoice reminders through a third-party tool without realising it, a reject policy blocks that legitimate mail too; starting in monitoring mode surfaces sources like that before anything actually gets blocked.
The third mistake is setting the records up once and never checking them again. If a business switches email providers and the old SPF entry never gets removed, both the old and new provider stay listed; over time that makes the record too long, and some receiving servers reject an SPF record that goes past its lookup limit.
How does the setup actually run, step by step?
The order matters: SPF first, then DKIM, DMARC last. Sending a test email after each step and checking the authentication result in its headers shows exactly where a problem sits before moving on to the next one.
- List every sending server: the email provider, the marketing tool, the invoicing system
- Combine that list into a single SPF TXT record and add it to the DNS
- Generate the DKIM key from the email provider's panel and add it to the DNS
- Add the DMARC record in monitoring mode, with reports routed to an address you actually read
- After a few weeks, read the reports, fix any problem sources, then move to quarantine and finally reject
SPF, DKIM and DMARC only work as a set; weaken one and the other two lose most of their value. In a technical review with rabbitclip, we can check all three records on your domain together and bring them in line with Gmail and Yahoo's current rules.
FAQ
In what order should SPF, DKIM and DMARC be set up?
SPF and DKIM first; once both are working, DMARC is added, starting in monitoring mode.
How many emails a day counts as a bulk sender?
Under Gmail's guidelines, an address sending close to 5,000 or more emails to personal Gmail accounts within 24 hours counts as a bulk sender, and DMARC becomes mandatory.
Does a DMARC record slow down email delivery?
No. DMARC is a DNS record; it does not affect sending speed, it only tells the receiving server what to do once authentication has been checked.
Why do emails still land in spam with SPF and DKIM already set up?
SPF and DKIM authenticate at domain level, but sender reputation, content and recipient behaviour also affect delivery; once the records are correct, the next step is watching sending volume and complaint rates.
Can a domain have more than one SPF record?
No, only one SPF record is valid per domain; if there is more than one sending system, all of them need listing together in that same record.
