Are Your Emails Landing in Spam? Gmail and Yahoo Sender Requirements and DMARC

"Customers are not receiving our emails, they end up in spam" has become a far more common complaint since 2024. The cause is usually not your content: from 1 February 2024 Gmail and Yahoo enforce authentication rules for every sender, and stricter ones for anyone sending more than 5,000 messages a day. Microsoft announced similar requirements for Outlook.com in 2025. This article explains the rules and how to meet each one.

Rules for every sender

• SPF or DKIM must be set up. Set up both.
• The sending IP needs forward and reverse DNS (PTR) records that confirm each other: the IP's PTR resolves to a hostname, and that hostname resolves back to the same IP.
• Email must be transmitted over TLS.
• The spam rate in Gmail Postmaster Tools must stay below 0.3%; Google recommends aiming for 0.1%.
• Headers must follow RFC 5322, and the From header must not impersonate gmail.com.

Extra rules above 5,000 messages a day

• SPF, DKIM and DMARC, all three. The DMARC policy may start at p=none.
• Alignment: the domain in the From address must match the domain authenticated by SPF or DKIM. If a newsletter service sends for you, the DKIM signature must use your domain; a signature with the service's own domain fails alignment.
• One-click unsubscribe: marketing and subscription email needs the List-Unsubscribe and List-Unsubscribe-Post headers (RFC 8058) plus a visible unsubscribe link in the body. Requests must be processed within two days.

Step-by-step setup

1. SPF: one record, ten lookups

A domain may have only one SPF TXT record; two records make both invalid. Merge every sending source (hosting server, newsletter service, CRM) into one record and check that it needs no more than 10 DNS lookups. Example: v=spf1 include:_spf.fiberserver.net.tr include:service.example ~all. The Email Deliverability screen in cPanel provides the correct SPF and DKIM records for the hosting server.

2. DKIM: 2048-bit keys

Gmail requires at least 1024 bits and recommends 2048. Enable DKIM in cPanel Email Deliverability; if your DNS is hosted elsewhere, add the TXT record there. For your newsletter service, add the DKIM selector it gives you (for example s1._domainkey) as a CNAME.

3. DMARC: monitor, then tighten

TXT record at _dmarc.example.com: v=DMARC1; p=none; rua=mailto:[email protected]; adkim=r; aspf=r. Watch the reports for two or three weeks (free report readers exist); once every legitimate source passes, move to p=quarantine and then p=reject. DMARC also stops others from spoofing your domain, which is its most visible benefit.

4. PTR and TLS

If you send from your own server (a VDS), set the IP's rDNS record to your mail server's hostname in the FiberVM panel and make sure the mail server offers TLS with a valid certificate. On Fiberserver hosting servers these settings are already in place.

5. Unsubscribe and list hygiene

Check the raw source of a test email to confirm that your newsletter tool adds the one-click unsubscribe headers. Remove bounced addresses immediately and deactivate subscribers who have not opened anything for 12 months. Spam complaints always come from people who did not want the email.

6. Measure

Add your domain to Google Postmaster Tools: spam rate, domain reputation and authentication success are shown there. Check it daily during the first week after a campaign.

Separate transactional and marketing email

Order confirmations and password resets should not share a source with campaigns. Use a subdomain (news.example.com) for campaigns; if its reputation drops, transactional email is unaffected. If you want an infrastructure built for volume, with SPF/DKIM/DMARC ready and reporting included, see our SMTP email sending plans; for business mailboxes, our business email comparison helps you choose.

Quick checklist

1. One SPF record, every source included, under 10 lookups.
2. DKIM for every source, 2048 bits, signed with your own domain.
3. DMARC starting at p=none, reports monitored, then quarantine/reject.
4. PTR and forward DNS match, TLS enabled.
5. List-Unsubscribe + List-Unsubscribe-Post headers and a visible link.
6. Spam rate target of 0.1% in Postmaster Tools.
7. Separate subdomain for marketing.

If you would like us to check your records, open a support ticket with your domain name and we will review SPF, DKIM and DMARC together. For the technical details, read our SPF, DKIM and DMARC guide.

Sources

• Google: Email sender guidelines
• Yahoo: Sender best practices
• RFC 8058: One-click unsubscribe