How to Set Up SPF, DKIM and DMARC for Media Outreach Email: Gmail's 5,000-a-Day Rule, Spam Rate and One-Click Unsubscribe

What Is Email Authentication for Media Outreach?

Email authentication for media outreach is the set of three DNS records (SPF, DKIM and DMARC) that let a receiving mail system confirm that your domain really sent the pitches, newsletters and press releases that carry its name.

In Google's description, SPF stops others sending unauthorized mail that appears to come from your domain, DKIM lets receivers verify the domain owner sent a message, and DMARC tells receiving servers what to do with mail that fails SPF or DKIM (Gmail sender guidelines). This guide is for a communications team sending pitches and list mail from its own domain. The message itself is covered in how to pitch a journalist by email; email law is covered in does CAN-SPAM apply to PR outreach. This is not legal advice.

How to Set Up SPF, DKIM and DMARC at a Glance

Time: about an hour of hands-on work, plus 48 hours between DKIM and DMARC (our estimate; the wait is Google's advice). Tools: DNS access, admin access to each sending tool, a Google account for Postmaster Tools. Cost: Google lists no fee for Postmaster Tools; check whether your email platform's plan includes custom-domain DKIM. Skill level: comfortable editing DNS records, or able to brief whoever manages them.

What You Need Before Starting

• Control of the domain's DNS, or a colleague or vendor who has it. Google says to set up authentication “for all of your sending domains at your domain provider” (Google).
• A list of every sender that uses your domain in the From: address (Step 1).
• A decision on what is list mail. Google defines a subscription message as “any email message sent to a mailing list that recipients can unsubscribe from”, and treats password resets, receipts and one-time passwords as transactional (Google).
• A Google account for Postmaster Tools, and a personal Gmail address for test messages.

Does Gmail's 5,000-a-Day Rule Apply to a PR Team?

Usually not in full, but part of the rules applies to everyone. The requirements for all senders are SPF or DKIM, valid forward and reverse DNS, TLS, correctly formatted messages and a Postmaster Tools spam rate below 0.3% (Gmail sender guidelines). The stricter set applies to senders of more than 5,000 messages a day to personal Gmail accounts. Three details matter for a small team:

• The line is approximate. The guidelines say “more than 5,000” in one place and “5,000 or more” in another; the FAQ says “close to 5,000 messages or more to personal Gmail accounts within a 24-hour period” (Google FAQ).
• Volume is counted by primary domain. “Messages sent from the same primary domain count toward the 5,000 limit”, so a subdomain does not start a fresh count (Google FAQ).
• Status is permanent. One large newsletter or announcement send to Gmail addresses can move a domain into the stricter group for good.

The rules govern mail to personal Gmail accounts only. If most of your media list uses newsroom domains on Google Workspace, Gmail's bulk rules do not apply to those messages, although each receiving system has its own filters. Our recommendation, not a Google rule: set up all three records whatever your volume. Google itself says, “we recommend that you always set up SPF, DKIM, and DMARC for your domains” (Gmail sender guidelines).

Step 1: List Every System That Sends as Your Domain

Write down each service that sends mail with your domain in the From: address: the mailbox provider, any mail-merge or outreach tool, a newsletter platform, a CRM or press-release distribution tool, and website contact forms. Expected result: one row per sender, with its admin owner. Verify: ask each team that sends email which tool it uses. Common mistake: forgetting a tool, which then fails SPF; Google says senders left out of the SPF record make messages more likely to be marked as spam (Gmail sender guidelines).

Step 2: Publish One SPF Record That Covers All Senders

SPF is a TXT record at your domain listing the servers allowed to send for it. For a domain that sends only through Google Workspace, Google's example is v=spf1 include:_spf.google.com ~all, and it says “Google recommends you use ~all in your SPF record” (Google Workspace Help).

Process: add each tool's published include value to that single record. The SPF standard says a domain “MUST NOT have multiple records” that would make a check select more than one, and limits the terms that cause DNS lookups (include, a, mx, ptr, exists and redirect) to 10; above that, the check returns a permanent error (RFC 7208). Google's page puts the same ceiling as “up to 10 include: tags.” Expected result: one TXT record beginning v=spf1. Verify: look the domain up in the Google Admin Toolbox, which Google's guidelines suggest for checking domain settings. Common mistake: a second SPF record added by a new tool's setup wizard.

