Email Deliverability Basics: SPF, DKIM, DMARC and Gmail's Rules

Email deliverability basics: why your first send hit spam

Email deliverability basics are the few things that decide whether your message reaches the inbox: authenticate your domain, send only to people who asked, keep complaints low, and make unsubscribing easy. For Gmail and Yahoo, the core parts are now formal sender requirements, not optional best practice ^[1][3].

If your first campaign landed in spam, or your domain got flagged, the cause is usually boring. A mailbox provider could not verify that your domain sent the message, or your list looked like a list that had not asked to be there. Gmail's sender guidelines say that starting in 2024, senders must meet its requirements to send email to personal Gmail accounts ^[1]. Yahoo's sender standards took effect in February 2024 ^[3]. Gmail's FAQ adds that starting November 2025, Gmail is ramping up enforcement on non-compliant traffic, with temporary and permanent rejections for messages that fail the requirements ^[2]. You are not the first small sender to look at a flagged domain and decide it is safer to stop sending. The way back is not a new tool; it is a short list of records and habits.

You do not need a new funnel builder to publish SPF, DKIM and DMARC. You need access to your domain's DNS settings and your email provider's authentication controls. If you have not set up a domain yet, our affiliate website setup lesson covers launching a site on a domain you control. Before you spend money on a deliverability add-on, do the free work in this guide. If you want a wider map of email as an affiliate channel, our email marketing for affiliates guide is the main-site starting point.

SPF, DKIM and DMARC in plain English

These three records answer three different questions. Once you can say what each one does, the setup screens stop looking like a foreign language.

SPF: who is allowed to send for your domain?

SPF (Sender Policy Framework) is a DNS record that lists the IP addresses allowed to send mail for your domain. Yahoo's sender guidance describes SPF records as letting a sender specify the list of IPs that are allowed to send mail for that domain ^[3]. Gmail requires all senders to set up SPF or DKIM, and bulk senders to set up both ^[1]. If you use an email service provider, make sure that provider is included in your SPF record; Gmail says messages from third-party senders that are not included in your SPF record are more likely to be marked as spam ^[1].

DKIM: is the message really from you and unchanged?

DKIM (DomainKeys Identified Mail) adds a signature to each message. Yahoo explains that DKIM signatures let it associate email with the signer and verify that the content of the email has not been changed during transmission ^[3]. Yahoo recommends a minimum 1024-bit key length ^[3]. If your email provider handles DKIM for you, verify that it is actually signing your domain's mail; Gmail says to verify that your provider authenticates your domain's email with SPF and DKIM ^[1].

DMARC: what should the receiver do when authentication fails?

A DMARC record tells the receiver what to do when neither SPF nor DKIM passes, and it ties the From: domain to those checks. Yahoo describes DMARC as a policy that says your messages are protected by DKIM and/or SPF and tells a receiver what to do if neither passes ^[3]. Gmail requires bulk senders to publish DMARC and says the enforcement policy can be set to none ^[1]. Yahoo's bulk requirements ask for a valid DMARC policy with at least p=none, strongly recommend a rua tag that is set up to receive reports, and accept relaxed alignment ^[3]. The domain in the From: header must be aligned with either the SPF domain or the DKIM domain ^[3].

What counts as a bulk sender (and why 5,000 matters)

Gmail defines a bulk sender as any sender that sends close to 5,000 messages or more to personal Gmail accounts within a 24-hour period. Messages from the same primary domain count toward that limit ^[2]. If you meet the criteria once, Gmail says you are permanently considered a bulk sender, and the status does not expire ^[2]. Subdomains count under the primary domain, so splitting your sending across promotions.yourdomain.com and yourdomain.com does not reset the count ^[2].

Gmail also defines a new domain as one that has not sent more than 5,000 emails a day to personal Gmail accounts since January 1, 2024. Enforcement for new domains will be on an accelerated timetable ^[2]. That matters if you are tempted to abandon a flagged domain and start fresh. A new domain is not a clean slate; it is a new domain with something to prove. Gmail says it updates the sender guidelines FAQ periodically, so check the current page before you rely on a threshold ^[2].

