Email deliverability for small businesses: SPF, DKIM, DMARC and the bulk-sender rules

When a business’s emails go to spam, the instinct is to blame the wording: too many offers, the word “free”, an exclamation mark. Sometimes that’s part of it. But for most small businesses the real problem is more basic. The receiving mailbox can’t confirm the email really came from you, so it treats it with suspicion.

That confirmation comes from three DNS records: SPF, DKIM and DMARC. They take an hour to set up and they’re now required by the largest mailbox providers.

What the big mailbox providers require

Gmail (personal Gmail accounts, from February 2024):

Outlook.com (Microsoft’s consumer mailboxes such as outlook.com and hotmail.com) announced similar rules in 2025 for domains sending more than 5,000 emails a day: pass SPF, pass DKIM and publish DMARC at least at p=none. Microsoft said non-compliant mail would go to Junk first, with rejection to follow. Yahoo publishes comparable sender guidelines.

Even if you send far less than 5,000 a day, set up all three. It’s the same hour of work, and it protects your domain from being spoofed.

Step 1: list everything that sends email as your domain

This is the step people skip, and the cause of most broken setups. Typical senders for a small business:

• your mailbox provider (Google Workspace, Microsoft 365, Zoho Mail)
• your email marketing tool (Klaviyo, Mailchimp, Brevo, HubSpot)
• your store (Shopify order emails), booking tool and CRM
• website contact forms and invoicing software

Each one sending as @yourdomain.com must be covered by SPF or DKIM, ideally both.

Step 2: SPF, one record listing every sender

SPF is a TXT record on your root domain listing who may send for it. Example for Google Workspace plus one marketing tool:

v=spf1 include:_spf.google.com include:spf.yourmarketingtool.com ~all

Rules that trip people up:

• Only one SPF record per domain. Two v=spf1 records break SPF. Merge them into one.
• Ten DNS lookups maximum. Each include: costs at least one lookup, and the SPF standard (RFC 7208) caps them at 10. Too many includes means SPF fails. Remove services you no longer use.
• Copy the exact include from each provider’s setup instructions. Don’t guess it.
• ~all vs -all: ~all (softfail) is the common, safer starting point.

Step 3: DKIM, one key per sending service

DKIM adds a digital signature to each email. You turn it on inside each sending service, which gives you a DNS record (usually a TXT or CNAME at something like google._domainkey.yourdomain.com). Add the record at your DNS provider, then go back to the service and confirm or “start authentication”.

Do this for every service from step 1. A marketing tool that signs with its own domain instead of yours won’t help your domain’s reputation or DMARC alignment. Look for a “custom domain” or “authenticate your domain” setting.

Step 4: DMARC, starting with monitoring

DMARC tells mailbox providers what to do when a message fails SPF and DKIM alignment, and where to send reports. Add a TXT record at _dmarc.yourdomain.com:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

• Start with p=none. It only monitors. Nothing gets blocked while you check that all your legitimate senders pass.
• Read the reports for a few weeks. The XML reports are hard to read raw, so many people use a free DMARC report viewer.
• Then tighten to p=quarantine and eventually p=reject once every legitimate sender passes. That’s what stops others from impersonating your domain.

Step 5: one-click unsubscribe and list hygiene

• Use your email platform’s built-in unsubscribe. Reputable platforms add the one-click unsubscribe headers (RFC 8058) for you. Check it’s switched on.
• Put a visible unsubscribe link in every marketing email.
• Stop emailing people who haven’t opened or clicked in a long time. Old, unengaged addresses push your spam rate up.
• Never buy lists. Besides deliverability, it creates consent problems under the UAE’s data protection law. See UAE PDPL and marketing consent.

Step 6: check it worked

1. Send a test to a personal Gmail address, open it, choose Show original, and look for SPF: PASS, DKIM: PASS and DMARC: PASS.
2. Repeat for each sending service: marketing email, store order email, booking confirmation.
3. Set up Google Postmaster Tools for your domain to watch your spam rate over time. It’s free, and it only shows data once you send a meaningful volume to Gmail.

Common problems and fixes

A note on new domains

A domain that has never sent email has no reputation. If you’re launching, start with transactional emails (orders, bookings) and engaged subscribers, then grow volume over a few weeks rather than emailing your whole list on day one.

Frequently asked questions

We only send a few hundred emails a month. Does this apply to us?

Gmail requires SPF or DKIM from all senders. DMARC and one-click unsubscribe are only required above 5,000 a day, but they’re quick to set up and protect your domain from spoofing.

Can we just use p=reject straight away?

You can, but if you’ve missed a legitimate sender (an invoicing tool, say), its emails will start bouncing. Monitor with p=none first.

Does this fix emails going to the Promotions tab?

No. Promotions is Gmail’s sorting, not spam. Authentication gets you into the inbox. Where in the inbox depends on the content and how recipients interact with it.