Email deliverability for small teams: SPF, DKIM, DMARC and the Gmail and Yahoo sender rules

Email deliverability is the share of your messages that reach the recipient's inbox rather than the spam folder or nowhere at all. Mailbox providers such as Gmail, Outlook and Yahoo decide where each message goes, and they base that decision mostly on two things: whether the message can be proven to come from your domain, and how recipients have reacted to your mail before.

For a small team this comes down to a short list: publish three DNS records (SPF, DKIM and DMARC), send campaigns through a service aligned with your domain, give every marketing email a one-click unsubscribe, and keep complaints low. Since February 2024 these are no longer recommendations for anyone sending in volume to Gmail or Yahoo users; they are requirements.

The three records, in plain words

SPF (RFC 7208) is a list of servers. Every service that sends as your domain, such as your office mail provider, your campaign tool or your invoicing system, must appear in it. A common failure is two SPF records on one domain; receivers treat that as an error, so merge them into one.

DKIM (RFC 6376) is a signature. Your sending service gives you a key to publish; it then signs every message, and receivers verify the signature against your DNS. Each sending service needs its own DKIM key. Use keys of at least 1024 bits; most services now issue 2048-bit keys by default, which is what Google recommends.

DMARC (RFC 7489) ties the two to the address people actually see. A message passes DMARC when SPF or DKIM passes and the domain that passed matches the domain in the From line. That matching is called alignment, and it is the part most often missing when a campaign tool sends "on behalf of" you from its own domain.

Rolling out DMARC without breaking mail

1. Publish p=none with a reporting address. Nothing changes for delivery; you start receiving reports.
2. Read the reports for a few weeks. They list every source sending as your domain. Authenticate the legitimate ones and note the rest.
3. Move to p=quarantine, then p=reject, once all legitimate mail passes. At that point spoofed mail using your domain stops reaching inboxes.

What Gmail and Yahoo require since 2024

In February 2024 Google and Yahoo started enforcing new rules for bulk senders. Google defines a bulk sender as one that sends close to 5,000 or more messages a day to personal Gmail accounts, and once a domain qualifies it is treated as one from then on. The requirements are, in short:

• Authenticate with both SPF and DKIM.
• Publish a DMARC record (a policy of p=none is enough to comply), with the From domain aligned to SPF or DKIM.
• Offer one-click unsubscribe on marketing and subscribed messages, and process unsubscribes within two days.
• Keep the spam rate reported in Google Postmaster Tools below 0.3%. Google recommends staying under 0.1%.

Even senders below the bulk threshold must authenticate with SPF or DKIM, send over TLS and have valid reverse DNS for their sending IPs, according to Google's guidelines. Yahoo published closely matching requirements at the same time. Because most sending services already handle TLS and reverse DNS, the work for a small company is usually the DNS records and the unsubscribe.

Unsubscribe: required, and in your interest

One-click unsubscribe, defined in RFC 8058, is a pair of headers (List-Unsubscribe and List-Unsubscribe-Post) that let the mail app show its own Unsubscribe button. When a recipient presses it, the app sends a request to your server and the address is removed, with no page to visit. A visible link in the footer is still expected as well.

The unsubscribe also has to stick. If a person leaves your newsletter and then receives a promotional sequence from a different tool a week later, from their point of view you ignored them.

A quick unsubscribe is also self-defence. A recipient who cannot leave easily presses "Report spam" instead, and every such report raises the complaint rate that decides where your next message lands. Make leaving one click, and honour it everywhere campaign mail is sent from.

List hygiene: who you send to matters most

• Send to people who asked. Contacts collected through a form with clear consent complain far less than a purchased list, and a purchased list may break data protection law as well.
• Remove hard bounces at once. Repeated sends to addresses that do not exist are a classic signal of a poor sender.
• Retire the silent. People who have not engaged in many months are the likeliest to mark mail as spam. Send them one re-permission email, then stop.
• Warm up a new domain. Start with your most engaged recipients and increase volume over a few weeks rather than sending to everyone on day one.

Sales mail and campaign mail are different streams

A salesperson replying to a customer from their own mailbox and a newsletter sent to two thousand subscribers are different kinds of mail with different risks. Keep them apart. One-to-one mail goes from the person's work mailbox. Campaigns go through a sending service with its own DKIM key, ideally from a subdomain such as news.example.com, so a newsletter that draws complaints does not damage the address your team uses to close deals.

The same thinking applies to automated sequences for new leads. A short sequence to someone who just filled in a form is wanted mail; the same sequence to scraped addresses is not, and the providers will notice the difference through complaints. If you score leads, a simple lead scoring model is a good way to decide who gets a person and who gets a sequence.

A ten-minute check before every campaign

1. Send a test to a Gmail and an Outlook address you control. In Gmail, open the message, choose "Show original" and confirm that SPF, DKIM and DMARC all read PASS.
2. Check the From address. Its domain must be the one you authenticated, not the sending service's domain and not a free mailbox.
3. Look for the unsubscribe button next to the sender name in Gmail. If the mail app does not show one, the headers are missing.
4. Read the audience filter once more. The fastest way to a spam complaint is a campaign that went to customers who were never meant to receive it, such as people who unsubscribed from a different list.
5. Glance at Postmaster Tools for the domain's spam rate over the last week. If it is rising, send to your most engaged segment only and find the cause before the full send.

None of these steps needs a specialist. They need a habit, and the habit matters most in the weeks after something changed: a new sending service, a new domain, a newly imported list.

How Nextora handles campaign mail

Nextora keeps two email systems on purpose. A person's work mailbox (Gmail, Outlook or any IMAP account) is connected so that customer correspondence is read and written next to the customer's record. Campaign mail goes out through the Outbound email sending channel the workspace configures, which is a different thing from a personal mailbox.

Every campaign email carries its own unsubscribe link, both in the message and in the mail header that Gmail, Outlook and other apps use to show their own unsubscribe button. If the template has an Unsubscribe block or a footer link, the link goes there; if it has neither, Nextora adds a short line with the link. Someone who unsubscribes lands on the unsubscribed list and campaigns never write to them again: the email step is skipped and the run log records unsubscribed. Automation and service mail, such as invitations and signing requests, are not affected. The campaign report shows people entered, emails sent, opens and clicks. See the Marketing page.

For collecting addresses with consent in the first place, see forms that reach the CRM. For replies that come back, one queue for every channel explains how they reach the right person.