EA Digital Solutions

E-mail security

E-mails that arrive and cannot be forged.

Are your quotes landing in spam, or is someone sending e-mails in your name? Both usually have the same cause: SPF, DKIM and DMARC are missing or do not match the services that actually send for your domain. We fix that without losing legitimate e-mails along the way.

  • Every sender of your domain listed
  • DMARC to “reject”, step by step
  • Reply within 24 hours
Send a request

In short

SPF defines which servers may send for your domain, DKIM signs every message, and DMARC tells receivers what to do with messages that fail both and sends you reports. Google and Yahoo have enforced minimum requirements since February 2024: every sender needs SPF or DKIM, bulk senders need all three including DMARC, plus one-click unsubscribe and a spam rate below 0.3 %. Since May 2025, Outlook.com requires SPF, DKIM and DMARC from domains sending more than 5,000 e-mails a day.

Key facts

Gmail: rules since February 2024
All senders need SPF or DKIM. Senders of around 5,000 or more messages a day to Gmail accounts need SPF, DKIM and DMARC (at least p=none), an aligned From domain and one-click unsubscribe for marketing mail.
Spam rate below 0.3 %
Google and Yahoo name 0.3 % as the limit for the reported spam rate. Above it, mail may be throttled or rejected.
Yahoo: same direction
SPF and DKIM, DMARC at least p=none, one-click unsubscribe via the List-Unsubscribe header. Unsubscribes should be honoured within two days.
Outlook.com: since May 2025
Domains sending more than 5,000 e-mails a day to Outlook, Hotmail and Live addresses must pass SPF, DKIM and DMARC. Microsoft rejects non-compliant mail.
SPF: at most 10 DNS lookups
Every “include” counts. Above ten lookups SPF fails with an error, even for legitimate mail (RFC 7208). That happens quickly when many services are listed.
MTA-STS and BIMI
MTA-STS ensures mail to your domain is only delivered encrypted. BIMI shows your logo in the inbox but requires DMARC at “quarantine” or “reject”.

As of 26 October 2026 · General information, not legal advice.

When this is worth it

  • Your e-mails, quotes or invoices end up in customers’ spam folders or bounce.
  • Several services send in your name: Microsoft 365 or Google Workspace, newsletter tool, shop, CRM, accounting, ticketing.
  • Someone has sent e-mails with your sender address, such as fake invoices to your customers.
  • Customers or insurers ask about DMARC, for example in security questionnaires or in the context of NIS2.

The requirements of Google, Yahoo and Microsoft mainly target bulk senders. A clean setup protects any domain against forged senders and helps deliverability, though.

What we do for you

  1. 1

    Inventory of all senders

    We list every service sending as your domain, including the forgotten ones. The first DMARC reports show what is actually out there.

  2. 2

    Consolidate SPF

    One SPF record that covers every legitimate sender and stays under ten DNS lookups; unused entries are removed.

  3. 3

    DKIM for every sender

    Separate DKIM keys per service so that signature and From domain align.

  4. 4

    DMARC to “reject”

    Start with p=none and analyse the reports, then move step by step to “quarantine” and “reject”, only once all legitimate mail passes.

  5. 5

    MTA-STS and, if wanted, BIMI

    Enforced encryption for incoming mail with TLS reports; BIMI if you want your logo shown in the inbox.

How well your e-mails arrive also depends on content, list hygiene and sending behaviour. We provide the technical foundation and tell you openly where else we see room for improvement.

Check for free first

Free checklist

E-mail security checklist: 12 points for SPF, DKIM and DMARC

E-mail security checklist: 12 points for SPF, DKIM and DMARC

So your mail reaches the inbox and nobody sends in your name. The free e-mail check at ea-digitalsolutions.at/en/tools/email-check shows the current state of your domain.

Sender inventory, SPF, DKIM, DMARC up to reject, MTA-STS: the 12 points for secure and deliverable e-mail, as a printable PDF.

Enter your e-mail to read the whole thing

Download for free — enter your e-mail

You are also subscribing to our newsletter. Unsubscribe any time.

Frequently asked questions

How do I know whether my domain has SPF, DKIM and DMARC?

With our free e-mail check: enter your domain and see which records exist and where the problems are. Whether each individual service signs correctly only shows up in the DMARC reports.

Do the Google and Yahoo rules apply to small businesses too?

Google requires SPF or DKIM from all senders. The stricter rules with DMARC and one-click unsubscribe apply to bulk senders. Setting up DMARC anyway protects you against forged senders and improves deliverability.

Can DMARC stop my own e-mails from arriving?

Yes, if you switch to “reject” too early. That is why we start with “none”, analyse the reports and tighten only once all legitimate senders pass.

What is MTA-STS, and do I need it?

MTA-STS tells other servers to deliver mail to your domain only over an encrypted, verified connection. It protects your inbox, not your outgoing mail, and is a sensible addition once SPF, DKIM and DMARC are in place.

How long does it take to reach “reject”?

That depends on how many services send and how quickly their settings can be changed. Reports need a few weeks anyway so that rarely used senders show up. We give you a timeline after the inventory.

Sources

Related services