Email Authentication Checklist for Small Businesses

If the words "SPF", "DKIM" and "DMARC" make your eyes glaze over, you are not alone. Most owners of cleaning, HVAC, roofing, plumbing and landscaping businesses never signed up to be email engineers. But here is the uncomfortable truth: since early 2024, the biggest inbox providers on earth — Gmail and Yahoo — will quietly send your emails to spam, or refuse them outright, if your domain is not authenticated. The good news is that email authentication is not nearly as complicated as it looks, and once it is done correctly it mostly runs itself.

This is a plain-language checklist. No jargon left unexplained, no assumptions that you know what a DNS record is. Work through it once and your appointment reminders, quotes and newsletters will start landing where customers actually see them.

What "email authentication" really means

Think of authentication as showing ID at the door. When you send an email, the receiving server — Gmail, Yahoo, Outlook — wants proof that the message genuinely came from your business and was not forged by a scammer pretending to be you. Authentication is a small set of records you publish on the internet that let any receiver check that proof automatically, in a fraction of a second.

Without those records, your email looks like a stranger with no ID trying to walk into a building. The receiver has two choices: turn it away, or let it in but keep a close eye on it (the spam folder). With authentication in place, your email walks up, shows a valid badge, and gets waved through to the inbox. That is the entire idea. Everything below is just how to create the badges.

Why this matters more in 2026 than ever before

In February 2024, Google and Yahoo rolled out shared sender requirements that are now simply the cost of entry. Any domain that sends 5,000 or more messages a day to Gmail addresses is permanently treated as a "bulk sender" and must authenticate. But do not assume you are safe just because you send less — both providers have made clear that authenticated mail is favoured across the board, and unauthenticated mail is increasingly filtered even at low volume.

The requirements are non-negotiable: you must authenticate with both SPF and DKIM, publish a DMARC record, include a one-click unsubscribe in marketing email, and keep your spam complaint rate low. Miss any of these and delivery suffers. For the full breakdown of the rules, see our guide to the Gmail and Yahoo sender requirements.

The three records, in plain English

There are exactly three authentication records. Here is what each one does, without the acronym headache:

• SPF is the guest list. It says "these servers are allowed to send email for my domain." If a message comes from a server that is not on the list, that is a red flag.
• DKIM is the tamper-proof seal. It adds an invisible digital signature to every message so the receiver can confirm the email was not altered in transit and really came from you.
• DMARC is the rulebook. It tells receivers what to do when a message fails SPF and DKIM — ignore it, send it to spam, or reject it — and it asks them to send you reports.

If you want the deeper mechanics of how these three work together, our companion article on SPF, DKIM and DMARC explained walks through every piece. For this checklist, the summaries above are all you need.

Step 1: Publish your SPF record

SPF (Sender Policy Framework) lives as a single TXT record in your domain's DNS settings — the same control panel where you manage your website address. It lists the mail servers permitted to send on your behalf. If you use an email platform to send campaigns, that platform gives you the exact value to paste in.

One technical trap worth knowing about: the SPF standard (RFC 7208) allows a receiver to perform a maximum of 10 DNS lookups when checking your record. Pile on too many services and you blow past that limit, which produces an error that DMARC treats as a failure — and your mail can be rejected. This is precisely the kind of hidden landmine that catches do-it-yourself setups. Direct IP addresses do not count toward the limit, but each "include" for another service does.

Step 2: Turn on DKIM

DKIM (DomainKeys Identified Mail) is the digital seal. Your email platform generates a pair of cryptographic keys; you publish the public half as a DNS record, and the platform keeps the private half to sign every outgoing message. When Gmail receives your email, it uses the public key to verify the signature. If the seal is intact, the message is trusted.

The current best-practice key length is 2048-bit RSA — older 1024-bit keys are considered weak. A 2048-bit public key is long enough that it sometimes has to be split across the DNS record, which is normal. Once DKIM is live, it is invisible to your customers and requires no ongoing attention.

Step 3: Add your DMARC record

DMARC (Domain-based Message Authentication, Reporting and Conformance) ties SPF and DKIM together and tells the world what to do with mail that fails them. It is also a TXT record. The key part is the policy, written as p=none, p=quarantine or p=reject.

