If you send a newsletter from your own domain, a few DNS records decide whether Gmail trusts it. Google and Yahoo both publish rules for bulk senders, and the checklist is shorter than the jargon suggests. Here is what applies to you, what your platform already handles and what you still need to do.
Do the rules apply to a small newsletter?
Some do, whatever your size. According to Google's email sender guidelines, every sender to Gmail must use SPF or DKIM, have valid forward and reverse DNS, use TLS and keep the spam rate below 0.3% in Postmaster Tools.
The stricter set applies to bulk senders, defined as 5,000 or more messages a day. That sounds big, but it is per day to Gmail addresses. A weekly newsletter with 6,000 Gmail readers sends all of them on one day. Bulk senders must have SPF, DKIM and DMARC, with the From domain aligned. Marketing or subscribed messages need one-click unsubscribe through List-Unsubscribe headers. Google says to aim for a spam rate under 0.10% and never reach 0.30%.
Yahoo's best practices ask for the same: SPF and DKIM, a valid DMARC policy of at least p=none, one-click unsubscribe, an obvious unsubscribe link in the body, and unsubscribes honoured within two days. Yahoo also wants spam complaints below 0.3%.
Google's wording is "might be marked as spam" and "might not be delivered", which suggests graduated filtering, not a switch. Do not wait to see which way it goes.
What the three acronyms do
SPF lists the servers allowed to send mail for your domain.
DKIM adds a signature that proves the message came through an authorised system and was not altered. Google asks for keys of at least 1,024 bits and recommends 2,048.
DMARC tells receivers what to do when SPF and DKIM fail, and requires the visible From domain to line up with one of them. Google says the policy can stay at "none".
What your newsletter platform handles
If you connect a custom sending domain, platforms generate most of the records for you. beehiiv's help page says you add three CNAME records, one for SPF and two for DKIM, and a separate DMARC record as a TXT entry. It states that since February 2024 every beehiiv account using a custom domain must have a valid DMARC record. Its advice: "Most users should start with none, monitor reports, and then gradually move to quarantine or reject over time."
On Kit, verifying your domain puts your address in the return-path, signs messages with your domain's DKIM and authenticates SPF with your domain. Kit also warns that you may see a temporary dip in open rates afterwards, because mailbox providers re-assess your reputation.
Check your own platform's help centre for the exact records, since the details differ.
The checklist
Send from a domain you own, not a free mailbox address.
Add the SPF and DKIM records your platform gives you.
Publish a DMARC record at p=none, with an address for reports.
Check that the record is live.
Make sure one-click unsubscribe and a visible unsubscribe link are on.
Watch your spam complaint rate in Gmail Postmaster Tools, and honour unsubscribes fast.
Leave DMARC at p=none until you have read a few weeks of reports.
A DMARC record looks like this, with your own domain and reporting address. You can check the live record from a terminal:
dig +short TXT _dmarc.yourdomain.com
"v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com"Three mistakes that cause trouble
Sending from a free mailbox address. Google's guidelines say senders must not impersonate Gmail From headers. A newsletter sent by a platform but claiming a gmail.com From address is exactly what that rule is about.
Forgetting the second tool. The invoicing app, form builder or community platform that also sends mail as your domain needs to be in your records too, or its messages may fail the checks.
Hiding the unsubscribe. Yahoo wants one-click unsubscribe in the headers and an obvious link in the body. Small grey text invites spam complaints, and complaints are the number both providers watch.
How long does all of this take? Adding the records is usually a few minutes of editing in your domain's DNS settings, though changes can take a while to show up. Then wait a few weeks of reports before you tighten anything.
The trade-off with tighter DMARC
Moving from none to quarantine or reject protects your name from spoofing. The risk is that any legitimate sender missing from your records, such as an invoicing tool that mails on your behalf, starts landing in spam or getting rejected. That is why beehiiv advises starting with none and moving slowly.
It is also worth being honest about what authentication does. It does not make a weak newsletter good. It only stops a good one from being filtered out for technical reasons.
A quick way to test it
After you add the records, send a test issue to a Gmail address you own. Open the message, choose "Show original" from the menu, and Gmail lists whether SPF, DKIM and DMARC passed. Three passes means your setup is working for Gmail. A fail names the check that broke, which tells you which record to revisit. Repeat the test whenever you change platform or add a new sending tool.
Why it matters for owned audiences
An email list is the audience you own, but only if the emails arrive. Authentication is the maintenance cost of that ownership. It takes an hour once, and a check every few months. If you plan bigger sends before the year ends, do this before, not after, a campaign goes wrong.
