New Email Sending Requirements: DKIM, SPF, and DMARC
New email sending requirements from Google and Yahoo went into effect on February 1, 2024, changing what businesses need to do before sending newsletters, email campaigns, and automated messages from their domain.
If your company owns its domain, self-authentication helps your “from address” match your domain, protects your sender reputation, and improves trust with inbox providers.
What Are the New Email Sending Requirements?
The new email sending requirements are rules from major inbox providers that require stronger domain authentication, lower spam complaint rates, and clear unsubscribe options. Businesses that send newsletters, marketing campaigns, CRM messages, lead magnet emails, or website form notifications should review SPF, DKIM, DMARC, their DNS records, and their email marketing platform settings.
Helpful tool: You can check whether your domain has a DMARC record using the free MXToolbox DMARC Lookup. If you are not comfortable editing DNS, ask your IT provider, web company, or email marketing provider for help before making changes.
Why Did Google and Yahoo Change Email Sending Rules?
Google and Yahoo tightened sender requirements to reduce spam, phishing, spoofing, and unwanted email. Authentication helps inbox providers verify whether a message really came from the domain shown in the “From” address.
For businesses, this means email marketing can no longer be treated as “just send it from any platform.” Your domain reputation, DNS records, email provider, and unsubscribe process all matter.
Who Needs to Pay Attention?
Any business that sends newsletters, email campaigns, automated follow-ups, lead magnet emails, CRM emails, or website-generated emails should review their setup.
Small businesses sending newsletters
If you use Constant Contact, Mailchimp, MailerLite, HubSpot, or another platform, domain authentication matters.
Websites sending forms or automations
WordPress forms, CRM notifications, lead magnets, and autoresponders should be sent through a properly authenticated service.
Bulk or frequent senders
If you send higher volumes, authentication, spam complaint rates, and unsubscribe requirements become even more important.
What Do SPF, DKIM, and DMARC Mean?
These three records work together to prove that your emails are legitimate and authorized to come from your domain.
What is SPF?
SPF stands for Sender Policy Framework. It is a DNS record that identifies which mail servers are allowed to send email for your domain.
If your business sends through Microsoft 365, Google Workspace, Constant Contact, Mailchimp, HubSpot, or another platform, your SPF setup needs to account for authorized senders.
What is DKIM?
DKIM stands for DomainKeys Identified Mail. It adds a digital signature to outgoing messages so receiving inboxes can verify that the email has not been altered and is connected to your domain.
Many email platforms provide DKIM records that must be added to your DNS settings.
What is DMARC?
DMARC stands for Domain-based Message Authentication, Reporting, and Conformance. It tells receiving mail servers what to do when a message fails authentication.
Many businesses start with a monitoring policy such as p=none, review results, then move to stronger policies later.
How Do I Check If My Domain Has DMARC?
The easiest first step is to look up your domain’s DMARC record. This does not change anything. It simply helps you see whether a DMARC record exists.
Use MXToolbox DMARC Lookup
Enter your domain into the free MXToolbox tool to see whether a DMARC record is published.
Check where your DNS is hosted
Your DMARC, DKIM, and SPF records are usually added where your domain’s DNS is managed, such as Cloudflare, GoDaddy, Network Solutions, SiteGround, or another provider.
Do not create duplicate SPF records
A domain should generally have one SPF record that includes authorized senders. Multiple SPF records can cause authentication problems.
How Do I Add DKIM, SPF, and DMARC for Microsoft 365?
Adding DKIM, SPF, and DMARC to Microsoft 365 helps protect your domain from spoofing and phishing. The exact screens can change, but the general process is usually handled through Microsoft Defender, Exchange admin, and your DNS provider.
Enable DKIM in Microsoft Defender
Go to the Microsoft Defender portal at https://security.microsoft.com/. Locate the email authentication or DKIM settings, choose your domain, and enable DKIM signing if it is not already enabled.
Publish the required DKIM records
Microsoft may provide DNS records that need to be added at your DNS host. Once published, those records allow Microsoft 365 to sign email for your domain.
Review your SPF record
SPF helps verify that emails claiming to come from your domain are sent by authorized mail servers. Your SPF record may include Microsoft 365 and other approved platforms that send email for your domain.
Add or review your DMARC record
DMARC tells receiving servers how to handle emails that fail SPF or DKIM alignment. Many businesses begin with p=none for monitoring, then move toward quarantine or reject after confirming legitimate email is passing.
Important recommendation: Do not jump straight to p=reject unless you are confident that all legitimate sending platforms are authenticated. A safer rollout is monitor first, then quarantine, then reject once testing confirms everything is passing correctly.
What Should Businesses Do Now?
The right setup depends on your email provider, DNS host, newsletter platform, CRM, website forms, and automation tools.
Identify every platform that sends email for your domain
List Microsoft 365, Google Workspace, Constant Contact, Mailchimp, HubSpot, CRMs, website forms, SMTP plugins, invoicing systems, appointment platforms, and lead magnet tools.
