Email Deliverability: SPF, DKIM and DMARC Explained

example.com.  IN TXT  "v=spf1 include:_spf.mailprovider.example ~all"

s1._domainkey.example.com.  IN TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkq...public-key-here..."

_dmarc.example.com.  IN TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

What do Gmail, Yahoo and Outlook.com require from bulk senders?

Gmail, Yahoo and Outlook.com all expect authentication from high-volume senders, and Gmail and Yahoo add one-click unsubscribe and spam-rate limits. Check each provider's page for the current text, because enforcement details change.

Further points from Google's guidelines: the sending IP needs matching forward and reverse DNS (a valid PTR record), mail must be sent over TLS, messages need a valid Message-ID and a clean RFC 5322 format, and HTML should not hide content. Senders who reach the bulk threshold once are permanently considered bulk senders; the status has no expiry. Google also says non-compliant mail may be rejected or delivered to spam.

On Outlook.com, Microsoft's post says that non-compliant mail from high-volume domains is routed to the Junk folder, with rejection (error 550; 5.7.515 Access denied) planned for a later date to be announced. Re-check Microsoft's page before you rely on this, as the enforcement stage may have moved.

How do you set up one-click unsubscribe?

Add two headers to every marketing message, and include a visible unsubscribe link in the body as well. The headers are defined in RFC 2369 and RFC 8058.

List-Unsubscribe: <https://example.com/unsubscribe?t=abc123>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

The URL must accept a POST request and unsubscribe the recipient without a login or further questions. Yahoo says the POST method is highly recommended and that a mailto method is acceptable. Yahoo also asks senders to honour unsubscribes within 2 days, so process them automatically and keep one suppression list shared across every campaign tool you use.

How do you warm up a new domain or IP?

Warm-up means increasing your sending volume in steps so that mailbox providers can learn your reputation from good engagement. Google's guidance is only to increase volume gradually and monitor recipients' spam reports, so use a schedule driven by data rather than a published table.

1. Authenticate first. Publish SPF, DKIM and DMARC and confirm they pass before the first send.
2. Start with the most engaged people: recent buyers, recent openers or people who just subscribed.
3. Raise volume in steps only while bounces and complaints stay low.
4. Keep a steady rhythm. Sudden spikes from a quiet domain look like abuse.
5. Pause the increase at the first sign of rising bounces, blocks or complaints, and fix the cause before continuing.
6. Add cooler segments last, and drop those that never engage.

Where you send from a shared platform sender address you are inheriting someone else's reputation; sending from your own authenticated domain makes your reputation yours, for better or worse.

How do you keep your list clean?

A clean list is the cheapest deliverability tool. Send only to people who agreed to receive your email, and remove addresses that cannot receive it.

• Collect consent properly and keep a record: see our guide to opt-in and consent across channels and the free opt-in consent generator.
• Remove hard bounces immediately. Repeatedly mailing invalid addresses harms your reputation.
• Suppress unsubscribes and spam complainers across every tool.
• Sunset inactive contacts. Define inactivity for your business (for example, no click or purchase over a period you choose) and stop mailing them, or run one re-permission message first.
• Do not buy lists. Purchased addresses have no consent and tend to produce complaints.
• Separate transactional and marketing streams so a marketing complaint spike does not hurt receipts and password resets. We cover this in transactional vs marketing email.

How do you monitor deliverability?

Watch three sources: your own bounce and delivery data, the mailbox providers' dashboards and your DMARC reports.

• Google Postmaster Tools shows spam rate, authentication results, and domain and IP reputation for mail sent to Gmail users. Google's guidelines tell senders to use it to monitor spam reports, delivery problems and authentication.
• DMARC aggregate reports sent to your rua address list every source that sends as your domain. They are how you find the forgotten CRM or invoicing tool before you move to p=reject.
• Bounce handling: hard bounces are permanent failures and should be removed; soft bounces are temporary and should be retried a few times before you stop. In the Email API you can scan the mailbox for bounce messages and start bounce monitoring.
• Seed tests: send to your own addresses at the major providers before each campaign and check the folder, the headers and the authentication results.

Email deliverability checklist

Run this before every new domain, platform or large campaign.

1. SPF record published once, covering every sending service, within 10 lookups.
2. DKIM enabled for your domain, key of 2048 bits where supported.
3. DMARC record published with a rua address; policy moved up only after reports are clean.
4. From domain aligned with the SPF or DKIM domain.
5. Forward and reverse DNS match on the sending IP, and TLS enabled.
6. One-click unsubscribe headers and a visible unsubscribe link on marketing mail.
7. Unsubscribes processed automatically, well inside 2 days.
8. Consent recorded for every recipient; no purchased lists.
9. Hard bounces removed; inactive contacts sunsetted.
10. Volume ramped gradually; spam rate watched in Postmaster Tools.
11. Marketing and transactional mail on separate streams.
12. Test sends checked at the major mailbox providers.

Worked example: a Dubai online pharmacy adds campaigns

"Noor Pharmacy", a synthetic Dubai retailer, sends order receipts from orders@noorpharmacy.example through its web shop and wants to add a monthly newsletter from a marketing platform. In an audit it finds that the web shop is covered by SPF but the newsletter platform signs with its own domain.

Actions: add the platform to the existing SPF record rather than creating a second one, enable custom domain DKIM, publish p=none with a rua mailbox and read two weeks of reports. The reports reveal an old support tool that was also sending as the domain; it gets authenticated. The newsletter moves to a subdomain, news.noorpharmacy.example, so a complaint spike on promotions cannot affect receipts. Then the pharmacy mails its most engaged customers first and widens the audience in steps, watching the spam rate.

What are the limits of this guide?

Authentication gets you through the door, not into the inbox. Mailbox providers also weigh engagement, content and history that no DNS record controls, and their rules change, so we link the providers' own pages rather than quote fixed thresholds beyond those cited. Nobody can promise inbox placement. This is general guidance, not legal advice; marketing email also has consent rules, covered in transactional vs marketing email.

How OmniChannels.ai helps

OmniChannels.ai sends email from your own sender: you connect your mailbox over SMTP and IMAP, or send through the Email API, with checks for your domain's SPF and DMARC records and a sandbox test send. Campaigns support Excel or CSV upload, duplicate filtering, preview and scheduling, and replies land in the Omni Inbox next to WhatsApp and other channels. Delivery reports export to CSV. See the email channel or book a developer walkthrough. For why email is only one part of the mix, read SMS vs email marketing.