Email authentication: the 2025 SPF, DKIM and DMARC checklist for Gmail, Yahoo and Outlook
Email authentication proves to a receiving mailbox that a message really came from your domain and was not altered on the way. Three records do the work: SPF lists the servers allowed to send for your domain, DKIM adds a tamper-proof signature, and DMARC tells receivers what to do when a message fails and sends you reports. Since 2024, Gmail and Yahoo require bulk senders to pass all three. Microsoft Outlook added the same requirement for high-volume senders in May 2025. If your mail fails authentication, it goes to spam or is rejected.
What SPF, DKIM and DMARC each do
- SPF (Sender Policy Framework): a DNS TXT record listing the servers and services allowed to send email for your domain. The receiver checks the sending server against this list.
- DKIM (DomainKeys Identified Mail): a cryptographic signature added to each message. The receiver uses your published public key to confirm the message was signed by your domain and not changed in transit. DKIM survives forwarding; SPF does not, which is why aligned DKIM is the more resilient signal.
- DMARC (Domain-based Message Authentication, Reporting and Conformance): a policy record that tells receivers what to do with mail that fails SPF and DKIM (p=none = monitor only, p=quarantine = send to spam, p=reject = block), and where to send aggregate reports. DMARC also requires alignment: the domain in the visible From: address must match the SPF or DKIM domain.
What Gmail, Yahoo and Outlook require (2025)
“Bulk / high-volume sender” is roughly 5,000+ messages a day to that provider's users.
| Requirement | Gmail (bulk) | Yahoo (bulk) | Outlook (high-volume, from 5 May 2025) |
|---|---|---|---|
| SPF | Required | Required | Required |
| DKIM | Required | Required | Required |
| DMARC record | Required, min p=none | Required, min p=none | Required, min p=none |
| DMARC alignment | SPF or DKIM aligned | SPF or DKIM aligned | SPF or DKIM aligned |
| One-click unsubscribe (marketing mail) | Required, honor within 48h | Required, honor within 2 days | Recommended |
| Spam complaint rate | Keep below 0.3% | Keep below 0.3% | Monitored |
| Valid forward + reverse DNS, TLS | Required | Recommended | Recommended |
- •All senders (not just bulk) must authenticate with at least SPF or DKIM.
- •Gmail began ramping enforcement on non-compliant traffic from November 2025; non-compliant mail faces temporary then permanent rejection.
- •Outlook's May 2025 rollout moves non-compliant high-volume mail to Junk first, with rejection to follow in a later phase. Sources differ on the exact rejection timing; verify against Microsoft's own post before quoting a hard date.
- •Yahoo does not publish a fixed volume threshold; the roughly 5,000-a-day figure is Gmail's.
How to check whether your email passes
- 1Publish SPF, DKIM and DMARC records at your DNS host (your email provider documents the exact values).
- 2Send a real campaign and confirm it passes authentication as actually sent, not just that the records exist. A record can be published and still fail because of alignment or a mis-signed message.
- 3Watch Gmail Postmaster Tools and your DMARC aggregate reports for your pass rate and spam-complaint rate.
Confirm your real message passes, before you send
Testicly checks the message you actually send. Send your campaign to a Testicly test address and you get your SPF, DKIM and DMARC results, content and spam-word analysis, and a deliverability score before you send to your list. Testicly does not change your DNS for you, and it does not run multi-provider seed inbox-placement tests. It confirms your real message authenticates correctly so a bulk-sender rule does not send it to spam.
Test my email freeFrequently asked questions
Do I need SPF, DKIM and DMARC, or just one?
All senders should have at least SPF or DKIM. If you send about 5,000 or more messages a day to Gmail, Yahoo or Outlook users, you need all three, with a DMARC policy of at least p=none.
What is the minimum DMARC policy I can use?
p=none. It monitors and reports without affecting delivery. Move to p=quarantine or p=reject once your reports show your legitimate mail passes.
Why does my email fail DMARC even though SPF passes?
DMARC needs alignment: the domain in your From: address must match the SPF or DKIM domain. A passing SPF check on a different domain does not satisfy DMARC.
What counts as a bulk or high-volume sender?
Roughly 5,000+ messages a day to one provider's users. Gmail treats crossing that line once as permanent bulk-sender status. Yahoo does not publish a number.
How do I know my message passes before I send it?
Send it to a checker that runs the authentication checks on the real message. Testicly returns your SPF, DKIM and DMARC results plus a deliverability score, so you can verify your sent message passes SPF/DKIM/DMARC before it reaches your list.