Check your SPF record
Your SPF record should include legitimate services that send email for your domain. Avoid creating multiple SPF records.
Set up DKIM for each sending service
Most platforms provide DKIM records inside their account settings. Add those DNS records where your domain DNS is managed.
Add a DMARC record
Start with monitoring if needed. Move toward stricter protection only after confirming legitimate email is passing authentication.
Make unsubscribe easy
Email marketing platforms should include clear unsubscribe links. Bulk senders should pay close attention to one-click unsubscribe requirements.
Monitor spam complaints and delivery
Keep complaint rates low, clean your list, avoid purchased lists, remove inactive contacts, and send useful content people actually want.
How Do These Requirements Affect Email Marketing?
The new requirements are not just technical. They affect how your business builds lists, sends campaigns, and protects its reputation.
Authentication supports inbox placement
Email authentication helps inbox providers trust your messages. It does not guarantee inbox placement, but unauthenticated email is more likely to be filtered or rejected.
Your domain reputation matters
If your domain is used for spammy or poorly configured sending, it can hurt your ability to reach customers. Use permission-based lists and helpful content.
Better email starts with better content
Useful newsletters, clear offers, lead magnets, segmentation, and consistent follow-up are more effective than blasting generic messages to everyone.
What If I Use Constant Contact, Mailchimp, or Another Email Platform?
You still need to authenticate your sending domain. Most platforms now have a domain authentication area that gives you DNS records to add at your domain host.
This often includes CNAME or TXT records for DKIM, SPF alignment instructions, and sometimes DMARC guidance. The exact steps vary by platform.
Do Not Guess with DNS
DNS records control important services, including your website, email, verification tools, and marketing platforms. A small mistake can break email delivery.
If you are not comfortable editing DNS, have your web, IT, or email marketing provider help you make the changes.
How Do Website Forms Fit into This?
Website forms often send email notifications to a business owner or staff member. Those form emails should also be sent through a reliable, authenticated method.
Use authenticated SMTP
WordPress form emails are more reliable when sent through a properly configured SMTP service instead of the default website server mail function.
Use the right From address
Form notifications should use a domain-based From address, such as wordpress@yourdomain.com, with Reply-To set to the lead’s email address.
Automate carefully
If you send checklist downloads, newsletter confirmations, or nurture emails, make sure the system sending those messages is authenticated.
How Maryland Web Design Can Help
Maryland Web Design helps businesses connect email marketing, website forms, DNS records, lead magnets, SEO, and automation into a cleaner digital marketing system.
Email marketing services
Build newsletters, lead magnet funnels, contact forms, email campaigns, and follow-up systems that support your business goals.
Free website review
Review your website, forms, lead-generation path, SEO, content, and digital marketing setup.
Digital marketing strategy
Connect email, SEO, social media, website content, analytics, and AI search visibility into one plan.
New Email Sending Requirements FAQs
These answers are written for business owners, marketers, website managers, search engines, and AI-powered search tools.
What are the new email sending requirements?
The new requirements focus on email authentication, domain alignment, lower spam complaints, and easy unsubscribe options. Businesses should review SPF, DKIM, DMARC, and their email marketing platform settings.
When did the new email authentication requirements go into effect?
The requirements went into effect on February 1, 2024. Businesses that send email from their own domains should review SPF, DKIM, DMARC, and unsubscribe practices.
Do small businesses need SPF, DKIM, and DMARC?
Even when a business is not a high-volume sender, setting up SPF, DKIM, and DMARC is a smart best practice because it helps protect the domain and improve trust with inbox providers.
How do I check my DMARC record?
You can use the free MXToolbox DMARC Lookup at https://mxtoolbox.com/dmarc.aspx to check whether your domain has a published DMARC record.
What happens if I do not authenticate my email domain?
Your emails may be more likely to go to spam, be rejected, fail authentication checks, or appear less trustworthy to inbox providers.
What is the difference between SPF and DKIM?
SPF identifies which servers are allowed to send email for your domain. DKIM adds a digital signature that helps receiving mail servers verify the message.
What does DMARC do?
DMARC tells receiving mail servers what to do when messages fail SPF or DKIM alignment. It can also provide reports to help monitor authentication issues.
Should I use p=reject for DMARC right away?
Not usually. Many businesses should start with p=none for monitoring, confirm legitimate mail is passing, then gradually move to quarantine or reject when the setup is verified.
Do website contact forms need authentication too?
Yes. Website forms should send through a reliable authenticated method, such as SMTP, and use a domain-based From address with the sender’s email placed in Reply-To.
Can Maryland Web Design help with this setup?
Yes. Maryland Web Design can help review email marketing platforms, WordPress form sending, DNS records, authentication requirements, lead magnet emails, and related digital marketing systems.
Need Help with Email Marketing and Domain Authentication?
Maryland Web Design can help review your website forms, newsletter setup, DNS records, SPF, DKIM, DMARC, lead magnets, and email marketing strategy.