What DMARC/DKIM/SPF updates are needed for new Gmail/Yahoo requirements?
Published 6 Jul 2025
Updated 29 Jul 2026
10 min read
Summarize with
Updated on 29 Jul 2026: We updated this guide with current bulk-sender scope and authentication checks for Gmail and Yahoo.
The update most senders need is direct: publish a valid DMARC record, make DKIM pass with a domain that matches the visible From domain at the organizational level, publish SPF for every system that sends mail for the domain, and make sure at least one of SPF or DKIM matches the From domain so DMARC passes. For Gmail bulk senders, Google also requires both SPF and DKIM authentication, a DMARC record with at least p=none, and domain matching for direct email. Google states this in its Google sender guidelines. Yahoo bulk senders also need both SPF and DKIM, a DMARC policy of at least p=none, and a DMARC pass through SPF or DKIM domain matching.
Do not start by changing DMARC to quarantine or reject. First prove that the live mail streams pass SPF and DKIM, then check which authenticated domain matches the address people see in the inbox. If DKIM already passes and uses your domain, SPF includes the active senders, and DMARC exists at p=none or stronger, the required DNS work is usually done.
Direct answer
- DMARC: Add a TXT record at _dmarc with at least p=none.
- DKIM: Sign mail with your domain, use a key of at least 1024 bits, and choose 2048 bits when supported.
- SPF: Include every legitimate sender and stay under the 10 DNS lookup limit.
- Priority: If time is limited, fix DKIM with your From domain before chasing SPF edge cases.
The short answer
The Gmail and Yahoo changes are not a request to publish random DNS records. They require mail to authenticate, then pass DMARC through domain matching. That means the domain in the visible From address must match, at least at the organizational domain level, the SPF return-path domain or the DKIM signing domain.
For bulk marketing and subscribed mail, the practical target is: SPF passes, DKIM passes, DKIM uses your domain, DMARC exists, and one-click unsubscribe works. The broader authentication and unsubscribe rules also include low spam complaint rates, TLS, and valid forward and reverse DNS.
|
|
|
|
|
|---|---|---|---|---|
 All senders to Gmail | Required if no DKIM | Required if no SPF | Recommended | Recommended |
Gmail bulk | Required | Required | p=none | One method |
 Yahoo bulk | Required | Required | p=none; must pass | One method |
Operational target | Passes | Passes | Reports on | DKIM match |
Compact requirement map for common sender types.
Flowchart showing the order to check SPF, DKIM, From domain matching, DMARC, and reporting.
Who counts as a bulk sender
For Gmail, bulk status applies when a primary domain sends close to 5,000 messages or more to personal Gmail accounts in a 24-hour period. Traffic from subdomains rolls up to the primary domain, and Google says the classification does not expire once assigned. These rules apply to mail sent to personal Gmail accounts, not Google Workspace accounts.
Yahoo does not publish a numeric bulk threshold. It describes a bulk sender as one sending a significant volume and evaluates compliance at the authenticated domain or From header domain level, along with other signals such as IP and content. Treat the rules as applicable before reaching Gmail's threshold when Yahoo recipients are part of the audience.
These requirements are already enforced
Gmail increased enforcement on non-compliant traffic in November 2025, including temporary and permanent rejections. Yahoo has enforced its sender rules since 2024 and can send non-compliant mail to spam or reject it.
The exact DNS changes
The safest DNS update is to make the visible From domain the center of the setup. If your newsletter uses news@example.com, then DKIM should sign with example.com or a subdomain under it. SPF should authorize the system that sends the message. DMARC should be published on the From domain, or inherited from the organizational domain when that is the intended setup.
The part that trips teams up is DKIM. Passing DKIM with an ESP-owned domain proves the message was signed, but it does not prove your brand domain was the signer. Configure DKIM to pass with the same organizational domain as the From address. Both providers require DKIM keys of at least 1024 bits and recommend 2048 bits when supported. The details are covered more deeply in DKIM domain match.
Minimum DMARC recorddns
_dmarc.example.com TXT v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com
Typical SPF recorddns
example.com TXT v=spf1 include:_spf.google.com include:send.example.net -all
DKIM selector record patterndns
selector1._domainkey.example.com TXT v=DKIM1; k=rsa; p=MIIBIjANBg...
Do not skip the live-message test
DNS records can look correct while live mail still fails. A vendor can sign with the wrong DKIM domain, use a different return-path domain, or send from infrastructure missing from SPF. Send a real message and inspect the authentication results before calling the work done.
How to check a domain
Start with the actual mail streams, not with a DNS guess. List every system that sends as the domain: newsletter platform, ecommerce receipts, billing, CRM, support desk, internal workspace, alerts, and any legacy SMTP relay. Then send a message from each system to a mailbox where you can see the full headers.
Check the Authentication-Results line first. Confirm that SPF, DKIM, and DMARC pass. Then compare the DKIM signing domain, the SPF envelope domain, and the visible From address. If the only passing method uses a vendor-owned domain, the message still needs a domain-matching fix. That small check usually changes the fix.
Suped's domain health check is useful before touching DNS because it catches missing DMARC, broken SPF syntax, missing DKIM selectors, and common authentication gaps.
?
What's your domain score?
Deep-scan SPF, DKIM & DMARC records for email deliverability and security issues.
