{"id":5207,"date":"2026-08-06T12:24:04","date_gmt":"2026-08-06T12:24:04","guid":{"rendered":"https:\/\/www.mailercloud.com\/blog\/?p=5207"},"modified":"2026-08-06T12:24:06","modified_gmt":"2026-08-06T12:24:06","slug":"spf-dkim-dmarc-implementation-guide","status":"publish","type":"post","link":"https:\/\/www.mailercloud.com\/blog\/spf-dkim-dmarc-implementation-guide","title":{"rendered":"How to Set Up SPF, DKIM & DMARC: Implementation Guide"},"content":{"rendered":"\n

Email authentication stopped being optional in February 2024, when Google began enforcing requirements on any domain sending close to 5,000 or more messages a day to personal Gmail accounts; Yahoo aligned the same month but publishes no volume threshold. Microsoft followed on 5 May 2025 with a 5,000\/day threshold for Outlook.com, Hotmail and Live.com. Microsoft’s own announcement is internally inconsistent on the action taken \u2014 an April 2025 revision states a decision to reject, while surrounding text still describes Junk-foldering first with rejection “at a date to be announced,” a date never announced. Senders report both behaviors; the rejection reads:<\/p>\n\n\n\n

\n

550 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level<\/em><\/p>\n<\/blockquote>\n\n\n\n

Enforcement has tightened since. Google’s FAQ states that “Starting November 2025, Gmail is ramping up its enforcement on non-compliant traffic,” and that non-compliant messages “will experience disruptions, including temporary and permanent rejections.” Google published no per-code cutover, so treat this as a directional escalation rather than a documented 421\u2192550 flip.<\/p>\n\n\n\n

The shared baseline is SPF and DKIM both configured and passing, a published DMARC record (p=none<\/code> is sufficient at Google and Yahoo), at least one of SPF or DKIM aligned to the visible From domain, and valid forward and reverse DNS on your sending IPs. Providers diverge from there: Google requires TLS; Yahoo’s published requirements do not mention it<\/strong> \u2014 send over TLS regardless. Google caps spam rate at 0.30%<\/strong><\/a> as reported in Postmaster Tools and Yahoo states the same figure via Sender Hub<\/a>; treat 0.10% as your working limit. Google and Yahoo both require one-click unsubscribe (RFC 8058<\/a>) honored within two days; Microsoft’s published requirements cover authentication only.<\/p>\n\n\n\n

This page is the implementation reference. For the receiver-side rules themselves, see the current Gmail and Yahoo sender requirements<\/a> and Microsoft’s own 5,000\/day rule and 550 5.7.515<\/a>.<\/p>\n\n\n\n

\n
\n

Table of Contents<\/p>\n<\/span><\/div>\n