DKIM and DMARC are now part of getting into the inbox. Gmail and Yahoo tightened their rules for bulk senders: emails need to be authenticated, unsubscribing has to be easy, and spam complaints must stay low. If you send newsletters or affiliate emails, here’s what DKIM, SPF and DMARC mean in plain English, how to set them up, and the easier route if you don’t want to touch DNS records at all.
Disclosure: this post contains affiliate links. If you sign up through them I may earn a commission.
What Gmail and Yahoo Now Expect
- Authentication: SPF and DKIM for your sending domain, and a DMARC record for bulk senders.
- Easy unsubscribe: a clear unsubscribe link, with one-click unsubscribe for marketing emails.
- Low spam complaints: keep complaint rates very low.
- Sending from a domain you control, not a free @gmail.com address, through an email service.
DKIM, SPF and DMARC Explained
SPF (Sender Policy Framework)
A DNS record listing which servers are allowed to send email for your domain.
DKIM (DomainKeys Identified Mail)
A digital signature on each email. Your domain publishes a public key in DNS; your email service signs messages with a private key; receiving servers check the signature to confirm the email really came from you and wasn’t changed on the way.
DMARC (Domain-based Message Authentication, Reporting and Conformance)
A policy that tells receiving servers what to do when SPF or DKIM checks fail:
- none: monitor only (a good starting point)
- quarantine: send failing mail to spam
- reject: block failing mail
DMARC also sends reports so you can spot problems. Cloudflare has a clear technical explanation of DMARC, DKIM and SPF.
Setting It Up Yourself
- Log in to your email service and find its domain authentication settings.
- Copy the SPF and DKIM records it gives you.
- Add them to your domain’s DNS at your registrar or web host.
- Add a DMARC record, starting with
p=none. - Verify in your email service and send a test email.
I recorded step-by-step videos for this; you can watch the setup videos here. Here’s what it looks like in practice:
The Easier Route: Let Your Email Service Handle It
If editing DNS records isn’t for you, use an email service that sends from its own authenticated domain. That’s one reason I recommend the LeadsLeap autoresponder: you can build a list and send emails without setting up DKIM and DMARC yourself. You also get capture pages, link tracking and traffic tools. See my LeadsLeap review.
I also use AWeber, which works very well, but I had to add the DNS records to my domain to send properly. Compare tools in AWeber vs GetResponse.
Other Ways to Stay Out of Spam
- Only email people who opted in.
- Send a welcome email right away so subscribers recognise you.
- Keep a consistent sender name and schedule.
- Remove inactive subscribers regularly.
- Avoid spammy subject lines and too many links.
New to email lists? My free guide The $0 Funnel walks you through building one.
DKIM and DMARC: FAQ
Do I need DMARC if I send few emails?
The strict requirements target bulk senders, but authentication improves deliverability for everyone.
Can I send from my Gmail address through an email service?
It’s increasingly unreliable. Use a domain you own, or a service that sends from its own authenticated domain.
How long do DNS changes take?
Usually minutes to a few hours, occasionally up to 48 hours.
