What DMARC/DKIM/SPF updates are needed for new Gmail/Yahoo requirements?
Published 6 Jul 2025
Updated 3 Oct 2026
10 min read
Summarize with
Updated on 3 Oct 2026: We clarified SPF and DKIM alignment for third-party senders, subdomains, and each provider's unsubscribe rules.
For Gmail and Yahoo bulk mail, make both SPF and DKIM pass, publish a valid DMARC record with at least p=none, and make one authenticated domain match the visible From domain at the organizational level. SPF checks the envelope sender domain; DKIM checks the signing domain. Google states the requirements in its Google sender guidelines. Yahoo also requires a DMARC pass for bulk mail.
Do not start by changing DMARC to quarantine or reject. First test every live mail stream, then check which authenticated domain matches the address people see in the inbox. If SPF and DKIM pass, one method aligns, and DMARC exists at p=none or stronger, the core authentication work is done.
Direct answer
- Publish a DMARC TXT record at _dmarc with at least p=none.
- Enable DKIM signing for each sender with a key of at least 1024 bits; use 2048 bits when supported.
- Publish one valid SPF record at each envelope sender domain you control and stay within the 10 DNS lookup limit.
- Check that SPF or DKIM passes with a domain aligned to the visible From address.
What Gmail and Yahoo require
Bulk senders need both SPF and DKIM to pass, a published DMARC policy, and a DMARC pass through an aligned SPF or DKIM domain. With relaxed alignment, the authenticated domain and visible From domain can share the same organizational domain.
For bulk marketing and subscribed mail, also check unsubscribe support. The broader authentication and unsubscribe rules cover low spam complaint rates, TLS for Gmail, and valid forward and reverse DNS.
|
|
|
|
|
|---|---|---|---|---|
SPF or DKIM | SPF or DKIM | Recommended | Recommended | |
SPF or DKIM | SPF or DKIM | Recommended | Recommended | |
Gmail bulk | Must pass | Must pass | p=none or stronger | One passing method |
Yahoo bulk | Must pass | Must pass | p=none or stronger; must pass | One passing method |
Operational target | Passes | Passes | Reports on | Both methods |
Authentication requirements by sender type. 'One passing method' means an SPF or DKIM domain aligns with the visible From domain.
Flowchart showing the order to check SPF, DKIM, From domain matching, DMARC, and reporting.
Who counts as a bulk sender
For Gmail, bulk status applies when a primary domain sends close to 5,000 messages or more to personal Gmail accounts in a 24-hour period. Traffic from subdomains rolls up to the primary domain, and Google says the classification does not expire once assigned. These rules apply to mail sent to personal Gmail accounts, not Google Workspace accounts.
Yahoo does not publish a numeric bulk threshold. It describes a bulk sender as one sending a significant volume and evaluates compliance at the authenticated domain or From header domain level, along with other signals such as IP and content. Treat the rules as applicable before reaching Gmail's threshold when Yahoo recipients are part of the audience.
These requirements are already enforced
Gmail increased enforcement on non-compliant traffic in November 2025, including temporary and permanent rejections. Yahoo has enforced its sender rules since 2024 and can send non-compliant mail to spam or reject it.
The DNS changes to make
Use the visible From domain as the reference for DMARC alignment. If your newsletter uses news@example.com, DKIM can sign with example.com or a subdomain under it when alignment is relaxed. SPF must authorize the sending IP at the message's envelope sender domain, which can differ from the visible From domain. Publish DMARC on the From domain, or let it inherit the organizational domain's policy when that is intended.
Passing DKIM with a vendor-owned domain proves the message was signed, but it does not give your From domain a matching signature. Configure at least one valid DKIM signature with the same organizational domain as the From address. Both providers require DKIM keys of at least 1024 bits and recommend 2048 bits when supported. The details are covered in DKIM domain matching.
Minimum DMARC recorddns
_dmarc.example.com TXT v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com
Illustrative SPF record for one sending IPdns
example.com TXT v=spf1 ip4:192.0.2.1 -all
Replace the documentation IP in this SPF example with the real sending IP or the sender's approved SPF mechanism. Publish the record at the actual envelope sender domain and keep only one SPF TXT record there.
DKIM selector record patterndns
selector1._domainkey.example.com TXT v=DKIM1; k=rsa; p=MIIBIjANBg...
Do not skip the live-message test
DNS records can look correct while live mail still fails. A vendor can sign with the wrong DKIM domain, use a different return-path domain, or send from infrastructure missing from SPF. Send a real message and inspect the authentication results before calling the work done.
Third-party senders and subdomains
For each vendor, record the DKIM signing domain shown as d= and the envelope sender shown in Return-Path. If the vendor uses its own envelope domain, adding it to the visible From domain's SPF record does not change that SPF check. Ask for a custom return-path under your domain if you want SPF alignment; otherwise use aligned DKIM for DMARC. Bulk mail still needs both SPF and DKIM to pass.
A message sent as offers@example.com and one sent as offers@news.example.com can use different DNS hosts. An organizational DMARC policy covers subdomains unless a subdomain publishes its own DMARC record. SPF and DKIM records do not inherit in the same way: publish SPF at the envelope domain in use and the DKIM key at the selector and signing domain used by each stream.
Check the actual domains
Compare the visible From domain, Return-Path domain, and each passing DKIM d= value in a delivered message. A passing SPF or DKIM result alone does not prove DMARC alignment.