Start with p=none. It changes nothing about delivery — it simply asks receivers to send you reports so you can see who is sending mail using your domain. After a few weeks of clean reports, you tighten to quarantine (fails go to spam) and eventually reject (fails are blocked). Gmail and Yahoo require at least p=none, so this record is mandatory, not optional. Our plain-English breakdown of DMARC policy covers the safe rollout in detail.

Step 4: Turn on one-click unsubscribe

For any marketing or bulk email, Gmail and Yahoo now require a working one-click unsubscribe — a special header (technically List-Unsubscribe with List-Unsubscribe-Post) that lets a recipient leave your list in a single tap, without logging in or filling out a form. You must also honour those requests within two days.

This is not just a rule to tick off; it is a deliverability tool. A frustrated recipient who cannot find the unsubscribe link will hit "report spam" instead, and spam complaints are far more damaging to your reputation than an unsubscribe. Making the exit easy protects your inbox placement.

Step 5: Watch your spam complaint rate

Google asks senders to keep their spam complaint rate below 0.1% and warns that you should never exceed 0.3%. In plain numbers, that means fewer than one complaint per thousand emails as your target, and a hard ceiling of three per thousand. Cross that ceiling and Gmail will start filtering you aggressively.

You keep complaints low by emailing people who actually asked to hear from you, sending relevant content, and cleaning your list of dead addresses. If your mail is landing in spam despite authentication, our guide on why emails go to spam covers the behavioural causes beyond the technical ones.

The complete checklist

Here is everything on one page. Print it, work through it, and tick each box:

• SPF record published as a TXT record, listing every service that sends for you, under the 10-lookup limit.
• DKIM enabled with a 2048-bit key, public key published in DNS.
• DMARC record published, starting at p=none with a reporting address.
• SPF or DKIM aligned with your visible "From" domain (at least one must match).
• One-click unsubscribe active on all marketing email, honoured within two days.
• Spam complaint rate monitored and kept well under 0.3%.
• A dedicated sending subdomain so your marketing mail does not put your main business email at risk.

Common mistakes that quietly break authentication

The setups that fail almost always fail the same handful of ways. Two SPF records on the same domain (you are only allowed one, merged into a single record). More than 10 DNS lookups in SPF. DKIM signed with a domain that does not match your "From" address, which breaks alignment. A DMARC record left at p=none forever, so it never actually protects anything. And using your everyday business domain for bulk campaigns, so one bad send drags down the reputation of the address you use to talk to suppliers and staff.

Every one of these is avoidable, but every one requires knowing it exists — which is exactly why so many small businesses get it subtly wrong and never understand why their open rates are low.

How Mailmundo does all of this for you

Here is the part that removes the headache entirely. Mailmundo is built deliverability-first for trades and service businesses, and it handles the entire authentication stack for you. You get a managed sending subdomain with SPF, DKIM and DMARC configured correctly from the start — no DNS lookup limits to trip over, no key lengths to worry about, no alignment mistakes. One-click unsubscribe and CAN-SPAM compliance are built into every campaign automatically, and the platform is aligned with the Gmail and Yahoo 2026 rules out of the box.

In other words, the checklist above becomes something the platform guarantees rather than something you have to engineer. You focus on the message and the customer; the authentication just works. That same foundation supports your automated sequences and everyday campaigns, so reminders and follow-ups land in the inbox instead of the spam folder.

Frequently asked questions

Do I really need all of this if I only send a few hundred emails?

Yes. The 5,000-a-day bulk threshold is where authentication becomes strictly enforced, but authenticated mail is favoured at every volume, and unauthenticated mail is increasingly filtered even for small senders. Setting it up once protects you now and as you grow.

Will authentication fix all my spam problems?

It fixes the technical half. Authentication proves you are who you say you are, but you still have to send content people want and keep your list clean. Both halves matter, which is why our deliverability guide treats them together.

How long does setup take?

DNS records themselves take minutes to publish, though they can take a few hours to spread across the internet. With a managed platform that does it for you, the practical answer is close to zero effort on your side.

Can I use my regular business email for campaigns?

You can, but you should not. A dedicated sending subdomain keeps your marketing reputation separate from the email you use for quotes and suppliers, so one problem never poisons the other.