You send an estimate, the customer never sees it, and three days later you find out it went to spam. Sometimes that is bad luck. Two things that decide it are in your hands: the address the estimate is sent from, and three short records on your domain called SPF, DKIM and DMARC. Gmail and Yahoo now require at least part of that set from every sender, and both have enforced their rules since February 2024.
What Gmail and Yahoo check now
Google's email sender guidelines say that starting February 1, 2024, everyone who sends email to Gmail accounts must meet a basic set of requirements. The ones that matter to a contractor:
Google's monitoring advice on the same page sets a tighter aim: below 0.10 percent, and never reaching 0.30 percent or higher.
Anyone sending more than 5,000 messages a day to Gmail accounts has to go further: SPF and DKIM, a DMARC record (a policy of “none” is enough), a From address whose domain aligns with the SPF or DKIM domain, and one-click unsubscribe on marketing mail.
Yahoo's Sender Hub sets out nearly the same list. Every sender needs SPF or DKIM at a minimum, a spam rate below 0.3 percent, valid forward and reverse DNS, and messages that follow the email standards (RFCs 5321 and 5322). Bulk senders need both SPF and DKIM, a valid DMARC policy of at least p=none that passes, alignment, a working one-click unsubscribe, and unsubscribes honored within two days.
A spam rate of 0.3 percent is three complaints for every 1,000 messages. On a small list it takes very few: two complaints on a 500-address newsletter is 0.4 percent.
Why a free webmail address hurts
If you send everything from a Gmail or Yahoo address, including the estimates your invoicing or estimating software sends for you, that last part is the problem. When software sends a message “from” your gmail.com address through its own servers rather than through your Gmail account, the message leaves the software's servers, not Google's, and Google's guidelines speak to that directly: don't impersonate Gmail From: headers, because Gmail will begin using a DMARC quarantine enforcement policy, and impersonating Gmail From: headers might affect delivery.
You also cannot fix it. SPF, DKIM and DMARC are records on a domain, and you do not control gmail.com. The anti-abuse industry group M3AAWG puts the cost plainly in its sender best practices: if you are not sending from a domain you control, you are not able to build a reputation on that domain for your brand. A domain you own, the same one your website runs on, is where your sending reputation can grow. If you are still choosing what goes on that website, see the website pages a contractor needs.
The three records in plain words
Setting them up, step by step
The steps below use Google Workspace's own help pages as the example. Other email hosts publish their own values for the same three records; the order of work is the same.
1. List everything that sends as your domain. Your mailbox host, your estimating or invoicing software, your website's contact form, any newsletter tool. Each one has to be covered by SPF or DKIM, or its mail will fail the checks once DMARC is in place.
2. Publish one SPF record. For a domain that sends only through Google Workspace, Google gives the value “v=spf1 include:_spf.google.com ~all”, added as a TXT record at your domain host. Two rules from the SPF standard itself, RFC 7208, catch people out: a domain must not publish more than one SPF record, so every other sender is added into that same record, and a check may make no more than 10 DNS lookups. Break either rule and the check ends in an error instead of a pass. Google says it can take up to 48 hours for SPF to start working.
3. Turn on DKIM. In the Google Admin console you generate a key (Google recommends 2048-bit where your domain host supports it), add the public key as a TXT record named “google._domainkey”, then click Start authentication. Google says DKIM can take up to 48 hours to start working. Every other service that sends as your domain has its own domain-authentication steps; do them for each one.
4. Add DMARC, starting gently. Google advises waiting 48 hours after SPF and DKIM are set up. The record is a TXT record at “_dmarc.yourdomain.com”. Start with a policy of “p=none” and a reporting address (“rua=mailto:” followed by the address). Google's page describes p=none as taking no action on the message and delivering it, while logging messages in a daily report; it suggests a dedicated mailbox for the reports, because they can arrive in volume. Google's suggested path is then to move to “p=quarantine” and finally “p=reject”, raising the percentage of mail the policy covers as your reports show everything passing.
5. Test. Send a message to someone who uses Gmail (Google notes you cannot verify DKIM by sending yourself a test). In Gmail, open it, choose More and then Show original, and look in the Authentication-Results line for DKIM=pass. If there is no DKIM result at all, the mail is not being signed yet.
A worked example
Say a painter runs everything from a free webmail address. The invoicing app sends estimates “from” that address, and some customers say they never got them. The fix, in order: register a domain (or use the one the website already has), set up a mailbox on it, publish SPF with both the mailbox host and the invoicing app in the single record, turn on DKIM for both, wait two days, add DMARC at p=none with a reporting address, and switch the invoicing app to send from the new address. Two weeks of clean DMARC reports later, the painter moves the policy to quarantine.
Habits that keep you out of spam
If you send estimates from the office in our tools, each one goes by email as a link with your own address as the reply-to, so a customer's answer comes straight back to you.