Every startup email - receipts, password resets, onboarding sequences, the cold outreach you finally worked up the nerve to send - rides on three DNS-level protocols: SPF, DKIM and DMARC. Gmail's sender guidelines recommend setting up all three for every domain, and the stakes are explicit: messages that are not authenticated with these methods might be marked as spam or rejected with a 5.7.26 error. If your email service provider handles sending, verify that it authenticates your domain's email with SPF and DKIM rather than assuming it does.
What each record does
SPF publishes which servers may send mail for your domain. DKIM adds a cryptographic signature that proves the message was authorized by the domain and not altered in transit. DMARC ties them together with a policy: it tells receivers what to do when checks fail, and it introduces alignment - for direct email, the domain in the sender's From: header must be aligned with either the SPF domain or the DKIM domain to pass DMARC alignment.
The 5,000-message line
Gmail draws a hard line at volume. If you send more than 5,000 messages per day to Gmail accounts, a stricter set of requirements applies. As published on Google's sender guidelines page (checked October 22, 2026), bulk senders must set up SPF and DKIM authentication for the domain, set up DMARC authentication for the sending domain - and the enforcement policy can be set to none at first. Sending domains or IPs need valid forward and reverse DNS records (PTR records), mail must use a TLS connection, and the spam rate reported in Postmaster Tools must stay below 0.3%.
Two details that bite startups
First, formatting: messages must follow the Internet Message Format standard, RFC 5322, and you must not impersonate Gmail From: headers - Gmail applies a DMARC quarantine enforcement policy and impersonating its headers can impact your delivery. Second, unsubscribing: marketing and subscribed messages must support one-click unsubscribe and include a clearly visible unsubscribe link in the message body.
Check your own state first
Before changing anything, confirm what your email provider already does: Google's guidelines note that if you use an email service provider, you should verify it authenticates your domain's email with SPF and DKIM. Sign up for Postmaster Tools to see the spam rate Gmail reports for your domain, since staying below 0.3% is a published requirement at bulk volume. And if you run any forwarding - a classic startup alias setup - follow Google's forwarding best practices so forwarded messages stay authenticated too.
A sane setup order
Start with SPF and DKIM through your email provider's domain-verification flow, then publish a DMARC record at p=none and read the reports before tightening. Forwarders should follow Google's forwarding best practices so forwarded mail stays authenticated. The work is an afternoon of DNS edits - each protocol is a TXT record on your domain - and it is worth doing before your first launch email, not after your first spam-folder report. The payoff is that the emails your product depends on actually arrive, and that tightening to a stricter DMARC policy later is a change you make on your own schedule.