SPF, DKIM, DMARC: Gmail and Yahoo require them from 2024

On October 3, Google and Yahoo announced that starting in February 2024 they'll be much stricter with email that isn't authenticated. For a small business, that comes down to three DNS records: SPF, DKIM and DMARC. Set them up now, while things are quiet, and you won't find out in February that your quotes are sitting in spam.

What was announced

Google wrote on the Gmail blog that from February 2024, anyone sending a lot of mail to Gmail accounts has to authenticate it, offer one-click unsubscribe and stay under a threshold for messages reported as spam. Yahoo announced nearly identical rules for the same period.

Google's sender guidelines page splits the requirements in two: what everyone has to do, and what's required on top of that from anyone sending more than 5,000 messages a day to Gmail addresses.

What everyone has to do

Even if you send ten emails a day, from February 1, 2024 Google requires:

• SPF or DKIM on the domain you send from;
• valid DNS records for the sending server (the IP address has to resolve to a hostname, and back);
• an encrypted (TLS) connection when sending;
• a reported spam rate below 0.3%, as measured in Postmaster Tools;
• messages formatted to the standard (RFC 5322), and no pretending to be a Gmail address.

If you use Google Workspace or Microsoft 365, part of this comes from the provider. SPF and DKIM on your own domain, though, are yours to turn on.

What's required above 5,000 messages a day

This covers bigger newsletters and online stores that send order confirmations:

• both SPF and DKIM;
• a published DMARC record; the policy can be p=none, which means you watch without blocking anything;
• the domain in the From field has to match the SPF or DKIM domain;
• for marketing mail, one-click unsubscribe plus a visible unsubscribe link in the body. Google says requests have to be processed within two days.

Even if you send less today, set all three up. Lists grow, and DMARC shows you whether someone is sending fake mail in your name.

SPF, DKIM and DMARC in plain words

SPF

A TXT record in DNS that says "mail for my domain only leaves from these servers." If you send from Workspace and from a newsletter platform, both have to be in the same record. A domain can have only one SPF record; two of them cause a permanent error.

DKIM

A digital signature on every message. Your provider gives you a public key to add to DNS, and the receiving server checks that the message arrived unchanged. You turn it on separately in every service that sends on your behalf.

DMARC

Another TXT record, at _dmarc.yourdomain.com. It tells receivers what to do with messages that fail the checks: none (nothing, just report), quarantine (set them aside) or reject (refuse them). With the rua tag you get daily reports on who is sending mail in your name.

The order to set them up in

1. List everything that sends mail from your domain: company mailboxes, newsletter platform, online store, invoicing software.
2. Add or fix SPF, with every service from the list in a single record.
3. Turn on DKIM in each service and add the keys to DNS.
4. Publish DMARC with p=none and an rua address so you can read the reports.
5. After a few weeks, once the reports show your mail passing, you can move to quarantine.
6. Send a test email to a Gmail account and open "Show original": SPF, DKIM and DMARC should all say "PASS".

One-click unsubscribe

One-click unsubscribe lives in the message header, separate from the link at the bottom of the email, and the mail app can act on it directly. For marketing mail, Google wants both: the one-click option and a visible link in the body, with the request processed within two days. The better newsletter platforms add the header for you; check the settings or ask them.

For a small list, this is good news. People who don't want your emails click unsubscribe instead of "Report spam," and your spam rate stays low. We wrote about building the list properly from the start in our article on newsletter subscribers.

If you'd like us to check your domain and newsletter setup, see our marketing services.