SPF, DKIM and DMARC in 2026: Gmail, Yahoo, Outlook Rules

What do the big inbox providers require in 2026?

The rules converged in 2024 and 2025, and they still apply. Gmail's guidelines split senders into two groups. Everyone must set up SPF or DKIM, send over TLS, have valid forward and reverse DNS, follow the RFC 5322 message format and keep spam rates below 0.3%. Bulk senders, defined as those sending 5,000 or more messages a day to Gmail, must also set up both SPF and DKIM, publish a DMARC record (the policy can be none), align the From domain with SPF or DKIM, and support one-click unsubscribe with a visible unsubscribe link.

Yahoo's Sender Hub asks bulk senders for the same core set: SPF and DKIM, a valid DMARC policy of at least p=none that passes, a working one-click List-Unsubscribe header, unsubscribes honoured within 2 days, and a spam rate below 0.3%. Microsoft followed for its consumer addresses: since May 5, 2025, senders of more than 5,000 messages a day to Outlook.com, Hotmail.com and Live.com must pass SPF, DKIM and DMARC, and non-compliant messages are rejected rather than sent to junk.

What do SPF, DKIM and DMARC actually do?

SPF (Sender Policy Framework) is a DNS record that lists the servers allowed to send mail for your domain. When a message arrives, the receiving server checks whether it came from one of those servers.

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each message. The public key lives in your DNS, so the receiver can confirm the message was not altered and really came from your domain.

DMARC ties the two together. It tells receivers what to do when a message fails (nothing, quarantine or reject) and requires that the domain in the visible From address matches the domain that passed SPF or DKIM. That alignment is what stops someone sending in your name from a server you never authorised. It also sends you reports, which is how you discover tools that send on your behalf without being set up.

How do you set them up, step by step?

Most teams can do this in an afternoon. The order matters: authenticate every real sender first, then publish DMARC in monitoring mode, then tighten.

• List every service that sends as your domain: your mailbox provider, marketing platform, CRM, billing and support tools.
• Publish one SPF record that includes each of them. A domain may have only one SPF record, and it must stay under 10 DNS lookups.
• Turn on DKIM signing in each sending service and publish the keys it gives you.
• Publish DMARC at p=none with a reporting address, for example v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com.
• Read the reports for two to four weeks, fix anything that fails, then move to p=quarantine and later p=reject.
• Send marketing and outbound from subdomains so a problem in one stream does not damage the main domain.

Why does p=none count, and should you stop there?

All three providers accept p=none as the minimum because it lets you start collecting reports without blocking your own mail by accident. It proves you have DMARC; it does not protect your domain. Treat it as a monitoring phase with an end date. Once the reports show that every legitimate sender passes, a stricter policy stops spoofed mail from reaching inboxes in your name.

How do you check that everything is working?

Do not assume a DNS change worked; test it. Send a message from each tool that mails as your domain to a Gmail address, open it, and use the menu option that shows the original message. Look for three lines: SPF pass, DKIM pass and DMARC pass, each naming your domain. If any line fails or names a different domain, that tool is not aligned yet.

Then watch the aggregate DMARC reports for a few weeks. They arrive as XML files, so most teams use a free or paid DMARC report reader. The reports list every server that sent mail claiming to be you, how much it sent and whether it passed. This is where forgotten senders appear: an old newsletter tool, a support desk, an invoicing system. Add each legitimate one to SPF and turn on its DKIM signing; anything you do not recognise is a reason to move to a stricter policy sooner.

Finally, register your domain in Google Postmaster Tools and Yahoo Sender Hub so you can see spam complaint rates and domain reputation directly. Check them weekly, and immediately after any large send or a new sending tool.

• Gmail 'Show original': SPF, DKIM and DMARC should each say PASS for your domain.
• DMARC reports: every legitimate sender should pass; investigate the rest.
• Postmaster Tools and Sender Hub: keep spam complaints well under 0.3%.

What else keeps you out of the spam folder?

Authentication gets you through the door; behaviour keeps you inside. Watch your spam complaint rate in Google Postmaster Tools and Yahoo Sender Hub and keep it well below the 0.3% ceiling. Make unsubscribing easy, because a hidden unsubscribe link turns into spam complaints. Send to people who asked to hear from you or who match a clear business reason, verify addresses before sending, and increase volume gradually on new domains.

For outbound specifically, a human approval step before sending reduces the off-target messages that generate complaints. I set up SPF, DKIM and DMARC as part of the outbound system I built at Attio, alongside that approval step.