What exactly does Google require from every sender?

Per its sender guidelines: SPF or DKIM on the sending domain, valid forward and reverse DNS for the sending IP address, an encrypted TLS connection, message formatting per RFC 5322, a spam complaint rate below 0.3%, and not presenting yourself as Gmail when you are not.

What is SPF in plain terms?

It is a record in your domain's DNS declaring which servers are allowed to send email on your behalf. The recipient looks at where the message came from and checks whether it is on the list. If it is not, the message becomes suspect.

It is a digital signature on the message itself, with a key also published in your DNS. The recipient verifies the signature and knows the message really came from you and was not altered in transit.

And what does DMARC add?

It ties the previous two to the name the recipient actually sees in the From field, and lets you declare what should happen when the check fails. It also sends reports, so you can see who is sending under your name. You always start with a monitoring policy and tighten later.

Does any of this apply to a small business sending few emails?

The bulk sender requirements apply to those crossing the 5,000 messages a day threshold. But the requirements that apply to every sender, meaning SPF or DKIM, correct DNS and TLS, have no threshold at all. And in practice the setup cost is the same whether you send ten or ten thousand.

What does Greek law say about commercial email?

Article 11 of Law 3471/2006 requires prior explicit consent for advertising messages. Paragraph 3 provides an exception where the address was obtained in the context of a previous sale and the message concerns similar products or services, with an obligation to offer easy opt-out in every message. Clear identification of the sender is also required.

If I set everything up, will my messages definitely arrive?

No, and nobody serious promises that. Authentication removes the reasons to reject you technically. Whether you reach the inbox also depends on your domain's reputation, meaning how many recipients mark you as spam. The technical side is necessary, it is not sufficient.

SPF, DKIM, DMARC: why business email lands in spam

Let me start with the incident, because I have lived it many times and always in the same way. The client rings, annoyed: “I sent a quote and my customer says they never got it.” We go in, we search, and we find the message. Sitting in the recipient’s spam folder, all alone.

And this is where the misunderstanding begins. The client thinks the text is at fault, that they wrote “offer” somewhere and a filter caught them. It almost never is. In the overwhelming majority of cases the fault is in their domain’s DNS, meaning three lines of text nobody ever told them existed.

Let us look at them, because since February 2024 they stopped being optional.

The problem, with an example

The way email is sent carries a naivety dating from when the internet was small and everyone knew each other: anybody can write any name in the sender field.

In practice, I could right now send a message claiming to come from your address. The protocol does not stop me. It is like posting an envelope and writing whatever return address you fancy on the back.

SPF, DKIM and DMARC exist for exactly this. They are how you tell the world “I send from here, everything else is fake”. And because you are the one who declares them, you are the one who pays when you do not.

The three of them, seriously but without the cryptography

SPF is a list. You publish in your DNS which servers may send email on your behalf: your mail provider, the system that sends your invoices, your newsletter tool if you have one. The recipient looks at where the message came from and checks the list.

DKIM is a signature. Every message leaves cryptographically signed, and the verification key sits in your DNS too. The recipient confirms two things at once: that you really sent it, and that nobody touched it in transit.

DMARC is the rule tying those two to the name the recipient actually sees. Because, and here is the clever part, a message can pass SPF and DKIM for one domain while the From field shows another. DMARC requires them to match, and lets you say what should happen when they do not.

It also comes with a gift most people ignore: it sends reports. Which means you find out who is sending messages under your name. The first time you read them, you will probably be surprised.

What changed in February 2024

Until recently all of this was good practice. It stopped being.

Google’s sender guidelines now set requirements for every sender, with no size threshold: SPF or DKIM on the sending domain, valid forward and reverse DNS for the sending IP, an encrypted TLS connection, message formatting per RFC 5322, a spam complaint rate below 0.3%, and not presenting yourself as Gmail when you are not.

And for bulk senders, meaning those sending more than 5,000 messages a day to Gmail addresses, a threshold in force since 1 February 2024, it adds: SPF and DKIM together, DMARC configured even with the loosest policy, alignment of the From domain with the SPF or DKIM domain, and one-click unsubscribe.

Two comments, because this is where the mistakes happen.

First, the 5,000 threshold sounds large and lets you off the hook. It does not. The requirements for every sender have no threshold, and they are precisely the ones missing from most small domains I look at.

Second, mind the complaint rate. 0.3% is not a target, it is a ceiling. In a thousand messages, three people hitting “spam” put you in a difficult position. Which is why sending to people who never asked you for anything is not merely rude, it is technical suicide.

And now the legal side, which applies regardless

Because the two get constantly confused: one is what the recipient will accept, the other is what you are allowed to send.

In Greece the second is set by Article 11 of Law 3471/2006. The rule is prior explicit consent for advertising messages. Not a pre-ticked box, not “they bought something so I will email them”.

There is an exception worth knowing, in paragraph 3: if you obtained the address in the context of a previous sale and the message concerns similar products or services, you may make contact, provided you give an easy way to opt out in every message. The law also requires clear identification of the sender and a valid contact address.

Notice something interesting: the one-click unsubscribe Google wants for technical reasons, and the easy opt-out the law wants for legal ones, end up as the same button. Technology and legislation rarely coincide so neatly, so let us take the win.

What I will not promise you

It would be easy to close with “fix these and everything will arrive”. It is not true.

Authentication removes the reasons to reject you technically. It does not guarantee the inbox, because there is also your domain reputation, built from recipient behaviour: how many open, how many delete without opening, how many hit “spam”. No DNS record fixes that. What you send and to whom does.

So the right phrasing is: necessary, not sufficient. Exactly like the little padlock in the address bar.

Why I am writing this rather than an email marketer

Because it is not a marketing job, it is infrastructure. These three records live in your domain’s DNS, next to the ones pointing at your website. Same place, same panel, same work.

And it is one of the few things that gets done once and then works. No monthly maintenance, no subscription, no new tool to learn. Half an hour from someone who knows where to put them, and then they stop being your problem.

Which brings us back to the phone call at the start, and the quote that never arrived. It was not the wording, nor the recipient, nor bad luck. Three lines were missing from a file the client did not know existed. If you want to see what your domain’s DNS says today, get in touch.

Why your emails land in the spam folder