What changed and who it applies to
Gmail and Yahoo now enforce a set of sender requirements, with the strictest rules for anyone sending around 5,000 or more emails a day to their users. In practice the core requirements apply to everyone, because the same signals decide whether your one-to-one emails land in the inbox too. If you send a newsletter, run automated sequences or use a CRM to email customers, this applies to you.
Quick answer
Set up SPF, DKIM and DMARC on your sending domain, add one-click unsubscribe, keep spam complaints under 0.3 percent, and stop sending from a free Gmail address. Half a day of work protects every email you send.
The three authentication records
Authentication proves your emails really come from your domain. There are three records, all added in your domain's DNS settings, usually through whoever you bought the domain from. Your email platform will give you the exact values to paste in.
- SPF: lists which services are allowed to send email for your domain
- DKIM: adds a digital signature so the message cannot be tampered with in transit
- DMARC: tells inbox providers what to do if SPF or DKIM fails, and sends you reports
The other requirements, in plain terms
Beyond authentication, the rules come down to behaving like a sender people want to hear from.
| Requirement | What it means for you | |
|---|---|---|
| One-click unsubscribe | Marketing emails need a working unsubscribe link and the technical header your platform adds | |
| Spam rate under 0.3% | Fewer than 3 complaints per 1,000 emails; aim for under 0.1% | |
| Send from your own domain | No bulk sending from @gmail.com or @yahoo.com addresses | |
| Valid forward and reverse DNS | Your platform handles this; check it is on a shared or dedicated IP with good reputation |
Why it is worth doing even if you are small
Deliverability is cumulative. Every email that lands in spam lowers the odds for the next one, including the quote you send to a new customer. Properly authenticated domains with low complaint rates get the benefit of the doubt. Unauthenticated ones do not, and the effect shows up as 'they never replied' rather than an error message.
A half-day checklist
Log into your DNS. Add SPF, DKIM and DMARC using the values from your email platform, starting DMARC in monitor-only mode. Check your unsubscribe link works and is on every marketing email. Remove anyone who has not opened in twelve months. Verify everything with a free tool like MXToolbox. If you get stuck, this is a job we do for clients in an afternoon.
If you are stuck or want a second pair of eyes on this, give us a shout. We are always up for a chat.