Step 3: Turn On DKIM Signing, Preferably With a 2048-Bit Key

DKIM adds a signature to each message that receivers check against a public key in your DNS. Google says “Sending to personal Gmail accounts requires a DKIM key of 1024 bits or longer” (Gmail sender guidelines). Its Workspace setup page adds: “If your domain provider supports 2048-bit keys, select this option”; the record type is TXT and the default selector is google (Google Workspace Help).

Process: in each sending tool, open the domain authentication or DKIM setting, generate a key for your domain and publish the record it gives you (some tools use CNAME records instead). Expected result: each tool shows the domain as authenticated. Common mistake: leaving an outreach tool signing with its own domain, which fails alignment in Step 5.

Step 4: Publish a DMARC Record, Starting at Policy None

DMARC is a TXT record at _dmarc under your domain. Google advises allowing “48 hours after setting up SPF and/or DKIM before setting up DMARC”, and says “When you start using DMARC, we recommend setting the policy option (p) to none” (Google Workspace Help). A minimal starting record, with your own reporting address, is:

Host: _dmarc.example.com
Type: TXT
Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

The v and p tags must come first, and the rua address must start with mailto: (Google). A policy of none meets Gmail's bulk requirement but does not ask receivers to quarantine or reject spoofed mail; Google suggests moving to quarantine or reject over time. The DMARC standard itself was updated in May 2026: RFC 9989, a Standards Track document, obsoletes RFC 7489 and removes the pct tag, while records still begin v=DMARC1 (RFC 9989). Verify: a DNS lookup of _dmarc returns exactly one record starting v=DMARC1. Common mistake: jumping to p=reject before every sender in Step 1 passes.

Step 5: Check That the From: Domain Aligns

For direct mail, bulk senders' From: domain “must be aligned with either the SPF domain or the DKIM domain” (Gmail sender guidelines). Google's FAQ says “only one of these needs to be aligned”, recommends both, and adds: “It's likely that DMARC alignment with both SPF and DKIM will eventually be a sender requirement” (Google FAQ). Process: send a test from each tool and confirm the DKIM d= domain or the Return-Path domain matches your From: domain. Expected result: DMARC passes. Common mistake: a newsletter platform's shared sending domain in the Return-Path with no custom DKIM.

Step 6: Add One-Click Unsubscribe to List Mail

Bulk senders' “Marketing messages and subscribed messages must support one-click unsubscribe” and include “a clearly visible unsubscribe link in the message body” (Gmail sender guidelines). Google's example headers, defined in RFC 8058, are:

List-Unsubscribe-Post: List-Unsubscribe=One-Click
List-Unsubscribe: <https://example.com/unsubscribe/example>

The FAQ says the requirement covers marketing and promotional messages only, not transactional ones; that “Including a mailto link in the body of your messages doesn't meet our one-click unsubscribe requirement”; and that the header needs one HTTPS URL. It also says “Message recipients, not Google, determine the nature of the messages they receive” (Google FAQ). Google's subscription guidelines say to “Process and honor unsubscribe requests within 48 hours” (Google); Yahoo says “Honor unsubscribes within 2 days” (Yahoo).

A newsletter to journalists is list mail. A single individually written pitch is not sent to a mailing list, and the Google pages we read do not say how Gmail treats it. Verify: the two headers appear in a test message's source. Common mistake: assuming the platform adds the headers without checking.

Step 7: Add and Verify the Domain in Postmaster Tools

1. Sign in to Postmaster Tools, click Add new domain, enter the domain and click Create. Google says to “Add either the DKIM (d=) domain or the SPF (Return-Path) domain.”
2. Choose Verify domain, copy the TXT or CNAME record into your DNS, return and click Verify. Google says it “can take up to 10 minutes” for the status to update.
3. Optionally add colleagues; “Postmaster Tools does not automatically notify them” (Google).

Subdomains of a verified domain can be added for separate dashboards without separate verification (Google).

What Are the Bulk-Sender Rules at Gmail, Yahoo and Microsoft?

Microsoft says non-compliant mail from high-volume senders “will be sent to the junk folder” and, if issues persist, may be rejected with “550; 5.7.515 Access denied” (Microsoft). The chart compares the one figure Gmail and Yahoo both publish.

The chart shows both providers drawing the line at 0.3%, while Google's own target for senders is a third of that.

