Gmail and Yahoo check whether mail that claims to come from a store’s domain was actually authorized by that domain. This guide explains what the two mailbox providers require, what SPF, DKIM and DMARC records do, and how to publish them through an email platform’s domain-authentication tool, using Mailchimp as the example.

What Gmail and Yahoo require

Google’s email sender guidelines, which took effect on February 1, 2024, set rules for everyone sending to personal Gmail accounts. All senders must set up SPF or DKIM, keep valid forward and reverse Domain Name System (DNS) records, also called PTR records, use a Transport Layer Security (TLS) connection, and keep spam rates reported in Google Postmaster Tools below 0.3%. Bulk senders, those sending more than 5,000 messages a day, must also set up both SPF and DKIM, publish a DMARC record (a policy of “none” is acceptable), align the From: domain with the SPF or DKIM domain, and support one-click unsubscribe on marketing messages along with a visible unsubscribe link. Google recommends keeping spam rates below 0.10%.

Yahoo’s sender best practices, enforced from February 2024, follow the same pattern. All senders need SPF or DKIM, a spam rate below 0.3% and valid forward and reverse DNS. Bulk senders need both SPF and DKIM, a valid DMARC policy of at least p=none that passes, From: domain alignment (relaxed alignment is accepted), a working one-click list-unsubscribe header for marketing and subscribed messages, and unsubscribes honored within two days.

What each record does

  • SPF (Sender Policy Framework) is a TXT record that, in Google’s words, “lists all the servers that send email for your domain.” It always begins with v=spf1.
  • DKIM (DomainKeys Identified Mail) is usually published from records an email platform supplies. Google says mail to personal Gmail accounts needs a DKIM key of at least 1024 bits and recommends 2048 bits where the domain provider supports it.
  • DMARC (Domain-based Message Authentication, Reporting and Conformance) is a TXT record named _dmarc that tells receivers how to treat mail that fails checks: none (deliver it and log it in a daily report), quarantine (send it to spam) or reject (refuse it).

Step-by-step setup

  1. List every service that sends as your domain. Identifying all email senders is the first step in Google’s SPF guide.
  2. Send from an address on your own domain. Mailchimp says public email services like Gmail and Yahoo can’t be authenticated. The domain must also be verified, by clicking a link in a verification email or entering a code, before authentication starts.
  3. Open the authentication tool. In Mailchimp, click the profile icon, open Account & billing, go to the Domains tab, click Start authentication next to the verified domain, choose the DNS provider and click Next. Mailchimp recommends its automatic method, run through a service called Entri, which prompts a login to the DNS provider so the records can be created; the manual route starts from Or manually authenticate your domain.
  4. Add the DKIM records. In manual setup, Mailchimp shows two CNAME records, each with a Name (Host) and a Value. Add both at the DNS provider, return to Mailchimp and click Next.
  5. Add the DMARC record. Mailchimp then shows one TXT record with the host _dmarc and a value to copy. Google’s DMARC guide recommends starting with p=none, reviewing the reports sent to the address in the rua tag, and moving to quarantine or reject once legitimate mail passes. An optional pct tag, from 1 to 100, applies the policy to a share of failing mail during rollout. Google also says to wait 48 hours after setting up SPF and DKIM before turning on DMARC.
  6. Update SPF for other senders. When another service sends as the domain, Google says to add an include: tag for each sender to the SPF record, as in its example v=spf1 include:_spf.google.com include:amazonses.com ~all. A record can carry up to 10 include: tags, and each subdomain that sends mail needs its own SPF record.
  7. Wait for validation. Mailchimp says most records update within a few minutes but can take up to 48 hours. The Domains page shows “Authentication in progress” and then an “Authenticated” label. Google says SPF can take up to 48 hours to start working.
  8. Check unsubscribe headers and complaints. Google’s guidelines call for both a List-Unsubscribe header and a List-Unsubscribe-Post: List-Unsubscribe=One-Click header on marketing mail. Track the spam rate in Postmaster Tools.

Common problems

  • The DNS host doubles the domain name. Some providers append the domain automatically. In Mailchimp’s example, entering k2._domainkey.example.com produced k2._domainkey.example.com.example.com; the fix is to enter only k2._domainkey.
  • Records look correct but authentication fails. Mailchimp suggests waiting up to 48 hours, then checking the DNS provider’s help site.
  • Records need changing after authentication. Editing the CNAME records can disrupt Mailchimp’s stored information. Disable authentication on the Domains page, make the change, wait for it to finish, then authenticate again.
  • A newly added tool’s mail goes to spam. Google says messages from senders missing from the SPF record could be marked as spam. Add the sender, and remove domains or IP addresses no longer used.
  • Delivery drops after DMARC goes live. Google warns that enabling DMARC too early can cause delivery problems. Confirm SPF and DKIM have been in place for 48 hours and start with p=none.