For a small affiliate list, you may never hit 5,000 messages a day. That does not make authentication optional. Gmail still requires all senders to use SPF or DKIM ^[1], and Yahoo strongly urges all senders to publish DMARC ^[3]. Starting DMARC at p=none is a sensible first step because it publishes a policy without asking receivers to quarantine or reject mail before you have checked your own sending ^[1][3].

A 30-minute authentication setup checklist

This is the order we would use on a small domain. It is deliberately unglamorous. Do it once, write down what you changed, and keep the notes with your domain login.

1. Find the DNS account for the domain you actually send from. If your email provider gives you a branded sending domain, that is the domain to authenticate. Do not publish records for a domain you do not control.
2. Turn on SPF or DKIM in your email provider. Gmail requires all senders to set up SPF or DKIM; bulk senders must set up both ^[1]. Most providers have a wizard that publishes the records for you, but you still need to check the result.
3. Check that your SPF record includes every service that sends mail for you. Gmail says the SPF record for your domain must include all email senders; third-party senders that are not included are more likely to be marked as spam ^[1].
4. Create a DKIM key and publish the public part. Yahoo recommends a minimum 1024-bit key length ^[3]. If your provider offers a longer key, use it; the minimum is what the guidance names.
5. Publish a DMARC record starting at p=none. Gmail says a bulk sender's DMARC policy can be set to none ^[1]. Yahoo's bulk rule requires at least p=none and strongly recommends a rua tag so you can receive reports ^[3]. Use a reporting address you actually read.
6. Check alignment before you tighten the policy. The From: domain must align with either the SPF domain or the DKIM domain ^[3]. If your provider sends as yourdomain.com but signs as provider.com, ask the provider how alignment is handled before you move DMARC past p=none.
7. Verify the sending IP has valid forward and reverse DNS. Yahoo requires a valid forward and reverse DNS record for your sending IPs ^[3]. Gmail requires that sending IP addresses have a PTR record ^[1]. If you use a shared email service provider, the provider normally manages this; ask support if you are unsure.
8. Send through TLS. Gmail requires a TLS connection for transmitting email ^[1]. Most providers do this by default, but confirm it rather than assume it.
9. Check Postmaster Tools. Gmail says to use Postmaster Tools to monitor information about messages sent from your domain to Gmail accounts ^[1]. Gmail's FAQ also mentions a compliance status dashboard in Postmaster Tools ^[2].
10. Change one thing at a time. If you get a Gmail error code, use the code to find the failed piece rather than guessing ^[2]. A calm change log beats a frantic afternoon of toggling settings.

When your domain is already flagged: a triage plan

A flagged domain feels like a verdict. It is usually a diagnosis with a code attached. Work from the specific error outward.

• Read the error code first. Gmail publishes codes such as 5.7.27 for SPF failure, 5.7.30 for DKIM failure, 4.7.31 for a missing or invalid DMARC record, and 5.7.25 for a missing PTR record ^[2]. The code tells you which layer failed.
• Check your domain's safety status. Gmail says to check regularly that your domain is not listed as unsafe with Google Safe Browsing ^[1]. If your site is verified in Search Console, also glance at its Security issues report; our Google Search Console guide for beginners shows where it sits.
• Lower volume and send to engaged users. Gmail recommends starting with a low sending volume to engaged users and slowly increasing the volume over time, while monitoring server responses, spam rate and the sending domain's reputation ^[1].
• Check your affiliates and third-party senders. Gmail's affiliate marketing section says spammers can abuse affiliate programs, and if your brand is associated with marketing spam, other messages you send might be marked as spam. It recommends monitoring affiliates and removing any that send spam ^[1].
• Stop any purchased or scraped list sending. Yahoo says not to purchase mailing lists or subscribe users by having an opt-in checkbox automatically checked on your website ^[3].
• Do not send test phishing campaigns from your domain. Gmail says not to send test phishing messages or test campaigns from your domain ^[1].
• Do not treat a new domain as a shortcut. Gmail says enforcement for new domains will be on an accelerated timetable ^[2]. Fix the cause before you move.