How to test each sending source
Start with the actual mail streams, not with a DNS guess. List every system that sends as the domain: newsletter platform, ecommerce receipts, billing, CRM, support desk, internal workspace, alerts, and any legacy SMTP relay. Then send a message from each system to a mailbox where you can see the full headers.
Check the Authentication-Results line first. Confirm that SPF, DKIM, and DMARC pass. Then compare the DKIM signing domain, the SPF envelope domain, and the visible From address. If the only passing method uses a vendor-owned domain, the message still needs a domain-matching fix.
Suped's domain health check helps review published DMARC, SPF syntax, DKIM selector records, and other DNS settings. Use live message headers to confirm how each sender actually authenticates.
?
What's your domain score?
Deep-scan SPF, DKIM & DMARC records for email deliverability and security issues.
After the first pass, split the work into mandatory fixes and cleanups. Mandatory fixes are the items that stop mail from passing authentication or matching the From domain. Cleanups include tightening SPF policies, rotating older DKIM keys, adding reporting addresses, and planning DMARC enforcement.
If you have one sender
- Send one real message and verify SPF, DKIM, and DMARC results.
- Make DKIM pass with your visible From domain.
- Use DMARC reports after the first live-message check.
If you have many senders
- Map every vendor, subdomain, and return-path.
- Separate marketing, transactional, and internal mail.
- Review DMARC reports for hidden or misconfigured sources.
When monitoring becomes worth it
For a sender with one mail stream, a live-message test is the first check. With multiple sources, old automation, agencies, or subdomains, DMARC aggregate reports help identify mail you missed and show whether each source passes authentication and alignment.
Suped's DMARC monitoring supports that workflow: receive aggregate reports, identify legitimate and unknown sources, and track SPF, DKIM, and DMARC issues while you stage policy changes.
Issue steps to fix dialog showing the issue overview, tailored fix steps, and verification action
Suped groups report data by sending source and provides issue details and fix steps, which helps teams review failures without reading raw XML.
Safe policy staging
If the domain has unknown mail sources, keep p=none while you identify them. Move to p=quarantine or p=reject only after important sources are passing with the right domain.
Non-DNS requirements still matter
SPF, DKIM, and DMARC are the authentication layer, but Gmail and Yahoo sender rules also cover sending behavior. A domain with valid DNS can still have delivery problems if recipients complain, messages are malformed, unsubscribe is broken, or the sending IP has poor reputation.
- For Gmail, keep the user-reported spam rate below 0.1% and prevent it from reaching 0.3%; Yahoo requires a rate below 0.3%.
- For Gmail bulk marketing and subscribed mail, implement RFC 8058 one-click headers and a visible body link. Yahoo requires a functioning List-Unsubscribe header and a visible body link; its mailto method is acceptable, while RFC 8058 POST is recommended.
- Honor unsubscribe requests within 48 hours. Transactional messages such as password resets are exempt from Gmail's one-click requirement.
- Use TLS when sending to Gmail. Keep valid forward and reverse DNS for sending IPs.
- Format messages correctly, identify the sender clearly, and include a valid Message-ID.
Google Postmaster Tools dashboard showing spam rate, reputation, authentication, and TLS status.
If DNS authentication passes and delivery still drops, look at reputation and complaints next. Authentication gives mailbox providers a reliable identity to evaluate. It does not guarantee inbox placement by itself.
What to do if DNS access is hard
Small businesses often have the hardest version of this work: the sender is non-technical, the DNS owner is busy, and every sending system has a different setup screen. Reduce DNS changes to the records needed for each actual mail stream, then use hosted services where they remove repeat DNS work.
Suped's hosted DMARC supports policy staging and reporting without repeated TXT record edits. For a first record, Suped's DMARC record generator produces a syntactically valid starting point.
Avoid this shortcut
Do not publish p=none at the root domain and assume every stream is ready. A DMARC record only creates the policy layer. You still need live mail to pass SPF or DKIM with the right domain.
Views from the trenches
Best practices
Prioritize DKIM with your From domain before changing policy enforcement or DNS volume.
Test every active sender with real mail headers, not only copied DNS values from setup screens.
Keep DMARC reports on once more than one vendor or mail stream sends for the domain.
Common pitfalls
Publishing DMARC at the root domain without checking each stream leaves gaps hidden.
Assuming an ESP fixed everything misses SPF return-path and DKIM selector details.
Changing to quarantine before source review can break invoices, alerts, and help desk mail.
Expert tips
Use relaxed domain matching first, then tighten only after stable reports prove coverage.
When engineering time is limited, make DKIM pass with your domain before chasing SPF edge cases.
Treat DMARC monitoring as step two if the only live stream has already been verified.
Marketer view
Marketer from Email Geeks says the right update depends on the starting point, because a domain with passing DKIM and a matching From domain needs less DNS work than a domain using shared signatures.
2024-02-12 - Email Geeks
Marketer view
Marketer from Email Geeks says a sender should publish DMARC with at least p=none, then confirm that a real message passes through either SPF or DKIM with the visible From domain.
2024-02-16 - Email Geeks
The safest practical path
Add DMARC if it is missing, enable DKIM signing with your domain, authorize each sender at its envelope SPF domain, and test live messages. For more than one mail stream, review aggregate reports to find sources you missed.
After legitimate mail passes, stage enforcement: observe at p=none, fix failures, move to p=quarantine, and then consider p=reject. Suped can help identify sending sources and track failures through those changes.
