Starting in 2025, the major mailbox providers began enforcing more specific requirements for incoming email. The goal is to prevent spam, fraud, impersonation, and other undesirable email from reaching their users' inboxes. This article covers those requirements and how domain owners can meet them.
Requirements
| Sender | Bulk sender (5,000+ messages per day) |
|---|---|
|
|
The 5,000-message threshold is the definition Google uses for bulk senders to Gmail. Other mailbox providers have similar requirements, but the details and enforcement can differ. Review the current guidance from Google and Yahoo.
1. Implement SPF
Sender Policy Frameworkis one of the two email authentication mechanisms. It is based on listing the servers that are allowed to send email for a domain.
Domain owners publish an SPF policy as a TXT record. When a mailbox provider receives an email, it checks whether the message came from a valid source for that domain.
v=spf1 include:_spf.google.com ip4:1.2.3.4 ~all
When email is sent by a third-party service for a domain, such as Mailchimp or HubSpot, the vendor usually provides an
includemechanism that domain owners can use in their policy. Setting up SPF involves making a list of all services that send email for your domain and finding the appropriate mechanisms. A service like dmarcdefender.io can also generate a policy from DMARC reports.
2. Implement DKIM
DomainKeys Identified Mailis the second email authentication mechanism. It is based on cryptographically signing emails.
When registering with a new email vendor, such as Mailchimp, HubSpot, Google, or Microsoft, they will generate a public/private key pair and ask you to save the public key in your DNS. The record is usually published at
selector._domainkey.company.com.v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADC...
When that vendor sends email as your domain, it signs the message with the private key. The receiving mailbox provider can then check the public DNS record and verify that the signature is valid.
Ensuring DKIM is set up involves working with each vendor you use to make sure DKIM is correctly enabled. It is also a good idea to use a separate selector for each vendor so that keys can be rotated or removed independently.
3. Implement DMARC
Domain-based Message Authentication, Reporting, and Conformanceis the policy that sits on top of SPF and DKIM. It decides what to do with unauthorized email and provides reporting to understand how effective the policy is.
v=DMARC1; p=reject; rua=mailto:stuart@company.com
In a DMARC policy, you can specify p=none, p=quarantine, or p=reject. For the purposes of meeting the sender requirements, any of them work, including p=none, which means that unauthenticated email is not quarantined or rejected by the DMARC policy. It is highly recommended to move toward quarantine or reject after monitoring your reports.
DMARC also has reporting. With reporting enabled, mailbox providers send reports every 24 hours to the email address listed in the
rua field. These reports cover the authentication status for each IP address sending email as your domain. This is a goldmine of information for ensuring that DMARC is set up properly and finding which services do not have SPF or DKIM configured.4. Spam Rates
Mailbox providers require spam complaint rates below 0.3%, which is three out of every 1,000 messages. Google recommends keeping the rate below 0.1% and avoiding a rate of 0.3% or higher. You can see your current spam rates in Google Postmaster Tools. Yahoo senders can use Yahoo's Complaint Feedback Loop.
Moving DMARC to quarantine or reject can also help reduce spam rates. Without DMARC enforcement, attackers can impersonate your domain, and if users mark those messages as spam, those complaints can count against your domain's reputation.
It is also recommended to keep your mailing list clean and make it easy to unsubscribe. This gives users a way to leave the list rather than marking your messages as spam.
5. Unsubscribe
There are two unsubscribe mechanisms that should be implemented. The different mailbox providers require different mechanisms.
- Unsubscribe links in the message body. The link may go to a preferences page, but it should be easy to unsubscribe. If the process is confusing, the user may mark the email as spam instead.
- Unsubscribe headers. Mailbox providers can use the
List-UnsubscribeandList-Unsubscribe-Postheaders to unsubscribe the user with an HTTP POST request or amailto:address. The one-click mechanism is defined inRFC 8058.
Unsubscribe headers and links are usually handled by email service providers. If you send your own email, you may need to implement this functionality yourself.
6. Reverse DNS Lookup
When a mailbox provider receives an email from an IP address, it can perform a reverse DNS lookup to find the hostname associated with the IP address. The hostname should then resolve back to the same IP address with a forward DNS lookup. This is called forward-confirmed reverse DNS.
As an example, one of my DMARC reports said that an email for my domain was sent by the IP address
204.220.184.30. You can verify the reverse and forward lookups with:dig +short -x 204.220.184.30
k30.k30.kb8c70eb.use4.send.mailgun.net
dig +short k30.kb8c70eb.use4.send.mailgun.net
204.220.184.307. Comply with RFCs
Unless you are running your own SMTP server, you probably will not need to worry about these details because your email service provider handles them. Email must comply with:
8. TLS
Mail should be sent using opportunistic TLS with STARTTLS. For most senders, this is handled by the email service provider. If you manage your own SMTP server, you need to make sure it supports TLS and is configured correctly.
MTA-STS and TLS-RPT are related technologies, but they manage TLS for incoming mail, not outbound mail.
Conclusion
For domain owners, the main requirements to worry about are:
- Setting up SPF and DKIM.
- Setting up DMARC, ideally with monitoring.
- Ensuring unsubscribe links and headers are implemented.
- Keeping spam complaint rates below 0.3%.
Ready to get started?
Start your free trial today and see how DMARC Defender can help you improve your email deliverability and protect your brand reputation.
Benefits
- Continuous deliverability monitoring
- Fulfil Google/Yahoo sender requirements
- Prevent Brand Impersonation
- Improve Deliverability