You can write a great newsletter and still watch it land in the spam folder. Often the problem has nothing to do with the words. It sits in a few lines of text in your domain settings that most business owners never look at. Those lines tell inbox providers that your emails really come from you.
The three standards are called SPF, DKIM and DMARC. They sound technical, and the setup does involve your domain’s DNS records. The ideas behind them are simple though. This guide explains what each one does and why big providers like Gmail now expect them.
Why email authentication matters for marketing
Anyone can put your business name in the “from” line of an email. Scammers do this all the time to trick customers into paying fake invoices or handing over passwords. Email authentication gives receiving servers a way to check the claim. If a message says it is from your domain but fails the checks, the receiver can treat it with suspicion.
For a marketing list this matters twice over. Your genuine campaigns are more likely to reach the inbox when they pass the checks. Your customers are also better protected from people pretending to be you. The Victorian Government uses DMARC so only people it authorises can send email from its domain. It also recommends business owners implement DMARC to protect their own email domains.
That same page makes a fair point about limits. DMARC gives strong protection against fraudulent emails sent in your name. It does not stop every kind of phishing or scam. Think of it as one layer of protection rather than the whole answer.
What SPF does
SPF stands for Sender Policy Framework. It is a record in your domain’s DNS that lists the servers allowed to send mail for your domain. Google describes SPF as a way to help prevent senders from impersonating you. When a message arrives, the receiving server checks whether it came from one of the servers on your list.
Small businesses often send mail from more than one place. You might use one service for your office inbox, another for newsletters and a third for online shop receipts. Each of those senders usually needs to be covered by your SPF record. If one is missing, its messages may fail the check even though they are genuine.
What DKIM does
DKIM stands for DomainKeys Identified Mail. It adds a digital signature to each email you send. Your sending service holds a private key that signs the message, and a matching public key sits in your DNS as a text record. Receiving servers use that public key to read the signature and confirm the email came from your domain.
Google notes that DKIM also helps prevent message contents from being changed in transit. If someone alters the email along the way, the signature will no longer match. Your sending service creates the keys. The job on your side is usually adding the public key to your DNS settings correctly.
What DMARC does
DMARC stands for Domain based Message Authentication, Reporting and Conformance. It builds on SPF and DKIM. A DMARC record tells receiving servers what to do with messages that claim to be from your domain but fail those checks. Google puts it simply: DMARC lets you choose what happens to messages that do not pass SPF or DKIM.
A DMARC policy can start gently. Gmail’s sender guidelines accept a minimum policy of none, which means receivers are told about the record but are not asked to block anything yet. Many businesses begin there, check that all their genuine mail passes, then tighten the policy later. That staged approach reduces the chance of blocking your own newsletters by mistake.
What Gmail now expects from senders
Google publishes email sender guidelines for Gmail that apply to anyone sending to personal Gmail accounts. Every sender is expected to have proper authentication in place. Bulk senders face stricter rules. Google treats a sender as a bulk sender when they send close to 5,000 messages a day to personal Gmail accounts, and that status does not expire.
For bulk senders the list of requirements is longer. Some of these settings sit with your email platform rather than your DNS. The main points from Google’s guidance are below.
- Authenticate messages with both SPF and DKIM.
- Publish a DMARC record, with a policy of none as the minimum.
- Align the visible from domain with either the SPF domain or the DKIM domain.
- Offer a one click unsubscribe option in the message headers for marketing and promotional emails.
- Keep the spam rate reported by users below 0.1% and stop it reaching 0.3%.
- Use a secure TLS connection for sending.
Google also recommends that unsubscribe requests are processed within 48 hours. That is good practice for any list, large or small. People who no longer want your emails are the ones most likely to press the spam button. Letting them leave easily protects your sender reputation.
How a small business can get this set up
Start by listing every service that sends email using your domain. Include your office email provider, your newsletter platform, your website contact forms and any shop or booking system. Each one should have setup instructions for SPF and DKIM in its help pages. Your domain’s DNS is usually managed where you registered the domain or with your web host.
Next, add or update the records one service at a time. Follow each provider’s exact instructions, as small typing errors can break a record. Test by sending a message to yourself and checking it arrives cleanly. Once SPF and DKIM are working, add a DMARC record starting with the policy of none.
Your hosting setup plays a part here too. If you are reviewing providers, our article on choosing web hosting covers some of the questions worth asking. Ask who controls your DNS and how quickly changes can be made. Delays there can hold up an email fix for days.
Authentication for online shops
Online stores send a steady stream of order confirmations, shipping updates and password resets. Customers expect these messages, and a missing receipt can trigger a support request or a lost sale. Those transactional emails need the same authentication as your newsletters. If you are setting up a store, our guide to ecommerce basics is a useful place to begin.
Google’s one click unsubscribe rule applies to marketing and promotional messages, not to transactional ones. You do not need an unsubscribe header on an order receipt. You do still need the receipt to pass SPF and DKIM. Keeping marketing and transactional email on clearly separated systems can make problems easier to spot.
Trust starts before the email is opened
People make quick judgements about whether a business looks genuine. The same instincts that shape web design psychology apply in the inbox. A message from an unfamiliar sender or a strange address makes people hesitate. Authentication will not write a better subject line, but it helps your real emails get seen in the first place.
Your emails and your website also work as a pair. Most campaigns send readers to a landing page or product page. If that page is slow or confusing, the good work done by the email is lost. That is one more reason web design is important for businesses that rely on email marketing.
Frequently asked questions
Do small businesses really need SPF, DKIM and DMARC?
Google expects all senders to authenticate their mail to personal Gmail accounts. The stricter bulk rules start near 5,000 messages a day. Smaller senders still benefit from better inbox placement and protection against spoofing.
Will DMARC stop all scam emails using my name?
No. The Victorian Government notes that DMARC protects well against fraudulent emails sent from your domain. It does not protect against other forms of phishing or scams.
Where do I add SPF, DKIM and DMARC records?
They go in your domain’s DNS settings. These are usually managed by your domain registrar or web host. Each sending service’s help pages show the exact text to add.
What does a DMARC policy of none do?
It publishes your DMARC record without asking receivers to block failing mail. Gmail accepts none as the minimum policy for bulk senders. Many businesses start there and tighten it once genuine mail is passing.
