NexusSec.If your invoices, newsletters or system alerts have started landing in spam, or bouncing, missing email authentication is the usual reason. Here is what the large mailbox providers ask for, and what to set up.
What Gmail and Yahoo require
For everyone sending to their users:
- SPF or DKIM authentication for your domain.
- Valid forward and reverse DNS for the sending servers, and TLS for the connection.
- A low spam complaint rate.
For bulk senders, in addition:
- Both SPF and DKIM.
- A DMARC record, with a policy of at least
p=none. - The From address aligned with the domain that passes SPF or DKIM.
- One-click unsubscribe on marketing and promotional mail, with unsubscribes honoured within two days.
- A spam complaint rate below 0.3%.
What Microsoft requires for Outlook.com
Microsoft announced that from 5 May 2025, domains sending more than 5,000 messages a day to Outlook.com, Hotmail and Live addresses must pass SPF and DKIM and publish DMARC with at least p=none. It said non-compliant mail would first go to Junk, with rejection to follow.
Does this apply if we send less than that?
The thresholds count all mail from your domain to that provider, including invoices and system alerts, not just newsletters. Even below them, the general rules apply, and authenticated mail is more likely to reach the inbox. The bigger reason is protection: without DMARC, anyone can send email that appears to come from your domain, which is how many invoice fraud attempts start.
What to set up, in order
- List everything that sends as your domain: Microsoft 365 or Google Workspace, your website forms, billing and accounting software, CRM, newsletter tools and scanners.
- SPF: publish one SPF record that includes each legitimate sending service, and keep it within the limit of ten DNS lookups.
- DKIM: turn on DKIM signing in each service that sends as your domain.
- DMARC: start with
p=noneand a reporting address, so you receive reports without affecting delivery. - Read the reports: find legitimate services that fail, and fix them.
- Enforce: move to
p=quarantine, thenp=reject, once the reports show legitimate mail passing.
Common mistakes
- Two SPF records on one domain, which makes SPF fail.
- Too many includes, so SPF goes over the ten-lookup limit.
- A third-party service sending as your domain without DKIM, or with its own domain, so DMARC alignment fails.
- Leaving DMARC at
p=nonefor ever, which reports spoofing but does not stop it. - Forgetting subdomains and unused domains, which attackers can spoof instead.
Our email security and DMARC service handles the whole rollout, and what is DMARC explains the basics. For Microsoft 365 tenants, see the Microsoft 365 security settings.
