Your invoices, OTPs or newsletters keep landing in spam, or Gmail bounces them with an error like 550-5.7.26. In 2026 the most common reason is simple: your domain is missing, or has broken, SPF, DKIM and DMARC records. Gmail, Yahoo and Microsoft Outlook.com now enforce these for bulk senders, and use them to judge everyone else.
This guide explains what each record does, the current rules from each provider, and how to set them up step by step, whether you use Google Workspace, Microsoft 365 or a hosting mail server.
Quick answer: Add three DNS TXT records for your domain: an SPF record listing who may send (only one SPF record per domain), a DKIM key from your email provider, and a DMARC record starting with v=DMARC1; p=none; rua=mailto:you@yourdomain.com. Make sure the From domain aligns with SPF or DKIM, read the DMARC reports for 2–4 weeks, then move to p=quarantine and later p=reject. Bulk senders (about 5,000+ emails a day) also need one-click unsubscribe and a spam rate under 0.3%.
Last updated: November 12, 2026.
Table of contents
- SPF, DKIM and DMARC in plain English
- 2026 rules: Gmail, Yahoo, Outlook.com
- How a receiving server checks your email
- Step 1: Set up SPF
- Step 2: Turn on DKIM
- Step 3: Publish DMARC
- Step 4: Test and read reports
- Common errors and fixes
- FAQ
SPF, DKIM and DMARC in plain English
| Record | What it does | Analogy |
|---|---|---|
| SPF | A TXT record listing the servers and services allowed to send email for your domain | The guest list at the gate |
| DKIM | Adds a digital signature to each email; the receiver checks it with a public key in your DNS | A tamper-proof seal on the envelope |
| DMARC | Tells receivers what to do if SPF/DKIM fail or don't match your From address, and sends you reports | The security guard's instructions |
Not sure what a TXT record is? See our guide to Outlook not receiving emails for more mail troubleshooting.
2026 rules: Gmail, Yahoo, Outlook.com
- Google and Yahoo started enforcing sender requirements in February 2024. Bulk senders (close to 5,000 messages a day to personal Gmail accounts) need SPF, DKIM, DMARC (at least
p=none) with alignment, one-click unsubscribe for marketing mail, and a spam complaint rate below 0.3% (aim for under 0.1%). - Gmail moved to stricter enforcement from November 2025, including outright rejection of non-compliant bulk mail (errors like
550-5.7.26). - Microsoft Outlook.com (outlook.com, hotmail.com, live.com) began enforcing similar rules for high-volume senders on May 5, 2025, rejecting non-compliant bulk mail.
- Everyone else: even if you send 50 emails a day, providers use these checks to decide inbox vs spam. Every domain should have all three.
How a receiving server checks your email
Step 1: Set up SPF
Add one TXT record at your domain root (@) that lists every service that sends mail as you.
| If you use | SPF record |
|---|---|
| Microsoft 365 | v=spf1 include:spf.protection.outlook.com -all |
| Google Workspace | v=spf1 include:_spf.google.com ~all |
| Both, plus a mailing tool | v=spf1 include:spf.protection.outlook.com include:_spf.google.com include:(your tool's value) -all |
- Only one SPF record per domain. Two
v=spf1records break SPF. Merge them. - 10 DNS lookup limit. Each
includecounts. Too many and SPF fails with "permerror". -allmeans "reject everyone else";~allis a softer fail. Use whichever your provider recommends.
Step 2: Turn on DKIM
DKIM keys come from your email provider. You publish them in DNS, then switch signing on.
- Microsoft 365: Microsoft Defender portal > Email & collaboration > Policies > Threat policies > Email authentication settings > DKIM. Select your domain, publish the two CNAME records it shows (selector1 and selector2), then enable signing.
- Google Workspace: Admin console > Apps > Google Workspace > Gmail > Authenticate email. Generate a 2048-bit key, add the TXT record (usually
google._domainkey), then click Start authentication. - Mailing tools (newsletters, CRM, billing): each has its own DKIM setup. Do it for every tool that sends as your domain.
Step 3: Publish DMARC
Add a TXT record named _dmarc:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; adkim=r; aspf=rp=none: monitor only. Start here so nothing legitimate is blocked.rua=: where daily aggregate reports go. Use a mailbox you'll read, or a free DMARC report viewer.- Alignment: DMARC passes only if SPF or DKIM passes and uses the same domain as your visible From address. A newsletter tool sending "From: you@yourdomain.com" but signing with its own domain will fail DMARC until you set up its custom DKIM.
Rollout plan:
- Weeks 1–4:
p=none. Read reports and fix every legitimate sender. - Next:
p=quarantine; pct=25, then raisepctto 100. - Finally:
p=reject. This also stops attackers spoofing your domain in phishing emails.
Step 4: Test and read reports
- Check the records with nslookup:
nslookup -type=txt yourdomain.com nslookup -type=txt _dmarc.yourdomain.com - Send an email to a Gmail address, open it, choose Show original and look for SPF: PASS, DKIM: PASS and DMARC: PASS.
- Read the DMARC aggregate reports weekly. Unknown sending IPs are either a tool you forgot, or someone spoofing you.
Microsoft 365 admins can also hunt failing messages with the EmailEvents table in Defender advanced hunting.
Common errors and fixes
| Problem | Fix |
|---|---|
Gmail bounce 550-5.7.26 | Your mail failed authentication. Add/fix SPF and DKIM, publish DMARC, check alignment. |
SPF permerror | Two SPF records, or more than 10 DNS lookups. Merge records, remove unused includes. |
DKIM fail or none | Signing not enabled, wrong selector, or key not published yet. Wait for DNS, then re-enable. |
| DMARC fails but SPF passes | SPF passed for the tool's own domain, not yours. Set up custom DKIM for that tool. |
| Forwarded mail fails SPF | Normal. DKIM survives forwarding, so make sure DKIM is on. |
FAQ
Do I need SPF, DKIM and DMARC if I send only a few emails?
Yes. The strict bulk-sender rules start around 5,000 emails a day, but every provider uses these checks to filter spam and spoofing.
Which DMARC policy should I start with?
p=none with reporting. Move to quarantine and then reject once all your real senders pass.
Can I have two SPF records?
No. Combine all services into one v=spf1 record.
Does DMARC stop phishing emails that pretend to be my company?
At p=reject, it stops emails that spoof your exact domain. It can't stop look-alike domains, so train users too. See what to do after clicking a phishing link.
How long do DNS changes take?
Usually minutes to a few hours, depending on the record's TTL.
What is one-click unsubscribe?
A header (RFC 8058) that lets Gmail and Yahoo show an "Unsubscribe" button. Bulk marketing senders must support it and honour requests within 2 days.
Sources: Red Sift bulk email sender requirements guide, Ironscales on Gmail's November 2025 enforcement and Microsoft's May 5, 2025 Outlook.com requirements, and Microsoft Tech Community's Outlook announcement. Checked on November 12, 2026.
){kind=link}
0 Comments