Skip to content
  • GDPR-compliant
  • 100% hosting in Germany
  • Personal contact
  • Support included
  • Provisioning within 24 hours
EN
Customer portal
Security 5 min read

DMARC becomes mandatory: what Google, Yahoo and Microsoft require from senders

Gmail, Yahoo and Outlook.com require SPF, DKIM and DMARC from senders of larger volumes. If you ignore the rules, your emails end up in spam or are rejected. Here is how to meet the requirements step by step.

DMARC email security

For a long time, securing email domains was a recommendation for advanced users. That has changed: since February 2024, Google and Yahoo have required full authentication from senders of larger volumes, and in May 2025 Microsoft followed suit for Outlook.com, Hotmail and Live. Since November 2025, Google has been enforcing the rules even more strictly: messages that do not comply are increasingly rejected temporarily or permanently. If you send newsletters, invoices or order confirmations, you should act now.

Who is affected

The strictest rules apply to bulk senders: Google classifies anyone who sends more than 5,000 messages to personal Gmail accounts in a single day as such and keeps this classification permanently. Microsoft applies the same threshold to addresses at Outlook.com, Hotmail and Live. All messages from your domain are counted together, including those sent by your newsletter service, shop and ticket system.

But even if you send fewer emails, you are affected: basic requirements apply to all senders. And without DMARC, your domain can easily be misused for forged emails.

The requirements at a glance

For all senders (Gmail)

  • SPF or DKIM for the sending domain.
  • Valid forward and reverse DNS (PTR record) for the sending servers.
  • Encrypted transmission via TLS.
  • A low spam complaint rate, according to Google below 0.3 percent, ideally below 0.1 percent.
  • Correctly formatted messages according to the email standard (RFC 5322).

Additionally for bulk senders (Gmail and Yahoo)

  • SPF and DKIM.
  • A DMARC record with at least the policy p=none.
  • Alignment: the domain in the visible sender (From) must match the domain of SPF or DKIM.
  • For marketing emails, one-click unsubscribe (List-Unsubscribe header according to RFC 8058). Unsubscribes must be processed within two days.

Outlook.com, Hotmail and Live (Microsoft)

Since 5 May 2025, Microsoft has also required SPF, DKIM and DMARC with at least p=none, aligned with SPF or DKIM, from senders of more than 5,000 messages per day. Messages that do not comply are rejected or end up in the junk folder. Microsoft also recommends a working unsubscribe option, well-maintained recipient lists and a reachable reply address.

The three building blocks briefly explained

  • SPF uses DNS to define which servers may send emails for your domain. There may only be one SPF record per domain, and it may trigger a maximum of ten DNS lookups. Learn more in our article on SPF records.
  • DKIM adds a digital signature to every message. You publish the matching public key in DNS.
  • DMARC links both to the visible sender address, defines what should happen to messages that fail and provides you with reports on all emails sent in your name. You can find background information in our article on DKIM and DMARC.

Step by step to a secure domain

1. Inventory: who sends emails in your name?

List all services that send emails with your domain: your mail server, the newsletter tool, the online shop, the CRM, the ticket system, accounting software or Microsoft 365. Each of them must be covered in SPF and DKIM.

2. Create or extend the SPF record

Here is an example for a domain that sends via its own mail server and a newsletter service. Your service will tell you the exact include value:

DNS TXT muster.de 
v=spf1 mx include:spf.newsletter-dienst.example ~all

3. Activate DKIM for every service

Activate DKIM on your mail server and in every external service that sends in your name. The services will give you one or more DNS records for this. For our hosting, the guide Configuring and activating DKIM shows you how.

4. Start DMARC in monitoring mode

Start with the policy p=none. It does not change delivery yet, but it provides you with reports on which servers send in your name and whether SPF and DKIM pass:

DNS TXT _dmarc.muster.de 
v=DMARC1; p=none; rua=mailto:dmarc-berichte@muster.de; adkim=r; aspf=r

5. Analyse the reports

The reports arrive as XML files from the major mailbox providers, usually daily. Analyse them for two to four weeks, most easily with a DMARC analysis tool. If a legitimate service appears with a failed check, add it to SPF or DKIM. It is best to set up a separate mailbox for the reports; depending on your sending volume, quite a few will arrive.

6. Tighten step by step

Once all legitimate messages pass the check, switch to p=quarantine: messages that fail will then end up in spam. With pct= you can initially apply the policy to only a portion of messages. Once everything runs smoothly, move on to p=reject. Only then is your domain effectively protected against forgery.

Common pitfalls

  • Two SPF records for the same domain make both invalid.
  • Too many include entries exceed the limit of ten DNS lookups.
  • A service sends with your sender address but signs with its own domain. Alignment is then missing, even though DKIM technically passes.
  • Forwarding breaks SPF. That is why a working DKIM signature is so important.

What we can do for you

With us, you manage the required DNS records directly in the customer area; you can find the guide under Editing DNS records. You can activate DKIM for your domains in hosting with just a few clicks. For newsletters with larger mailing lists, please note our information on bulk mailing and email limits. And if you are unsure whether your records are correct, our support team will be happy to check them with you.

Conclusion

SPF, DKIM and DMARC are no longer optional extras but a prerequisite for your emails to arrive. The way there is manageable: list your services, set up SPF and DKIM, start DMARC in monitoring mode and tighten it step by step after analysing the reports. Afterwards, your domain is not only deliverable but also protected against misuse.

Email security

Protection for incoming emails, too

SpamGate filters spam, phishing and malware before they reach your mailbox.

View SpamGate Email security

More posts

All posts
Security 4 min read

Passkeys instead of passwords: how password-free login works

Passkeys replace your password with a cryptographic key pair stored on your device. This makes the login more convenient and provides reliable protection against phishing. We explain how passkeys work, why they are more secure, and how you can use them in the SpeedIT customer area.

Security 4 min read

AI crawlers and bot traffic: reducing the load on your website

AI crawlers such as GPTBot and ClaudeBot can place a significant strain on websites. This article explains which bots are out there, how to control them via robots.txt, how to restrict them technically, and how to reduce server load using caching, rate limiting and firewall rules without slowing down genuine visitors.

Security 4 min read

The 3-2-1 backup rule: How to back up your website and email properly

Three copies, two storage types, one of which is off-site: the 3-2-1 backup rule is the tried-and-tested foundation of any data backup. Find out how to create a reliable backup for your website, database and mailboxes, and why the hosting provider’s backup alone is not enough.