In February 2024 Google and Yahoo started enforcing new rules for anyone sending large volumes of email to their users. Microsoft announced similar requirements for Outlook.com consumer addresses, taking effect in 2025. Together these providers handle a large share of the world's personal inboxes.
The rules
For senders of more than about 5,000 messages a day to Gmail, the requirements are:
- Authenticate mail with both SPF and DKIM.
- Publish a DMARC policy, at least p=none, and make sure the From domain aligns with SPF or DKIM.
- Offer one-click unsubscribe in marketing mail and honour requests within two days.
- Keep the spam complaint rate reported in Google Postmaster Tools below 0.3%.
Smaller senders are not exempt from the basics: every sender is expected to have SPF or DKIM, valid forward and reverse DNS for sending servers, and TLS for transmission.
Why it matters even if you are not a marketer
Invoices, password resets, order confirmations and system alerts all depend on reaching the inbox. If your domain is not authenticated, these messages can land in spam or be rejected outright, and you may not notice until a customer complains. Missing DMARC also makes it easier for criminals to send phishing that appears to come from your domain.
A checklist for your domain
- List every service that sends mail as your domain: your mail server, CRM, invoicing tool, website, helpdesk.
- Publish one SPF record that includes all of them, and stay within the 10 DNS lookup limit.
- Enable DKIM signing on each service and publish its keys.
- Publish DMARC with p=none and a reporting address, then read the reports.
- Once legitimate mail passes, move to p=quarantine and then p=reject.
How IDX helps
IDX hosting includes DNS zone management, where you publish the SPF, DKIM and DMARC records your domain needs, including those for third-party senders. Our team can review your setup and walk you from monitoring to full enforcement without losing legitimate mail.
IDX on digital infrastructure
Back to blog →