Email deliverability for small business: SPF, DKIM, DMARC and the bulk sender rules

Why emails go to spam

Mailbox providers decide where your email goes based on two things: whether they can prove it's really from you (authentication) and whether recipients want it (engagement and complaints). If either is weak, you land in spam or get rejected.

SPF, DKIM and DMARC in plain English

• SPF is a DNS record listing the services allowed to send email for your domain. You can only have one SPF record per domain, and it's limited to 10 DNS lookups.
• DKIM adds a digital signature to every email. The matching public key sits in your DNS, so receivers can check the email wasn't forged or changed.
• DMARC tells receivers what to do when an email fails SPF or DKIM, and sends you reports. Start with p=none to monitor, then tighten to quarantine or reject once you're sure all legitimate mail passes.

The bulk sender rules

Since February 2024, Gmail and Yahoo require anyone sending around 5,000 or more emails a day to their users to:

• Pass both SPF and DKIM, with a DMARC record (at least p=none) aligned with your From domain.
• Offer one-click unsubscribe on marketing email and honour it within two days.
• Keep the spam complaint rate below 0.3%, ideally under 0.1%.

Outlook.com introduced similar requirements for high-volume senders in May 2025. Even if you send less, following these rules is the best way to reach the inbox.

Use a dedicated sending subdomain

Send marketing email from a subdomain such as mail.yourbusiness.com. It keeps your marketing reputation separate from your main domain, so a campaign that gets complaints doesn't affect your everyday email. Make sure the From address uses the same authenticated domain.

Setup checklist in Oceanic Funnels OS

1. Go to Settings → Email Services → Sending Domain and add a subdomain, such as mail.yourbusiness.com.
2. Add the DNS records shown (SPF, DKIM and others) at your domain provider, then verify.
3. Add a DMARC record with p=none and a reporting address.
4. Update your From address in campaigns and automations to use the authenticated domain.
5. Watch DMARC reports for 2 to 4 weeks before moving to quarantine or reject.

Habits that keep you in the inbox

• Only email people who opted in. Never buy lists.
• Remove contacts who bounce or haven't opened in months.
• Send consistently instead of rare huge blasts.
• Write like a person: clear subject lines, few links, no spammy phrases.

Sources

• Google and Yahoo sender requirements guide (Warmy)