After the first pass, split the work into mandatory fixes and cleanups. Mandatory fixes are the items that stop mail from passing authentication or matching the From domain. Cleanups include moving from softfail to fail in SPF, rotating older DKIM keys, adding reporting addresses, and planning DMARC enforcement.
If you have one sender
- Check: Send one real message and verify SPF, DKIM, and DMARC results.
- Fix: Make DKIM pass with your visible From domain.
- Monitor: DMARC reports help, but the live-message test is the first step.
If you have many senders
- Inventory: Map every vendor, subdomain, and return-path.
- Group: Separate marketing, transactional, and internal mail.
- Monitor: DMARC reports become important because hidden senders are common.
When monitoring becomes worth it
For a tiny sender with one ESP-controlled mail stream, you can verify the stream with less work than building a full DMARC reporting process. That does not make reporting useless. It means reporting has to match the risk. The moment a domain has multiple mail sources, old automation, agencies, subdomains, or shared operational ownership, DMARC aggregate reports stop being optional hygiene and start being the way you find what is really sending.
Suped's DMARC monitoring is built for that workflow: connect reporting, identify legitimate and unknown sources, get automated issue detection, and follow steps to fix SPF, DKIM, and DMARC problems. Suped also includes hosted SPF, hosted DMARC, hosted MTA-STS, real-time alerts, and blocklist (blacklist) monitoring for ongoing authentication work.
Issue steps to fix dialog showing the issue overview, tailored fix steps, and verification action
For teams without IT capacity, Suped turns DMARC reports into actions instead of leaving teams with raw XML. The product connects source identification, issue detection, and fix steps while letting teams stage policy carefully instead of jumping straight to enforcement.
Safe policy staging
If the domain has unknown mail sources, keep p=none while you identify them. Move to p=quarantine or p=reject only after important sources are passing with the right domain.
Non-DNS requirements still matter
SPF, DKIM, and DMARC are the authentication layer, but Gmail and Yahoo sender rules also care about sending behavior. A domain with perfect DNS can still have delivery problems if recipients complain, messages are malformed, unsubscribe is broken, or the sending IP has poor reputation.
- Spam rate: For Gmail, keep the reported rate below 0.1% and prevent it from reaching 0.3%; Yahoo requires a rate below 0.3%.
- Unsubscribe: Bulk marketing and promotional mail needs RFC 8058 one-click unsubscribe, a visible body link, and processing within 48 hours.
- TLS: Gmail bulk mail must be transmitted over TLS.
- DNS hygiene: Sending IPs need valid PTR and forward DNS that resolve consistently.
- Headers: Messages need valid formatting, clear sender identity, and a valid Message-ID.
Google Postmaster Tools dashboard showing spam rate, reputation, authentication, and TLS status.
If DNS authentication passes and delivery still drops, look at reputation and complaints next. Authentication gives mailbox providers a reliable identity to evaluate. It does not guarantee inbox placement by itself.
What to do if DNS access is hard
Small businesses often have the hardest version of this work: the sender is non-technical, the DNS owner is busy, and every ESP has a slightly different setup screen. Reduce DNS changes to the smallest set that proves compliance, then use hosted services only where they remove repeat DNS work.
Suped's hosted DMARC helps when policy staging and reporting need to be managed without repeated TXT record edits. If you are creating the first record manually, Suped's DMARC record generator is a faster way to produce a syntactically valid starting point.
Avoid this shortcut
Do not publish p=none at the root domain and assume every stream is ready. A DMARC record only creates the policy layer. You still need live mail to pass SPF or DKIM with the right domain.
Views from the trenches
Best practices
Prioritize DKIM with your From domain before changing policy enforcement or DNS volume.
Test every active sender with real mail headers, not only copied DNS values from setup screens.
Keep DMARC reports on once more than one vendor or mail stream sends for the domain.
Common pitfalls
Publishing DMARC at the root domain without checking each stream leaves gaps hidden.
Assuming an ESP fixed everything misses SPF return-path and DKIM selector details.
Changing to quarantine before source review can break invoices, alerts, and help desk mail.
Expert tips
Use relaxed domain matching first, then tighten only after stable reports prove coverage.
When engineering time is limited, make DKIM pass with your domain before chasing SPF edge cases.
Treat DMARC monitoring as step two if the only live stream has already been verified.
Marketer from Email Geeks says the right update depends on the starting point, because a domain with passing DKIM and a matching From domain needs less DNS work than a domain using shared signatures.
2024-02-12 - Email Geeks
Marketer from Email Geeks says a sender should publish DMARC with at least p=none, then confirm that a real message passes through either SPF or DKIM with the visible From domain.
2024-02-16 - Email Geeks
The safest practical path
The answer to the Gmail and Yahoo update question is not to make one blind DMARC change. Add DMARC if it is missing, make DKIM pass with your domain, authorize every sender in SPF, and test real mail headers. If a single stream is already clean, that can satisfy the immediate requirement. If the domain has more than one stream, turn on reporting and use it to find the senders you missed.
After that, staged enforcement is the right security move: observe, fix, quarantine, then reject. Suped makes that path practical for teams that do not want to parse DMARC XML, manage SPF lookup limits by hand, or wait for a bounce problem before learning that a sender was misconfigured.
