New email rules for SaaS: SPF, DKIM, and DMARC compliance guide

Major email providers have shifted from soft filtering to hard rejection for non-compliant senders. Since early 2024, Gmail and Yahoo have enforced bulk sender requirements, with Microsoft joining in May 2025. These changes affect any software team sending automated messages to user inboxes, requiring precise DNS configuration and stream separation to maintain deliverability.

What happened

The landscape of email delivery changed significantly over the last two years as major providers tightened security against spoofing and spam. In February 2024, Google and Yahoo introduced new bulk sender requirements that moved beyond simple spam foldering to outright rejection of unauthenticated mail. Microsoft followed suit for Outlook.com users in May 2025, implementing similar strict checks. The goal is to ensure that every email reaching a consumer inbox can be cryptographically verified as coming from the claimed domain.

These rules apply most strictly to senders transmitting more than 5,000 messages per day to a single provider’s consumer accounts. However, the technical requirements for authentication apply to all senders, regardless of volume. Providers use these signals to determine reputation, meaning even small startups can face delivery issues if they neglect basic setup. A sudden product launch or marketing blast can push a low-volume sender over the threshold instantly, triggering stricter enforcement without warning.

The core of these updates revolves around three DNS-based authentication protocols: SPF, DKIM, and DMARC. Providers now require alignment between these records and the visible "From" address. If the technical envelope sender does not match the domain users see, the message fails authentication. Microsoft has become particularly strict, returning specific error codes like 550 5.7.515 when authentication levels are insufficient, forcing developers to fix DNS records rather than tweaking email content.

Key details

• Bulk sender threshold: Approximately 5,000 messages per day to one provider’s consumer mailboxes triggers strict bulk sender classification.
• SPF limits: SPF records must not exceed 10 DNS lookups; exceeding this causes a permanent error equivalent to having no SPF record.
• DKIM key size: Use 2048-bit keys where supported, and ensure every tool sending on your behalf signs with your specific domain.
• DMARC policy: Start with p=none for monitoring, then move to p=quarantine or p=reject once alignment is confirmed.
• Unsubscribe standard: Marketing emails must include RFC 8058 one-click unsubscribe headers, with opt-outs processed within two days.
• Stream separation: Transactional and marketing emails should use different subdomains to isolate reputation risks.

Background

To understand these requirements, it helps to know how email authentication works. SPF (Sender Policy Framework) is a DNS text record that lists IP addresses authorized to send mail for your domain. DKIM (DomainKeys Identified Mail) adds a digital signature to each message, which receivers verify using a public key published in your DNS. DMARC (Domain-based Message Authentication, Reporting, and Conformance) ties these together by checking if the domain in the "From" header aligns with the domains that passed SPF or DKIM checks.

Alignment is the most common point of failure. If your email provider signs messages with their own domain instead of yours, DMARC will fail even if SPF and DKIM technically pass. This is why using a dedicated subdomain for sending, such as mail.example.com, is critical. It allows you to control the DNS records and ensures that the authentication results match the visible sender address. Without this alignment, providers like Outlook will reject the message entirely.

Why it matters

For teams running self-hosted software or SaaS products, email deliverability is directly tied to user trust and retention. If password reset emails land in spam or are rejected, users cannot access their accounts, leading to support tickets and churn. The shift from soft filtering to hard rejection means there is no second chance for misconfigured messages. Once a domain is flagged for poor authentication or high complaint rates, recovering reputation is difficult and time-consuming.

Operational stability also depends on separating email streams. Marketing campaigns often generate higher spam complaint rates than transactional messages. If both types of email come from the same domain or IP pool, a poorly received newsletter can damage the reputation of critical system notifications. By isolating these streams, you ensure that marketing experiments do not jeopardize the delivery of security alerts and billing receipts. This separation is now a best practice enforced by provider algorithms.

Furthermore, monitoring these metrics provides early warning signs of infrastructure issues. Tools like Google Postmaster Tools and DMARC aggregate reports reveal if unauthorized services are sending mail as your domain or if legitimate tools are misconfigured. Ignoring these signals can lead to sudden blacklisting. Proactive management of DNS records and sender reputation is no longer optional for any team relying on email for user communication.

What you can do

• Audit DNS records: Verify that you have only one SPF record per domain and that it includes all current sending services without exceeding 10 lookups.
• Implement DMARC monitoring: Publish a DMARC record with p=none and a reporting email address to receive daily XML aggregates from providers.
• Separate sending domains: Configure distinct subdomains for transactional and marketing emails to isolate reputation and prevent cross-contamination.
• Enable one-click unsubscribe: Add RFC 8058 headers to all marketing emails, ensuring the unsubscribe link processes requests immediately without login.
• Check reverse DNS: If self-hosting your mail server, ensure every sending IP has a PTR record that resolves back to the correct hostname.
• Monitor complaint rates: Use Google Postmaster Tools and Microsoft SNDS to track spam complaints, keeping them below 0.1% to avoid throttling.

Keep your domain and certificate status visible to prevent unrelated outages from compounding email issues.