Gmail and Yahoo now check whether a message came from the domain named in the From: line. Without SPF, DKIM, and in many cases DMARC, your invoices, contact-form alerts, and newsletters get treated like mail from a stranger. The fix is a one-time job at your domain host.
Gmail and Yahoo now verify who sends your mail
According to Google Workspace Admin Help's email sender guidelines, every sender who mails personal Gmail accounts must set up SPF or DKIM for their sending domain. Yahoo's Sender Hub best practices set a similar bar for bulk senders, who need both SPF and DKIM together. Skip it, and spam filters sort your mail with the impostors.
Small businesses face the same clock as large mailers
Google's sender guidelines FAQ defines a bulk sender as any sender that sends close to 5,000 messages or more to personal Gmail accounts within a 24-hour period. Most small businesses stay far below it. Even so, the same FAQ warns that Gmail is ramping up enforcement on non-compliant traffic starting November 2025.
Senders had until June 1, 2024 to add one-click unsubscribe to marketing messages, per that FAQ. Invoices and contact-form notifications count as transactional mail, so this particular rule skips them. Newsletters and promotions do need it.
SPF, DKIM and DMARC each do a different job
These three records work together. Each one checks something different.
| Record | What it does | Who needs it |
|---|---|---|
| SPF | "SPF helps prevent your outgoing email from being marked as spam by receiving email servers," according to Google Workspace Admin Help. | Every sender needs SPF or DKIM, per Google's email sender guidelines; bulk senders need both. |
| DKIM | "DKIM helps protect your domain against spoofing by authenticating your email with a DKIM signature," per Google Workspace Admin Help. | Every sender needs SPF or DKIM; bulk senders need both. |
| DMARC | DMARC "builds on the widely deployed SPF and DKIM protocols, adding linkage to the author ('From:') domain name, published policies for recipient handling of authentication failures, and reporting from receivers to senders," according to dmarc.org. | Required for bulk senders, on top of SPF and DKIM. |
Google's guidelines add that for bulk senders, the domain in the From: header must line up with either the SPF domain or the DKIM domain. Yahoo asks for a DMARC policy of at least p=none that passes, alongside SPF and DKIM, per its Sender Hub best practices.
Bulk senders face extra rules for unsubscribe links and spam rate
Bulk senders need more than SPF and DKIM. Google's email sender guidelines require these senders to add DMARC, align their From: header, and support one-click unsubscribe on marketing and subscribed messages. Spam rate matters too. Google asks senders to keep spam rates reported in Postmaster Tools below 0.10%, and to avoid ever reaching 0.30%. Yahoo caps bulk senders at 0.3%. It also asks for SPF, DKIM, a valid DMARC policy, and one-click unsubscribe.
Check your setup and fix what's missing
Fixing these records is a one-time DNS task.
- List every service that sends mail from your domain, including your website's contact form, invoicing tool, and newsletter platform.
- Search for a free SPF record checker online, enter your domain, and confirm each sending service shows up in the result.
- Ask each sending service for its DKIM setup instructions, since the exact steps differ by provider.
- Add a DMARC record for your domain, starting with a policy of p=none so you can watch reports before setting anything stricter.
- Confirm the domain in your From: header matches either your SPF domain or your DKIM domain.
- If you send newsletters, check that your email platform adds one-click unsubscribe headers to marketing messages.
- Sign up for Google Postmaster Tools to track your spam rate going forward.
Our team can set up records like these as part of a website build, and our web development services cover the rest of your setup.
Frequently asked questions
Why do my invoices go to spam? They can go to spam when your domain does not have SPF, DKIM, and in many cases DMARC set up. Gmail and Yahoo now verify who sends mail from the domain in the From: line.
Do small businesses need SPF and DKIM too? Yes. Google's sender guidelines say every sender who mails personal Gmail accounts must set up SPF or DKIM, and Yahoo sets a similar bar for bulk senders with both SPF and DKIM.
Do invoices need one-click unsubscribe? No. The guide says invoices and contact-form notifications count as transactional mail, so that rule does not apply to them. Newsletters and promotions do need one-click unsubscribe.
