SPF, DKIM and DMARC Explained: Email Deliverability for B2B Senders

You can write the perfect email to the perfect prospect, and it is worthless if it lands in spam. Deliverability is the part of email marketing most teams ignore until something breaks. This guide explains the three authentication standards every B2B sender needs, what Gmail and Yahoo now require, and how to monitor your reputation.

Why authentication matters now

Since 2024, Google and Yahoo have required bulk senders to authenticate their mail, offer easy unsubscribes and keep spam complaints low (Google, n.d.; Yahoo, n.d.). Google defines a bulk sender as one sending close to 5,000 or more messages a day to personal Gmail accounts, but its baseline rules apply to everyone: set up SPF or DKIM, have valid reverse DNS, use TLS, and keep reported spam below 0.3%.

SPF: who is allowed to send

Sender Policy Framework (SPF) is a DNS TXT record listing the servers authorised to send mail for your domain (Kitterman, 2014). A typical record for Google Workspace looks like v=spf1 include:_spf.google.com ~all. Keep the record under SPF's 10-DNS-lookup limit, and publish only one SPF record per domain; two records break validation.

DKIM: proof the message was not altered

DomainKeys Identified Mail (DKIM) adds a cryptographic signature to each message, verified with a public key published in DNS (Crocker et al., 2011). Generate a 2048-bit key in your email platform, publish it at the selector it gives you, and confirm the "DKIM: PASS" header in a test message.

DMARC: the policy that ties them together

Domain-based Message Authentication, Reporting and Conformance (DMARC) tells receivers what to do when SPF or DKIM fail and requires that the authenticated domain align with the visible From address (Kucherawy & Zwicky, 2015). Start with monitoring:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.ca

Review the aggregate reports for a few weeks, fix any legitimate sources that fail, then move to p=quarantine and eventually p=reject.

One-click unsubscribe

Marketing and promotional mail to Gmail and Yahoo must support one-click unsubscribe using the List-Unsubscribe and List-Unsubscribe-Post headers defined in RFC 8058 (Levine & Herkert, 2017), plus a visible link in the body. CASL separately requires a working unsubscribe in every commercial message, so you need it anyway.

Spam-complaint rate

Google asks senders to keep the user-reported spam rate below 0.1% and never reach 0.3% (Google, n.d.). For cold outreach, the best protection is relevance: tight targeting, short, specific messages and an easy opt-out. Monitor your rate in Google Postmaster Tools.

Protect your main domain

Outbound campaigns should run from separate sending domains (for example getadskings.com alongside adskings.ca), each with its own SPF, DKIM and DMARC. If a campaign has problems, your primary domain, which carries invoices and client conversations, stays clean.

Deliverability checklist

1. One valid SPF record per domain, under 10 lookups.
2. DKIM signing with a 2048-bit key.
3. DMARC published, starting at p=none with reporting.
4. Aligned From domain.
5. One-click unsubscribe headers and a visible link.
6. Separate sending domains for outbound.
7. Verified lists with hard bounces under 2–3%.
8. Gradual warm-up of new inboxes.
9. Google Postmaster Tools monitoring.
10. Spam complaints under 0.1%.

Not sure where your domain stands? Our free email audit checks your SPF, DKIM and DMARC records and tells you exactly what to fix.