You send a quote. The customer never answers. A week later they find it in their spam folder.
The problem may not be what you wrote. It may be that the customer's email provider couldn't confirm the message really came from you. Gmail and Yahoo have required senders to prove it since February 2024, and Microsoft added rules for big senders to Outlook.com in 2025. The proof is three short records in your domain's DNS, the settings that tell the internet where your website and email live. They're called SPF, DKIM and DMARC.
What SPF, DKIM and DMARC do
Picture the receiving mail server as a front desk deciding what to let in.
SPF (Sender Policy Framework) is the list of couriers allowed to carry your mail. It's one line of text listing every server that sends email for your domain, and receiving servers check it to verify that a message came from one of them (Google Workspace Help).
DKIM (DomainKeys Identified Mail) is a tamper-evident seal. Your email service signs each outgoing message with a private key, and you publish the matching public key in your DNS so receiving servers can check the signature (Google Workspace Help). Google's short version of the pair: DKIM "says you wrote the email," and SPF "says your server sent the email" (Google Workspace Help).
DMARC (Domain-based Message Authentication, Reporting and Conformance) is the note you leave at the front desk: what to do with mail that claims to be from you but fails, and where to send reports. It adds one rule. SPF or DKIM has to pass for the same domain that appears in the From line, which is called alignment. A message passes DMARC if it passes SPF with alignment, or DKIM with alignment (Google Workspace Help).
Why a free Gmail or Yahoo address works against you
All three records live in the DNS of the domain after the @. If your business email is yourname@gmail.com or yourname@yahoo.com, that domain belongs to Google or Yahoo, and only they can publish records for it. You can't add your invoicing app to Gmail's SPF record.
That matters as soon as anything other than your mail provider's own servers sends email "from" you. Yahoo publishes a DMARC policy asking receivers, Gmail and Hotmail included, to reject email "that may not be legitimately sent by Yahoo." Yahoo says this "can also interfere with some long-standing uses of identities that are authorized by the user but not verifiable" (Yahoo Sender Hub). An accounting tool emailing invoices as yourname@yahoo.com is that kind of use. Google, for its part, tells senders not to impersonate Gmail From: addresses, and says Gmail "will begin using a DMARC quarantine enforcement policy" (Gmail Help).
With your own domain, you hold the DNS. You decide which services may send as you, and you can add one when you start using it.
An address at your own domain also tells a customer who the email is from before they open it.
What Gmail, Yahoo and Outlook require
The three big consumer mailbox providers each publish rules for senders, split into everyone and bulk senders:
Google's rules for every sender took effect February 1, 2024. They also ask for a secure connection, valid DNS records for the sending server, and a spam rate below 0.3% in Postmaster Tools, Google's free dashboard for senders. Yahoo's enforcement began in February 2024 with similar points, including the 0.3% spam rate, and Yahoo says its rules apply to every domain Yahoo Mail hosts, AOL included (Yahoo FAQ). Bulk senders at both must also offer one-click unsubscribe on marketing email.
Mail that misses the mark at Gmail "might be marked as spam or rejected." At Yahoo it "may be sent to the spam folder or rejected." Microsoft's enforcement for big senders started May 5, 2025, and its announcement says failing messages go to Junk or are rejected.
A business sending quotes one at a time is nowhere near 5,000 a day. The floor still applies at Gmail and Yahoo, though, and Google recommends that you "always set up SPF, DKIM, and DMARC for your domains." Microsoft says that while enforcement targets large senders first, "all senders benefit." The server-side parts are mostly your email provider's job: Google says large providers such as Google, AOL and Yahoo typically follow its guidelines. Your part is the records on your own domain.
How to check your own email
- Send a real message from your business address to a Gmail account outside your business. Google notes you can't verify DKIM by emailing yourself (Google Workspace Help).
- Open it in Gmail on a computer. Below the sender's name, click the Down arrow. If you see "Mailed by" and "Signed by" lines, the message is authenticated. A question mark next to the sender's name means it isn't (Gmail Help).
- Look at the detail. Next to Reply, click More, then Show original (Gmail Help). The headers hold the results of the SPF, DKIM and DMARC checks (Google Workspace Help). Find the part that starts with Authentication-Results: each check should say pass, as in spf=pass or dkim=pass.
- Check the records themselves. Enter your domain in the Check MX tool in Google's free Admin Toolbox, which Google's troubleshooting pages use to verify SPF, DKIM and DMARC records.
What none, quarantine and reject mean
Your DMARC record's policy, the p= part, tells receivers what to do with mail that fails (Google Workspace Help):
- none: take no action and deliver it, but log it in a report.
- quarantine: send it to the recipient's spam folder.
- reject: refuse it. The sending server usually gets a bounce.
A starting record looks like this, with rua naming the address that gets the reports:
v=DMARC1; p=none; rua=mailto:dmarc@yourbusiness.com
Reports can arrive daily, so Google suggests a dedicated mailbox or group rather than your own inbox. Its recommended rollout: set up SPF and DKIM at least 48 hours first, run DMARC at none for a week while you read the reports, then move to quarantine for a small percentage of messages and raise it over time. Reject means failing messages "are rejected by receiving servers and never delivered," so it's the last step, not the first (Google Workspace Help).
The usual culprits
-
No records at all. Google says you must have an SPF record to send email, and without one, "emails might be blocked or sent directly to spam" (Google Workspace Help).
-
Two SPF records. Each domain can have only one. It's easy to end up with two, say one from your email setup and another added later for a new tool. Google says multiple SPF records can send your email to spam, and the fix is to merge them into a single record. One record naming Google Workspace and another service looks like this, with the service supplying its own include: value:
v=spf1 include:_spf.google.com include:[the other service's domain] ~all
-
A tool sending as you without permission. Your website's contact form, invoicing or accounting software, a booking system, a newsletter: each can send email with your address on it from its own servers. Google says "a contact form that automatically sends messages is an email sender for your domain," and it belongs in your SPF record (Google Workspace Help). For DMARC, Google says to check with each provider that its messages pass SPF and DKIM. List everything that sends email as you, and make sure each one is authorized.
-
Too many services in one record. SPF allows at most 10 DNS lookups, and services nested inside an include: count too. Go past that and the check can fail (Google Workspace Help).
-
Changes still on their way. Google says SPF and DKIM can each take up to 48 hours to start working.
Authentication proves who sent a message, not that anyone wants it. Google says spammers can authenticate their mail too, so "authentication by itself isn't enough to guarantee your messages can be delivered" (Gmail Help). Its sender guidelines also ask for accurate subject lines and headers, and email only to people who signed up for it (Gmail Help).
Where I can help
If your business email runs on Google Workspace, or you'd like it to, setting it up is a $150 add-on to any of my website plans. In your own Google account, I do the domain verification, the MX record (the one that tells the world which provider gets your mail), the SPF, DKIM and DMARC records, and up to two mailboxes. Moving old email, setting up devices and anything more is billed hourly: $150 an hour in 15-minute increments, with a 30-minute minimum. Google's monthly subscription is yours, billed by Google. My guide to domains, hosting and email covers how email depends on your domain, and why the accounts should be in your business's name.
What nobody can honestly promise is that every message lands in the inbox. Each provider makes that call, and Google says organizations can quarantine or reject mail even when it passes DMARC (Google Workspace Help). What correct records do is give Gmail, Yahoo and Outlook what they ask for. See the add-ons.