If you are stuck, use Gmail's troubleshooting path for delivery issues ^[1] and ask your email provider for the exact authentication results on a recent message. A support ticket with the error code, the sending domain and the time of the send is more useful than my email goes to spam.

List hygiene: the part that actually keeps complaints low

Authentication gets you past the front door. List hygiene keeps you out of the spam folder after you are inside. This is the part affiliate marketers skip when they are in a hurry to send the next offer.

• Keep spam complaint rates below 0.3%. Gmail says to keep spam rates reported in Postmaster Tools below 0.3% ^[1]. Yahoo says to keep your spam rate below 0.3% ^[3].
• Use confirmed opt-in. Yahoo recommends sending a confirmation email and asking users to click to confirm their opt-in; this reduces accidental signups and fake addresses ^[3].
• Honor unsubscribes within 2 days. Yahoo's bulk requirements include a functioning list-unsubscribe header that supports one-click unsubscribe, and it says requests should be processed within 2 days ^[3]. Gmail's one-click unsubscribe requirement uses List-Unsubscribe headers as described in RFC 8058, with one HTTPS URL in the List-Unsubscribe header ^[2].
• Do not buy lists. Yahoo explicitly says not to purchase mailing lists or subscribe users with a pre-checked opt-in box ^[3].
• Remove invalid recipients. Yahoo says to monitor hard and soft bounces and inactive recipients, remove invalid recipients promptly, and consider a reconfirmation email to inactive subscribers periodically ^[3].
• Use complaint feedback loops. Yahoo says an active complaint feedback loop is needed for all DKIM domains and can help you process complaints quickly and stay below 0.3% ^[3].
• Do not judge by open rates. Gmail says it does not track open rates, cannot verify the accuracy of open rates reported by third parties, and that low open rates are not necessarily an accurate indicator of deliverability or spam classification issues ^[1]. Watch complaints, bounces and authentication failures instead.

A monthly 15-minute deliverability check

Put this in your calendar once a month. It is shorter than watching another hour of tool reviews, and it tells you whether your setup is still doing its job.

Affiliate links, disclosures and the rules that still apply

Deliverability rules do not replace advertising rules. If you put affiliate links in email, you still need to comply with CAN-SPAM. Yahoo says to adhere to CAN-SPAM regardless of where in the world you are sending, and that it gives recipients the right to have you stop emailing them ^[3]. Our guide to affiliate links in emails and CAN-SPAM basics covers the practical side.

A clear disclosure is worth considering. Our FTC affiliate disclosure examples for blogs, email and video show where the disclosure goes without turning the email into a legal notice. If you are writing the first few emails after signup, our five-email welcome sequence template can keep those sends useful rather than pushy. And if your opt-in offer is weak, the problem may be the offer rather than the inbox; lead magnet ideas for affiliate sites covers that.

One more affiliate-specific recommendation from Gmail, aimed at brands that run affiliate programs: regularly monitor your affiliates and remove any that send spam, because if your brand is associated with marketing spam, other messages you send might be marked as spam ^[1].

A note on trust: what we can and cannot tell you

We are an education site, not your email provider. We cannot see your domain, your DNS records or your Postmaster Tools data, and we cannot promise a particular inbox placement. We also do not have a lab full of inboxes, so we will not pretend we have personally checked every email tool on the market. What we can do is quote the official sender guidelines, show where each rule comes from, and give you a checklist you can run before you spend anything.

We may earn a commission if you buy through some links. That is how affiliate education sites usually make money, and we would rather say it plainly than hide it. It does not change the facts above, and you do not need to buy a new tool to do the work in this guide. SPF, DKIM and DMARC are DNS records, not software subscriptions. The fear of pouring money into the wrong tool is reasonable. The work in this guide is mostly DNS and list habits, not a software purchase. If a product tries to sell you deliverability before you have fixed authentication, ask what specific problem it solves. If a record change affects a live business domain and you are unsure, ask your email provider's support or a qualified professional before you publish it.

This guide is general education. Program terms and tools change; check the linked official pages for the current version. How we write: editorial policy. This page has no affiliate links.