Key facts
- Gmail and Yahoo have required SPF, DKIM and DMARC from senders of 5,000 or more messages a day since February 2024
- Those bulk sender rules also ask for a spam complaint rate below 0.3%
- Microsoft began enforcing similar authentication rules for high-volume senders to Outlook.com from 5 May 2025
- Viewing the original message in Gmail shows whether SPF, DKIM and DMARC passed or failed
- Website contact forms sending through PHP mail are a frequent cause of failed authentication
- A domain can only have one SPF record; two SPF records cause both to fail
- dijitul fixes deliverability at £45 an hour + VAT
Why it happens
Mailbox providers such as Gmail and Outlook decide where a message lands based on who sent it, whether it can be proved genuine, and how recipients have reacted to that sender before. For a small business, the problem is usually one of these:
- No authentication. The domain has no SPF, DKIM or DMARC records, or they are wrong.
- Unauthorised senders. Your newsletter tool, CRM, invoicing software or website sends 'from' your domain but is not listed in SPF and does not sign with DKIM.
- Blocklisting. Your mail server's IP address or your domain is on a list such as Spamhaus, often after a compromised account sent spam.
- Reputation and content. A brand new domain, lots of recipients marking mail as spam, link shorteners, image-only emails, or attachments that look risky.
The rules got stricter
Since February 2024, Google and Yahoo have required anyone sending 5,000 or more messages a day to personal Gmail or Yahoo addresses to authenticate with SPF, DKIM and DMARC, align the From domain, offer one-click unsubscribe on marketing mail and keep the spam complaint rate below 0.3%. Microsoft followed for Outlook.com, Hotmail and Live addresses: from 5 May 2025, high-volume senders that fail these checks are sent to junk and then rejected with a '550 5.7.15' error.
Most small businesses send far fewer than 5,000 a day, but the same checks are applied, more gently, to everyone. Unauthenticated mail is treated with suspicion whatever the volume.
Step 1: read the headers
Send a test from your normal email to a personal Gmail address. Open it, click the three dots and choose Show original. At the top, Gmail shows SPF, DKIM and DMARC as PASS or FAIL. In Outlook, open the message, choose File, Properties (or View, Message details) and look for Authentication-Results.
Repeat for every system that sends as your domain: your website's contact form, your email marketing tool, your accounts software. One failure often turns out to be the website, which sends through the server's PHP mail function with no authentication at all. Switching it to SMTP through your real email provider usually fixes it.
Step 2: fix SPF, DKIM and DMARC
Make sure you have exactly one SPF record that lists every service sending for you, DKIM switched on in Microsoft 365 or Google Workspace and in each third-party tool, and a DMARC record, starting at p=none to collect reports. Our step-by-step guide on how to set up SPF, DKIM and DMARC covers the exact records.
Step 3: check blocklists and reputation
Check your sending IP and domain on a multi-blocklist checker such as MXToolbox. If you are listed, find out why before requesting removal: a compromised mailbox sending spam will get you listed again. Look in Microsoft 365 for users blocked from sending, and reset passwords and enable MFA for any account that was abused. If you send newsletters, register for Google Postmaster Tools to see your domain reputation and complaint rate, and remove addresses that never open or that bounce.
Small content changes help too: use a plain, consistent From name, avoid URL shorteners, include real text alongside images, and do not send attachments to people who are not expecting them.
When to call dijitul
Call us if customers say your quotes or invoices never arrive, if headers show failures you cannot trace, or if you are on a blocklist. We audit every service that sends as your domain, fix DNS, configure DKIM and DMARC, fix your website's form email and check the result, at £45 an hour + VAT. See email deliverability or get in touch.
If spam was sent from one of your accounts, treat it as a security incident: our guide on what to do after clicking a phishing link explains the next steps.
Frequently asked questions
Why are my emails going to junk in Outlook and Gmail?
Most often because your domain lacks SPF, DKIM or DMARC records, or a tool sending as your domain is not authorised in them. Blocklisting after a compromised account and poor sender reputation are the next most common causes. Message headers show which checks are failing.
How do I check if my email passes SPF, DKIM and DMARC?
Send a test email to a Gmail address, open it, click the three dots and choose Show original. Gmail lists SPF, DKIM and DMARC as PASS or FAIL at the top. Test every system that sends as your domain, including your website forms.
Why do my website contact form emails go to spam?
Many websites send form notifications using the server's PHP mail function, from your domain but without SPF or DKIM authorisation, so receiving servers distrust them. Configuring the site to send through authenticated SMTP via your Microsoft 365 or Google Workspace account usually fixes it.
Do the Gmail and Yahoo bulk sender rules apply to small businesses?
The strict requirements apply to senders of 5,000 or more messages a day to personal Gmail or Yahoo addresses. Smaller senders still need SPF or DKIM to avoid spam folders, and adding DMARC is strongly advised. Authenticating properly helps every business, whatever its volume.
How do I get my domain off a blocklist?
First find and fix the cause, such as a hacked mailbox or an insecure website form sending spam. Then use the blocklist's own removal process. Requesting removal before fixing the cause usually leads to relisting. dijitul can investigate and handle this at £45 an hour + VAT.
How long does it take to fix email deliverability?
DNS fixes for SPF, DKIM and DMARC take effect within hours in most cases. Recovering reputation after blocklisting or high complaint rates can take longer, as providers need to see good sending behaviour. dijitul usually completes the technical fixes in one session.
Related
Get it fixed
One-off fixes are £45 an hour + VAT. You'll know the likely cost before we start.