Why it matters
Mailbox providers decide whether a message goes to the inbox, the spam folder or nowhere. One of the first things they check is authentication: is this server allowed to send for this domain, and has the message been tampered with? Without it, your replies are more likely to be filtered, and anyone can send email that appears to come from you.
The three records, in plain English
| Record | What it says | Where it lives |
|---|---|---|
| SPF | "These services may send email for my domain." | A TXT record on your domain, e.g. v=spf1 include:_spf.google.com ~all |
| DKIM | "Messages from me carry this signature, and here's the key to check it." | A TXT record your email provider gives you (e.g. google._domainkey) |
| DMARC | "If a message fails those checks, here's what to do with it, and send me reports." | A TXT record at _dmarc.yourdomain.com |
What Gmail and Yahoo require
Since February 2024, Google and Yahoo have required bulk senders (5,000+ messages a day to their users) to have SPF, DKIM and DMARC (at least p=none), aligned with the From address. They must also keep spam complaints below 0.3% and offer one-click unsubscribe on marketing email. Microsoft began enforcing similar rules for high-volume senders in May 2025.
A small business sending a few dozen replies a day isn't a bulk sender, but the same records still help your mail get delivered and stop others impersonating you. Authentication is now simply expected.
Check your own domain
You can look up these records yourself with any free DNS lookup tool. Search for your domain's TXT records and for _dmarc.yourdomain.com. Look for:
- Exactly one record starting
v=spf1. Two SPF records break SPF entirely. - A DKIM record for each service that sends as you (your mailbox, newsletter tool, invoicing software).
- A DMARC record.
p=noneonly monitors.p=quarantineorp=rejectactually protects you.
A safe setup order
- List every service that sends email as your domain. This is the step people skip, and it's what breaks things later.
- Turn on DKIM in your email provider (Google Workspace: Admin console → Gmail → Authenticate email) and in each sending service.
- Publish one SPF record that includes every legitimate sender.
- Publish DMARC at
p=nonewith a reporting address, and read the reports for a week or two. - When only legitimate senders appear, move to
p=quarantine, thenp=reject.
Change one thing at a time and send yourself a test after each change. If something goes wrong, going back a step at the DMARC policy is safe.
If you use a free @gmail.com address
Google handles authentication for gmail.com, so there are no records for you to set. Messages sent from a personal Gmail account are limited to 100 automated recipients a day through Apps Script. A business domain on Google Workspace raises that to 1,500 and looks more professional.
How this applies to Lead Desk
- Replies go out from your own mailbox through Gmail, so they inherit your domain’s authentication. If your domain has no SPF, DKIM or DMARC records, set them up before go-live; we check this in the first conversation.
- Volume stays low by design. One automatic reply per address per day, hourly and daily caps, and at most three follow-ups per inquiry, all in the same thread.
- Every message offers a way out. The footer asks customers to reply “stop”, and Lead Desk honours it at the next hourly check.
- Daily limits apply. Apps Script can email about 100 recipients a day from a free Gmail account and more on Google Workspace. Lead Desk keeps part of the quota for your own alerts.