What are SPF, DKIM, and DMARC, in short?

Three DNS records that together prove to receiving mail servers that an email really was sent by the domain it claims to come from. SPF lists which servers are allowed to send on behalf of a domain, DKIM signs every email with a cryptographic signature that can't be forged, and DMARC decides what happens when those checks fail - and gives you reports on who's actually sending mail as your domain, including impersonation attempts you wouldn't otherwise know about.

Do these rules only apply to businesses sending thousands of emails a day?

Officially, Google's threshold is around 5,000 messages a day to personal Gmail accounts to be classified as a bulk sender. In practice, any business sending automated email through a CRM platform like GoHighLevel shares sending infrastructure with many other accounts, so an unauthenticated domain gets hurt long before the business itself reaches that volume on its own.

What actually happens if an email doesn't meet the authentication requirements?

Google temporarily or permanently rejects the message, depending on the severity. Best case it lands in spam, worst case it never arrives at all - and without Postmaster Tools set up on the domain, there's usually no way to know it's happening.

← All Articles

Automation · Aug 31, 2026 · May I

Automated Emails Landing in Spam - Google and Yahoo's 2026 Sender Rules, and Why SPF, DKIM, and DMARC Aren't Optional Anymore

Short answer: if reminders, follow-ups, or campaigns sent automatically from GoHighLevel are landing in spam or not arriving at all, the most common reason is that the sending domain doesn't meet the authentication requirements Google and Yahoo jointly began enforcing in February 2024. The fix has nothing creative about it and nothing to do with the email's content - it's purely technical: configure SPF, DKIM, and DMARC correctly on the domain that's actually sending the mail, instead of relying on whatever default the platform set up on install.

What Google and Yahoo actually required

Starting in February 2024, Google classifies any sender pushing roughly 5,000 or more messages to personal Gmail accounts within 24 hours as a "bulk sender," and requires full authentication from them - both SPF and DKIM, with at least one aligned to a DMARC policy of p=none or stronger. Yahoo adopted a parallel policy on the same timeline. Source: support.google.com.

Alongside authentication, both companies also require one-click unsubscribe on every marketing or promotional email, with unsubscribe requests processed within two days. That matters directly for anyone running automated follow-up sequences - every such email counts as "commercial" even when it's sent from a CRM rather than a classic newsletter platform.

Who actually needs to meet these requirements

Google's official threshold is around 5,000 emails a day to personal accounts - that sounds high for a small business. But in practice, a business sending automated email through GoHighLevel isn't sending from private infrastructure - it shares sending infrastructure with hundreds of other accounts on the same platform. An unauthenticated domain there looks to Google exactly like an unauthenticated domain sending at bulk volume, so the deliverability hit starts long before the business itself reaches meaningful volume. There's no real "too small for this to matter" - it's a matter of domain configuration, not business size.

The three mechanisms, briefly

SPF - a DNS record listing which servers are authorized to send email on behalf of your domain. Without it, any server can impersonate the domain.
DKIM - a cryptographic signature attached to every email that proves it wasn't altered in transit. Without DKIM, the receiving mail server can't verify the content is genuine.
DMARC - the policy that tells the receiving server what to do when SPF or DKIM fail, and returns reports showing exactly who is sending email as your domain - including impersonation attempts you wouldn't otherwise know about.

What happens if you don't meet the requirements

Since November 2025, Google has been ramping up enforcement against non-compliant traffic, and the consequence is temporary or permanent rejection of the message - not just a spam-folder landing. Source: support.google.com. The practical problem: without Google Postmaster Tools set up on the domain, there's usually no way to know it's happening at all - the automated reminder shows as "sent successfully" inside GoHighLevel, but it never reached its destination.

What this means in practice for anyone running automation in GHL

Connect a dedicated sending domain (a subdomain like mail.yourbusiness.com) instead of sending from a free or shared address.
Configure SPF, DKIM, and DMARC at the DNS level for that domain - don't rely on the platform's default.
Make sure every automated email includes a proper unsubscribe link, including reminders and follow-ups that don't feel like "marketing."
Track delivery and spam rates through Postmaster Tools - don't assume they're fine just because there are no complaints.

This isn't content work and it isn't design work - it's infrastructure. But it's the explanation behind most of the "the automation is configured correctly, so why isn't anyone responding" cases we run into with clients.

Is your automation actually reaching its destination?

We configure and verify sending infrastructure - domain, SPF, DKIM, DMARC - as part of setting up your GoHighLevel automation, not as an afterthought once something's already broken.

Get started