SPF, DKIM and DMARC for newsletter senders

Set up all three on the domain you send from, and keep your spam complaints low. Google and Yahoo ask bulk senders for SPF, DKIM and DMARC. Microsoft asks the same of high-volume senders to Outlook.com. If you send a newsletter from your own domain, you will cross those lines as your list grows, so it is easier to do it before you do.

What each record does

SPF lets the owner of a domain publish which servers may send mail for it. RFC 7208 defines it, and a receiving server checks the sending server against that list.

DKIM adds a cryptographic signature to each message. The sender signs, and the receiver checks the signature against a public key published in the sender's DNS. RFC 6376 defines it. Google asks for keys of at least 1024 bits and recommends 2048.

DMARC is the policy on top. The owner of the domain in the From address publishes what receivers should do with mail that fails validation, and asks for reports. RFC 9989, published in May 2026, is the current definition; it obsoletes RFC 7489, which most older guides cite.

DMARC passes when SPF or DKIM passes and the domain it passed for matches the domain in the From address. That match is called alignment. Google's FAQ says only one of the two has to align, and says aligning both will likely become a requirement later.

What the mailbox providers ask for

This is what each provider's own page says, read on October 21, 2026. These pages change, so read the current one before you rely on a line.

Gmail's rules apply to mail sent to personal Gmail addresses, not to Google Workspace recipients. Microsoft's apply to the consumer service, which covers outlook.com, hotmail.com and live.com addresses. Yahoo tells senders to use its complaint feedback loop, which reports complaints back to you.

Google's FAQ says enforcement on non-compliant traffic ramps up from November 2025, with temporary and permanent rejections. Microsoft's post says non-passing mail from high-volume senders goes to Junk from May 5, 2025.

A first DMARC record

A DMARC record is a TXT record at _dmarc. followed by your domain. This one asks receivers for reports and asks them to do nothing special with failures, which is the minimum the providers name:

Replace the address with a mailbox you read, on a domain you control. Yahoo recommends including a reporting address. Read the reports for a while to see every service that sends mail as your domain, such as your support desk and your billing system, and fix any that fail before you move to a stricter policy.

The ten-lookup trap in SPF

Every service you add to your SPF record with include: costs DNS lookups, and so do a, mx, ptr, exists and redirect. RFC 7208 stops evaluation at ten and gives a permanent error, which fails SPF. Microsoft's post warns of the same limit. A domain that sends from a newsletter platform, a CRM, a help desk and a billing tool can reach it without noticing.

DKIM does not have this limit, and DMARC needs only one of the two to pass and align, so a platform that signs your mail with DKIM on your own domain keeps you covered if SPF breaks. Keep SPF records short, and remove services you no longer use.

The order to do it in

1. Send from a domain you own. You can only publish records for a domain you control.
2. Add the DKIM and SPF records your sending platform gives you. Both go in your DNS provider.
3. Publish a DMARC record at p=none, with a reporting address.
4. Read the reports, and fix any service that sends as your domain without passing.
5. Check that your unsubscribe works in one click and takes effect within the time above.
6. Watch your spam rate in Google Postmaster Tools. Keep it below 0.10%.

Tightening DMARC to quarantine or reject is optional. None of the three provider pages we read requires it.

Setting it up on FlockStack

On FlockStack, adding a domain on the Domains page lists the DNS records to add. Emails sent from the domain are signed with DKIM, and bounces return to a subdomain of it. When you press Check, FlockStack asks the email provider and DNS whether the records are in, and looks up the DMARC record of the domain or its parent. The API documentation describes the same steps for agents and scripts. Newsletters can send from the domain once it is verified.

FlockStack's first sends to a list also go out in steps, to build a reputation before the whole list gets the issue. That is a separate thing from authentication, and the migration guides explain it.

What this post leaves out

It reports what Google, Yahoo and Microsoft publish, and does not say how any of them filters mail beyond that. Passing these checks does not guarantee delivery, and no page we read promises it. This is not legal or compliance advice.