Why Gmail, Seznam and Outlook now refuse unauthenticated mail

For twenty years, unauthenticated email mostly still arrived. That era ended: starting in 2024 Google and Yahoo turned their sender guidelines into enforced requirements, Microsoft followed for Outlook, and Seznam — which matters more than any of them for mail to Czech inboxes — publishes requirements in the same direction. If your mail to these providers suddenly bounces or lands in spam and it never used to, this is very likely why.

What they now require

The common core, phrased as the receivers phrase it: every sender must authenticate — SPF or DKIM at minimum, with valid forward and reverse DNS for the sending addresses. Senders above a volume threshold (Google and Yahoo drew it at roughly five thousand messages a day to their users) must have both SPF and DKIM, a published DMARC policy, a From domain aligned with that authentication, one-click unsubscribe on bulk mail, and a spam-complaint rate kept low — Google names 0.3% as the line not to cross. The exact thresholds and dates are the receivers' to change; the direction has only ever tightened.

Note what the DMARC requirement is: a published policy, even p=none. The receivers are not yet demanding enforcement — they are demanding that you join the reporting loop and put your name on a policy. Enforcement is where the protection is, but the entry ticket is the record itself.

The shortest path to compliant

In order: publish SPF naming every system that sends as you; enable DKIM signing with your own domain on each of those systems (your provider hosts the key, you publish a DNS record — and alignment matters: the signature must be your domain, not the tool's); publish DMARC with a reporting address; then watch the reports to confirm every real sender authenticates before you tighten anything. For most domains this is an afternoon of DNS edits and a few provider dashboards — the work is knowing which senders exist, and the reports answer that.

Staying compliant is the actual task

The requirements are checked continuously by the receivers, so compliance is a state you maintain, not a form you file. A new tool starts sending unauthenticated, a DKIM key rotates wrong, a complaint rate creeps — and delivery degrades without a notice letter. Sojka watches exactly this surface: the records, the alignment per sender from your DMARC reports, and the moment any of it changes, with the next safe policy step called out. The free check takes thirty seconds and grades where you stand today.

Check your domain free — it reads your public DNS and grades what is there.