Staying out of spam: authentication and list hygiene

You can write a great email and still have it land in spam. Whether it reaches the inbox depends on two things: whether mailbox providers can confirm it really came from you (authentication), and whether recipients seem to want it (reputation). You control both.

This guide covers what Gmail, Yahoo and Microsoft now require from senders, and the list habits that keep your reputation healthy.

Part 1: Authentication

Authentication proves your emails come from you. Three DNS records do the work.

SPF lists the services allowed to send email for your domain. See SPF records, explained.
DKIM adds a digital signature to each email, which the receiving server checks against a public key in your DNS. See DKIM records, explained.
DMARC tells receiving servers what to do when an email fails those checks, and sends you reports. It also requires alignment: the domain in the visible "From" address must match the domain that passed SPF or DKIM. See DMARC records, explained.

SPF and DKIM are two separate checks on the same email: one on the sending server, one on the signature. DMARC is not a third check: it is the policy that tells receiving servers what to do with emails that fail SPF or DKIM.

Read this as text

An email arrives claiming to be from your domain. The receiving mail server runs two checks on it. SPF checks the envelope: is this mail server on the approved list? DKIM checks the letter: was this email signed by the claimed domain, and is the signature still intact?

If both checks pass, the email has been authenticated and there is nothing for your DMARC policy to act on. Authentication on its own is not a promise of the inbox: spam filters also weigh things like your message content.

If either check fails, your DMARC policy tells the receiving server what to do. A policy of none delivers the email anyway and sends reports to you as the domain owner. Quarantine puts it in the spam or junk folder. Reject blocks it entirely, so it never reaches the recipient.

Authenticate your email platform

When you connect Mailchimp, Klaviyo, Kit, Beehiiv or similar, the platform will ask you to verify your domain and add DNS records, usually for DKIM and sometimes a custom return-path for SPF. Do this. Without it, the platform signs your email with its own domain, and DMARC alignment fails for your From address.

Find the domain authentication settings in your email platform. The name varies: "domain authentication", "sending domain", "verify domain".

Add the records it gives you at your DNS provider, exactly as shown. If you're not sure where your DNS is managed, see where is my domain registered?

Check your SPF record. You can only have one SPF record per domain. If your platform asks you to add to SPF, merge it into your existing record rather than creating a second one.

Add a DMARC record if you don't have one. Starting with a monitoring policy (p=none) is fine. Review the reports, then tighten the policy once all your legitimate senders pass.

Verify it works. Most platforms show a green check once records are found. You can also send a test to Gmail, open it, and use "Show original" to see whether SPF, DKIM and DMARC passed.

Don't send from a free address

Sending marketing email "from" a Gmail, Yahoo or Outlook.com address through a platform fails DMARC, because those providers publish strict DMARC policies. Always send from your own domain.

Part 2: The 2024 Gmail and Yahoo requirements

In February 2024, Google and Yahoo started enforcing new sender requirements. They split them into rules for everyone and extra rules for bulk senders.

For all senders

Google's guidelines say anyone sending to personal Gmail accounts must:

Requirements for all senders

0 of 5 done

Set up SPF or DKIM for their sending domain.
Have valid forward and reverse DNS for their sending servers. Your email platform handles this.
Use a secure (TLS) connection to send. Again, the platform handles this.
Keep spam rates reported in Postmaster Tools below 0.3%.
Format messages according to internet email standards.

Saved in this browser only.

For bulk senders

Google defines a bulk sender as one that sends close to 5,000 or more messages to personal Gmail accounts in a day, and says that once a domain reaches that level it's treated as a bulk sender from then on. Bulk senders must also:

Extra requirements for bulk senders

0 of 4 done

Set up SPF and DKIM and DMARC. A DMARC policy of p=none meets the requirement.
Make sure the From domain aligns with the SPF or DKIM domain.
Support one-click unsubscribe for marketing and subscribed messages (the technical standard is called RFC 8058), and include a clearly visible unsubscribe link in the message body.
Process unsubscribe requests within two days.

Saved in this browser only.

Yahoo published closely matching requirements for bulk senders: authenticate with SPF and DKIM, publish a DMARC policy of at least p=none, support one-click unsubscribe and honor it within two days, and keep spam complaints below 0.3%.

Microsoft followed in 2025 with similar authentication requirements for domains sending more than 5,000 emails a day to Outlook.com, Hotmail and Live addresses.

What this means for you: even if you're well below 5,000 emails a day, set up all three records and use a platform that supports one-click unsubscribe. All the major email marketing platforms do. Google recommends SPF, DKIM and DMARC for every sender, and you'll be ready if your list grows.

Part 3: List hygiene

Authentication gets you through the door. Reputation decides whether you stay in the inbox. Mailbox providers watch how people react to your emails: do they open, reply, move you out of spam, or mark you as spam?

Only email people who asked. Never buy, rent or scrape a list. See building your list.
Use double opt-in if bots or typos are a problem. It keeps fake addresses and spam traps out.
Remove hard bounces. Your platform does this automatically, but don't re-import them.
Re-engage or remove inactive subscribers. People who haven't clicked or bought in six to twelve months drag your engagement down. Send a short "still interested?" email, then remove those who don't respond. Because Apple Mail Privacy Protection inflates opens, base "inactive" on clicks or purchases. See reading your email metrics.
Make unsubscribing easy. A hidden or broken unsubscribe link pushes people to the spam button instead, which hurts you far more.
Send consistently. Long silences followed by a big send look suspicious to filters, and recipients forget who you are.
Set expectations at sign-up and stick to them. Sending daily when you promised monthly drives complaints.

Content still matters, a bit

Modern filters rely mostly on authentication and engagement, but some habits still help:

Use a recognizable from name and a subject line that matches the content.
Avoid misleading subject lines. They're also against the FTC's CAN-SPAM rules.
Keep a sensible balance of text and images. An email that's one big image gives filters, and screen readers, nothing to read.
Use link shorteners sparingly; some are associated with spam.

If you're already in spam

Check authentication first. Send a test to Gmail and check "Show original" for SPF, DKIM and DMARC passes.

Check your complaint rate in your platform and in Google Postmaster Tools.

Look at recent changes. A new platform, a new list import, or a sudden increase in volume are common triggers.

Send only to your most engaged subscribers for a few weeks, then gradually widen.

If your everyday business email (not just marketing) is going to spam, see my email is going to spam.

Frequently asked questions

Should I use a subdomain for marketing email?

Some businesses send marketing from a subdomain, such as news.yourbusiness.com, to separate its reputation from everyday email. It can help larger senders. For most small businesses, correct authentication and good list habits matter more.

Does my email platform handle all of this?

It handles the servers, TLS and one-click unsubscribe. You still need to add DNS records for your own domain, and you're responsible for your list.