Step 8: Read Spam Rate, Authentication and Errors

Postmaster Tools lists dashboards for compliance status, spam rate, IP and domain reputation, feedback loop, authentication, encryption and delivery errors (Google). Read three first:

• Spam rate: the share of messages recipients mark as spam. Google says to keep it “below 0.10%” and “avoid ever reaching a spam rate of 0.30% or higher” (Gmail sender guidelines).
• Authentication: trace any failing SPF, DKIM or DMARC share to a sender from Step 1.
• Delivery errors and compliance status: the FAQ lists 4.7.27 (SPF did not pass), 4.7.30 (DKIM did not pass), 4.7.31 (no DMARC record) and 4.7.32 (From: not aligned).

Small senders may see nothing: “Data might be missing if the total number of messages for a given day is too low” (Google). An empty dashboard is not proof of compliance.

How to Verify It Worked

• Records: the Admin Toolbox finds one SPF record, a DKIM record for each tool and a DMARC record.
• Headers: send a message from each tool to a personal Gmail address, then open it and choose More, then Show original (Gmail Help). SPF, DKIM and DMARC should each read PASS, with your domain as the signing or Return-Path domain.
• Unsubscribe: list mail carries both one-click headers, and the URL removes a test address.
• Monitoring: the domain is verified in Postmaster Tools.

Common Problems and Fixes

What Not to Do

• Do not treat authentication as a delivery guarantee. Consequence: authenticated mail can still be filtered. Correction: Google says only that authenticated messages are “less likely to be rejected or marked as spam”.
• Do not buy, scrape or blast lists. Consequence: spam reports that push the rate toward 0.3%. Correction: Google says “Don't send messages to people who didn't sign up to get messages from you”; for pitches, send fewer, individually relevant emails from a carefully built media list and honor every opt-out.
• Do not rely on a mailto or footer link alone. Consequence: list mail fails the one-click requirement. Correction: add the Step 6 headers.
• Do not send test phishing messages from your domain. Consequence: Google warns against it. Correction: our recommendation is a separate domain for simulations.
• Do not spike volume. Consequence: Google says “immediately doubling previously sent volumes suddenly could result in rate limiting or reputation drops.” Correction: raise volume gradually.

Authentication affects whether a message is delivered, not whether anyone covers the story.

Frequently Asked Questions

Sources and Methodology

This guide is built from Google's Gmail sender guidelines, its sender requirements FAQ, subscription guidelines and Postmaster Tools help pages, Google Workspace's SPF, DKIM and DMARC setup pages, Yahoo's Sender Hub, Microsoft's Outlook.com sender policy and the IETF standards for SPF, DMARC and one-click unsubscribe, all read on October 11, 2026. Google has moved its Workspace help pages to knowledge.workspace.google.com, and we link the current addresses. The time estimate, the step order and the advice to set up all three records at any volume are our recommendations, not provider rules. We did not test a setup, send test messages or open Postmaster Tools for this guide. No provider promises inbox placement, and neither does this guide.

1. official Google, Email sender guidelines, Gmail Help. Requirements for all and bulk senders, 5,000 threshold, spam-rate figures, DKIM key length, DMARC policy, one-click headers, personal-account definition. Read October 11, 2026.
2. official Google, Sender requirements & Postmaster Tools FAQ, Google Workspace Help. Bulk-sender definition, permanent status, November 2025 enforcement, Workspace exclusion, alignment, unsubscribe scope, error codes, mitigation. Read October 11, 2026.
3. official Google, Email subscription guidelines for senders and Top 10 Gmail sender issues, Gmail Help. Subscription versus transactional mail, 48-hour unsubscribe, setup at the domain provider. Read October 11, 2026.
4. official Google, Set up Postmaster Tools and Postmaster Tools dashboards, Gmail Help. Domain verification, low-volume data gaps, dashboard list. Read October 11, 2026.
5. official Google, Set up SPF, Set up DKIM and Set up DMARC, Google Workspace Help; Trace an email with its full header, Gmail Help. Example records, key length, 48-hour wait, p=none start, Show original. Read October 11, 2026.
6. official Yahoo, Sender Best Practices, Yahoo Sender Hub. Requirements for all and bulk senders, 0.3% spam rate and its basis, two-day unsubscribe. Read October 11, 2026.
7. official Microsoft, Policies, Practices, and Guidelines, Outlook.com postmaster. Requirements for domains sending more than 5,000 emails a day, effective May 5, 2025; junk and 550 5.7.515 handling. Read October 11, 2026.
8. standards IETF, RFC 7208: Sender Policy Framework (April 2014), RFC 9989: DMARC (May 2026) and RFC 8058: Signaling One-Click Functionality for List Email Headers (January 2017). Single-record rule, 10-lookup limit, DMARC status and tags, one-click headers. Read October 11, 2026.