Email Authentication for Outbound Teams: Fix SPF, DKIM, and DMARC Before You Send

Your team researched the accounts, wrote personalized first lines, and loaded the sequence. Some of those emails will never be seen. Not bounced, not unsubscribed, just filtered before a prospect could decide whether the message was worth reading.

When that happens, the cause is often not the copy or the subject line. It is infrastructure: DNS records, sending patterns, and how recipients react to your mail. This is a non-technical playbook for RevOps and sales leaders who need outbound email to reach the inbox, built on what the mailbox providers themselves publish.

The Rules Changed for High-Volume Senders

Both major providers now publish authentication requirements for bulk senders.

Gmail. Google's sender guidelines require every sender to Gmail accounts to set up SPF or DKIM. Senders of more than 5,000 messages per day must set up SPF, DKIM, and DMARC, keep their From domain aligned with SPF or DKIM, and support one-click unsubscribe for marketing and subscribed messages ^[1].

Outlook. Microsoft announced that domains sending more than 5,000 emails per day to Outlook must pass SPF and DKIM and publish a DMARC policy of at least p=none that aligns with SPF or DKIM, and that it would reject messages that fail these requirements with the error "550; 5.7.515 Access denied" ^[3].

Most outbound teams send far less than 5,000 emails a day from one domain, but these requirements describe what the providers treat as a legitimate sender. Meeting them is the floor, not a ceiling.

The connection to your wider stack matters. Teams that consolidate tools often find several platforms sending from the same domain at once, each with its own SPF include, DKIM key, and sending pattern. The result is conflicting DNS records, a broken SPF lookup budget, and volume nobody sees in one place.

Why Outlook Feels Harder to Reach

Teams selling to larger companies often find Outlook harder than Gmail, because so many corporate mailboxes run on Microsoft 365 and corporate administrators add their own filtering on top. A few things to understand:

• Authentication failures are now explicit. Under Microsoft's high-volume rules, a failing message can be rejected outright rather than quietly filtered ^[3].
• Organizations filter too. Corporate tenants run their own spam and phishing policies in addition to Microsoft's, so a domain can be filtered at one company and delivered at another.
• One complaint can travel. A junk report from someone at a target account feeds the filtering that protects the rest of that organization.

If your Outlook-heavy segments underperform your other segments with the same messaging, check authentication and reputation before you rewrite the copy.

SPF, DKIM, and DMARC: The Non-Technical Survival Guide

You do not need to become a DNS engineer. You do need to know what these three records do and how they break.

SPF: Your Approved Sender List

SPF (Sender Policy Framework) is a DNS record listing every server and service allowed to send email for your domain. When a mailbox provider receives an email claiming to be from yourcompany.com, it checks the SPF record to see whether the sending server is authorized.

The most common failure is the lookup limit. The SPF standard says implementations must limit the include, a, mx, ptr, and exists mechanisms and the redirect modifier to 10 DNS lookups in total, and must return a "permerror" when that limit is exceeded ^[4]. Every tool you add with an include statement uses part of that budget: your email provider, your engagement platform, your marketing automation, your CRM's notification mail, your transactional mail service. Add enough tools and the record silently breaks.

DKIM: Your Digital Signature

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every outgoing email. The receiving server checks it against a public key in your DNS to confirm the message came from you and was not altered.

The usual mistake: DKIM is set up once during tool onboarding and never revisited. Make sure every platform that sends as your domain signs with its own key, and rotate keys on a schedule your security team sets. A compromised key lets an attacker send authenticated mail as you.

DMARC: Your Enforcement Policy

DMARC (Domain-based Message Authentication, Reporting, and Conformance) tells mailbox providers what to do when an email fails SPF and DKIM alignment. It has three policy levels:

• p=none: monitor only. Failing mail is still delivered. This is where you start, and it is the minimum both Google and Microsoft require of high-volume senders ^{[1] [3]}.
• p=quarantine: failing mail goes to spam or junk.
• p=reject: failing mail is blocked.

The escalation path: start at p=none and read the aggregate reports to find every legitimate service sending as your domain. Fix or authorize each one. Move to p=quarantine once legitimate mail passes, and to p=reject once quarantine reports stay clean.

Warming a New Domain

New domains and new sending IPs start with no reputation. Mailbox providers trust you only after a period of consistent, low-volume sending that earns positive engagement. Rushing this is the fastest way to burn a domain.

A practical ramp:

Engagement seeding is the piece most teams skip. Early on, send only to people who will open, read, and ideally reply: teammates, friendly customers, partners. Those positive signals build the reputation that later cold outreach depends on.

Keep sending consistent through the ramp. Sudden starts and stops look like automated batch sending, so increase gradually and avoid long gaps until the domain is established.

Volume Spikes: The Silent Campaign Killer

Picture a typical week. Monday is slow. On Tuesday a manager reviews pipeline and tells the team to ramp up outreach, and volume jumps. Thursday tapers off and Friday is nearly silent. That pattern is a deliverability risk, because sudden jumps in volume are a classic spam signal.

