Gmail moved to rejecting non-compliant mail in November 2025, Outlook.com has sent non-compliant bulk mail to junk since May 2025, and DMARC became an IETF Proposed Standard in 2026 (RFC 9989). What the three records do, what each mailbox provider requires, and how to keep marketing from sinking your password resets.
Email from your app claims to come from your domain. Mailbox providers check three DNS records to decide whether to believe it, and since 2024 the largest have made those checks mandatory.
The 2015 DMARC specification (RFC 7489) was informational. In 2026 it was replaced by RFCs 9989, 9990 and 9991, which put DMARC on the standards track. Existing v=DMARC1 records keep working. The new version drops the pct= sampling tag, adds t= for testing a policy, and adds np= for subdomains that do not exist.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Two details catch growing apps. Gmail classifies bulk senders permanently, so crossing the threshold once is enough. And from November 2025 Gmail moved from warnings to enforcement, with temporary and permanent rejections for mail that fails the requirements. One-click unsubscribe (RFC 8058) applies to marketing and promotional mail; password resets, receipts and other transactional messages are exempt.
If newsletters and password resets share a domain and a reputation, one badly received campaign can delay the emails people need to sign in. Send them from different subdomains, such as mail.example.com for the product and news.example.com for marketing, each with its own SPF, DKIM and DMARC, and ideally through separate streams.
Pick a sending provider for app mail. Amazon SES is $0.10 per 1,000 emails; dedicated transactional providers charge more and include more tooling. Do not send app mail through a personal or Workspace mailbox.
Verify the sending subdomain and publish the provider's DKIM records, so mail is signed as your domain.
Add the provider to that subdomain's SPF record, keeping the total under 10 lookups.
Publish DMARC at p=none with a reporting address, read the aggregate reports for a few weeks, fix anything legitimate that fails, then move to quarantine and reject.
Register the domain in Google Postmaster Tools and watch the spam rate.
Stop sending to addresses that bounce or complain. SES and other providers report both.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
Your App Has Users Now: The Internet Underneath It, on One Page
Building fast skips the parts of the internet that only matter once people depend on you: DNS, certificates, email authentication, caching, timeouts, backups and abuse. What happens between someone typing your domain and your database answering, what breaks at each step, and the order we would fix things in.
Read
DNS for App Builders: Records, TTLs, the Apex Problem, and Why "Propagation" Is Caching
What each DNS record does, why you cannot put a CNAME on your bare domain, why DNS changes seem to take hours, and how to stop the domain itself becoming your single point of failure. With Route 53 prices and the January 2025 switch from WHOIS to RDAP.
Read
As of October 26, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.