Getting your newsletter into the inbox: SPF, DKIM, DMARC and consent

You can write a brilliant newsletter and still reach almost nobody. Gmail, Outlook, Yahoo and the other mailbox providers decide, message by message, whether your email goes to the inbox, the spam folder or nowhere at all. Their decision rests on a few things you can control: whether your mail is authenticated, whether your sending reputation is good, and whether your readers actually want it.

Authentication in plain language

Email was designed without any way to prove who sent a message. Three standards fill that gap. Together they let receiving servers check that mail claiming to be from your domain really is.

SPF: who may send for you

SPF (Sender Policy Framework) is a DNS record listing the servers and services allowed to send email for your domain, for example your email host and your newsletter platform.

Two practical points:

• a domain should have one SPF record; adding a second one breaks it;
• SPF allows at most ten DNS lookups, so a record that includes many services can quietly stop working. Keep it tidy.

DKIM: a tamper-proof signature

DKIM (DomainKeys Identified Mail) adds a digital signature to each message. The receiving server uses a public key published in your DNS to check that the message really came from an authorised sender and was not altered on the way. Each service that sends for you should sign with its own DKIM key.

DMARC: the policy that ties it together

DMARC connects SPF and DKIM to the address people actually see in the “From” line, and tells receivers what to do when a message fails: nothing (p=none), treat it as suspicious (p=quarantine) or refuse it (p=reject). It also sends you reports showing who is sending email using your domain.

The usual path is to start at p=none, read the reports, fix any legitimate services that fail, then move step by step to quarantine and reject. An enforced DMARC policy also makes it much harder for criminals to send fake email in your name.

What the large mailbox providers now expect

Since 2024, Google and Yahoo have required bulk senders to authenticate their mail with SPF and DKIM, publish a DMARC policy, offer one-click unsubscribe and keep spam complaints low. Microsoft introduced similar requirements for high-volume senders to its consumer email services in 2025. Even if your list is small today, meeting these standards from the start avoids painful problems later.

Reputation and list hygiene

Authentication proves who you are. Reputation decides whether receivers trust you. It is built, or damaged, by how you send:

• Send consistently. Sudden jumps from a few hundred to tens of thousands of messages look like spam. Warm up new sending domains gradually.
• Remove hard bounces immediately. Repeatedly sending to addresses that do not exist is a strong negative signal.
• Make unsubscribing easy. An unsubscribe link is far better than a spam complaint.
• Suppress long-inactive subscribers. People who have not opened or clicked in a long time drag down engagement. Ask them to re-confirm, then stop sending if they do not.
• Never buy or scrape lists. It is the quickest way to ruin a sending reputation, and it raises serious legal problems.

Consent under Nigerian law

The Nigeria Data Protection Act 2023 requires a lawful basis for using personal data. For marketing newsletters, that usually means consent. For consent to count, it should be:

• freely given: not a condition of buying something unrelated;
• specific and informed: people know what they are signing up for and who is sending it;
• unambiguous: an active choice, never a pre-ticked box;
• recorded: you can show when and how each person agreed;
• easy to withdraw: unsubscribing is as easy as signing up.

Double opt-in, where new subscribers confirm by clicking a link in a first email, is a simple way to show clear consent and keep typos and fake addresses off your list. This article is general guidance, not legal advice: your lawyer or data protection officer should confirm the right basis for your particular lists.

A short checklist before you send

1. SPF lists every service that sends for your domain, in a single record.
2. DKIM is enabled for your newsletter platform and your regular email.
3. DMARC is published, you read the reports, and you have a plan to enforce it.
4. Every message has a working one-click unsubscribe and a physical or contact address.
5. Bounces and complaints are removed automatically.
6. Every subscriber has a recorded, valid consent.
7. Your first sends to a new domain are small and gradually increase.

Get these right and your writing has a fair chance of being read. That is the whole point of a newsletter.