The fix has three parts:

1. 1Set daily send caps per domain. Decide a comfortable volume for each warmed domain and hold it, quota pressure or not.
2. 2Spread sends across the business day. Use sending windows in the recipient's time zone instead of sending everything at once.
3. 3Split high volume across warmed domains or subdomains. Each needs its own warming period and its own authentication records.

There is also a spike you cannot see in any single tool. Your engagement platform, CRM notifications, marketing automation, and customer success platform may all send from the same root domain on the same day. Each team thinks its volume is small. Together they can exceed what the domain was warmed for.

Why Relevant Sending Is a Deliverability Strategy

Signal-based selling is usually framed as personalization. It is also a deliverability strategy. Smaller sends triggered by real buying signals produce steadier volume, more replies, and fewer complaints, and those are the signals mailbox providers use to judge you.

Mailbox providers read engagement roughly like this:

• Replies: the strongest positive signal
• Rescues from spam: a recipient moving your email to the inbox is strongly positive
• Reading and clicking: moderately positive
• Deleting without reading: weakly negative
• Spam reports: the strongest negative signal

If you run large batch campaigns, break them into smaller sends prioritized by signals such as a new executive, a funding round, or job postings that point to the problem you solve.

Unsubscribes, Engagement, and Open Tracking

Authentication gets you through the door. What recipients do next decides whether you stay there. Three rules from the mailbox providers themselves are worth building into every sequence.

Make leaving easy. Google's sender guidelines say that senders of more than 5,000 messages per day to Gmail accounts must support one-click unsubscribe for marketing and subscribed messages and include a clearly visible unsubscribe link in the message body ^[1]. The same guidelines ask every sender to keep spam rates reported in Postmaster Tools below 0.10% and to avoid ever reaching 0.30% ^[1]. A prospect who cannot find the exit reaches for the spam button instead, and that complaint counts against every later email from your domain.

Stop mailing people who never engage. Google also suggests that senders consider unsubscribing recipients who don't open or read their messages ^[1]. For outbound, that means ending the sequence for contacts who have shown no sign of interest after your planned touches, instead of recycling them into the next campaign. Fewer, better-targeted sends protect the domain your active deals depend on.

Do not judge placement by opens alone. Apple says Mail Privacy Protection prevents senders from seeing if a recipient opened the email message they sent ^[2]. For those recipients, an open in your dashboard is not proof that a person read anything. Check inbox placement with seed accounts across Gmail and Outlook, and treat replies, not opens, as the signal that your mail is landing and being read.

The Quarterly Authentication Audit

Authentication drifts as tools come and go. Review it every quarter:

1. 1Check SPF. Run your domain through an SPF checker, confirm you are inside the 10-lookup limit ^[4], and remove includes for tools you no longer use.
2. 2Review DKIM. Confirm every sending platform signs with its own key, and rotate keys on your security team's schedule. Verify a new key passes before removing the old one.
3. 3Read DMARC aggregate reports. Look for unknown senders and unexpected failures.
4. 4Check subdomain alignment. Each sending subdomain needs SPF and DKIM set up, and your DMARC policy needs to cover it.
5. 5Check blocklists. Run your domains and sending IPs through a blocklist checker. If you are listed, fix the cause first, then follow that list's own delisting process.

Monitoring Tools Worth Using

• Google Postmaster Tools: domain reputation, spam rate, and authentication results for Gmail traffic
• Microsoft SNDS: IP reputation and complaint data for Outlook traffic
• An SPF, DKIM, and DMARC checker such as MXToolbox: record validation and blocklist checks
• A DMARC report processor: turns aggregate reports into a readable list of senders and failures

If You Get Blocklisted

Act quickly but in order. Find and fix the root cause first: a volume spike, a compromised account, or an authentication failure. Then submit delisting requests through each list's own process. While you wait, move outbound to a secondary domain that is already warmed, which is why it pays to keep one ready.

Your Deliverability Fix, Starting Now

Today: Run your primary sending domain through an SPF, DKIM, and DMARC checker. Fix what it flags. Most issues, such as a missing DMARC record or an SPF record over the lookup limit, are DNS changes that take minutes to make and some time to propagate.

This week: Turn on DMARC aggregate reporting if you have not. A record such as v=DMARC1; p=none; rua=mailto:dmarc-reports@yourcompany.com starts the reports. Track how much of your mail passes DMARC, and chase down every legitimate sender that fails.

This quarter: Put the quarterly audit on the calendar now, and make one person accountable for every tool that sends as your domain.

None of this is glamorous. But every email your team researched and wrote deserves a fair chance at the inbox, and the fixes are DNS records and sending discipline, not more copywriting.

References

[1]Google Workspace Admin Help, Email sender guidelines. https://support.google.com/a/answer/81126

[2]Apple Support, Use Mail Privacy Protection on iPhone. https://support.apple.com/guide/iphone/use-mail-privacy-protection-iphf084865c7/ios

[3]Microsoft Tech Community, Strengthening Email Ecosystem: Outlook's New Requirements for High-Volume Senders, 2025. https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook%E2%80%99s-new-requirements-for-high%E2%80%90volume-senders/4399730

[4]IETF, RFC 7208: Sender Policy Framework (SPF), Section 4.6.4. https://www.rfc-editor.org/rfc/rfc7208.txt