Plain-language email authentication, the sender rules Gmail and Yahoo enforce, and a setup order that won't block your own invoices
Key takeaway: Since February 2024, Gmail and Yahoo have required every sender to authenticate their mail, and bulk senders must also publish DMARC, support one-click unsubscribe and keep spam complaints low. Most small businesses can meet these rules in an afternoon, but only if they know which domain their email platform actually sends from.
Below: what SPF, DKIM and DMARC each do, what Google and Yahoo require, a setup order that avoids breaking legitimate mail, and a monthly routine to keep newsletters out of the spam folder.
For years, email deliverability was something only large senders worried about. That changed when Google and Yahoo published formal sender requirements that took effect from February 2024. Google’s guidelines state that all senders to Gmail accounts must meet a baseline set of requirements, with stricter rules for anyone sending more than 5,000 messages a day to Gmail accounts (Google: Email sender guidelines). Yahoo set out closely matching requirements for its own mailboxes (Yahoo Sender Hub: Sender requirements and recommendations).
A small business rarely thinks of itself as a bulk sender. But Google’s FAQ counts all messages sent from the same primary domain toward the 5,000 figure, and says that senders who meet the threshold at least once are permanently considered bulk senders (Google: Email sender guidelines FAQ). A single seasonal campaign to a large list can be enough. The practical answer is to set up as if the bulk rules already apply to you.
All three are DNS records published on your domain. Each answers a different question for the receiving mail server.
Sender Policy Framework is a TXT record listing the servers and services permitted to send mail for your domain. Your office email provider, your newsletter platform, your booking system and your CRM may all send on your behalf, and each needs to be included. Two common mistakes: publishing two separate SPF records (there should be exactly one per domain), and adding so many services that the record exceeds SPF’s DNS lookup limit. Your email platforms’ setup guides give the exact include values to use.
DomainKeys Identified Mail adds a cryptographic signature to each message. The sending platform holds a private key; you publish the matching public key in DNS, usually as a CNAME or TXT record the platform gives you. Yahoo recommends DKIM keys of at least 1024 bits. The important step many small businesses miss is enabling DKIM signing with your own domain in each platform, rather than leaving the platform to sign with its shared domain.
DMARC ties the other two together. It checks that the domain in the visible From: address aligns with the domain that passed SPF or DKIM, tells receivers what to do with messages that fail, and asks them to send you aggregate reports. A starter record looks like this:
_dmarc.yourdomain.com TXT "v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com"
The p=none policy means “monitor only”: nothing is blocked, but you start receiving reports showing every service sending as your domain.
Both providers publish their rules, and they line up closely. For all senders, Google requires:
For senders of more than 5,000 messages a day to Gmail accounts, Google adds:
Yahoo’s bulk-sender requirements mirror these: SPF and DKIM, a valid DMARC policy of at least p=none that passes, relaxed alignment accepted, a functioning list-unsubscribe header supporting one-click unsubscribe (Yahoo highly recommends the RFC 8058 POST method), a visible unsubscribe link, honouring unsubscribes within 2 days, and a spam rate below 0.3%. Google’s FAQ likewise recommends processing unsubscribe requests within 48 hours.
One nuance worth knowing: 0.3% is the ceiling, not the target. Google’s guidelines recommend keeping spam rates below 0.10% and avoiding ever reaching 0.30%.
The risk in email authentication is not doing too little; it is locking out your own legitimate mail by doing things in the wrong order. This sequence avoids that.
p=none with a reporting address. Use a dedicated mailbox or a DMARC report service, because the reports are XML files that are hard to read raw.quarantine and eventually reject. This protects your domain from being spoofed in phishing emails, but it is optional for meeting Google’s and Yahoo’s current bulk-sender rules, which accept p=none.If you are still choosing a platform, authentication support with your own domain should be on the shortlist criteria. Our guide to email marketing tools for small businesses compares the main options.
Yahoo recommends not sending bulk or marketing email from the same IPs you use for user mail, transactional mail and alerts, because each IP and DKIM domain builds its own reputation. For a small business, the practical version is simple: send newsletters from your marketing platform, and keep invoices, password resets and booking confirmations on your transactional or office system. Many businesses also use a subdomain for marketing, such as news.yourdomain.com, so a campaign that draws complaints does not drag down the reputation of the domain your staff use every day.
Authentication gets you through the door. What you send, and to whom, decides whether you stay out of the spam folder. Yahoo’s recommendations are blunt: only send to people who specifically requested your mail, do not buy lists, do not pre-tick opt-in boxes, use confirmed opt-in, remove invalid addresses promptly and watch bounces and inactive recipients. It also recommends setting expectations at sign-up about what you will send and how often, and not suddenly switching a monthly list to daily emails.
Our article on email list building tactics covers how to grow a list that people genuinely signed up to. If you run automated sequences, the same principles apply to every trigger in your marketing automation setup: an automated email nobody expected is still a spam complaint waiting to happen.
p=reject. Without reading reports first, you risk blocking your own invoices or booking confirmations.If you ever send more than 5,000 messages a day to Gmail accounts from your domain, Google requires a DMARC record, and Yahoo requires one for bulk senders too. A monitoring policy of p=none is accepted. Setting it up early is sensible because Google counts all mail from the same primary domain toward the threshold.
Google and Yahoo both require spam rates below 0.3%. Google recommends keeping the rate reported in Postmaster Tools below 0.10% and never reaching 0.30%.
Yahoo requires bulk senders to honour unsubscribes within 2 days, and Google recommends fulfilling unsubscribe requests within 48 hours.
No. Start with p=none and read the aggregate reports to find every legitimate service sending as your domain. Tighten to quarantine or reject only once they all pass, or you risk blocking your own mail.
Vega Marketing helps small businesses set up email authentication, list hygiene and campaigns that people actually want to receive.
Talk to Our Team