SaaS Email Deliverability: SPF, DKIM, DMARC and Streams

For a SaaS product, deliverability means three things working together: every sending domain is authenticated with SPF, DKIM and DMARC; mail that must arrive (verification codes, receipts, resets) travels on a different stream from mail people can ignore; and complaints stay low enough that Gmail and Yahoo keep trusting you. If you send more than 5,000 messages a day to Gmail addresses, the first and third are now written rules, not best practice.

Prices checked 7 October 2026; each price links to the vendor page it came from.

What Gmail and Yahoo require

Google's sender guidelines apply to anyone sending more than 5,000 messages a day to Gmail accounts, effective 1 February 2024. Yahoo's sender requirements cover similar ground for bulk senders and say enforcement began the same month and may change over time.

Google's page shows the one-click headers as List-Unsubscribe-Post: List-Unsubscribe=One-Click alongside a List-Unsubscribe URL. Most sending providers and lifecycle tools add these for you on marketing mail, so your job is to confirm they are present on a real test message rather than to write them.

Authentication, domain by domain

SPF

SPF is a TXT record on your sending domain listing the servers allowed to send for it. Keep one SPF record per domain and add each provider's include to it rather than publishing a second record. The standard limits an SPF check to 10 DNS lookups, so a domain that includes a helpdesk, a CRM, a marketing tool and a transactional API can fail silently. This is the main reason to put each message class on its own subdomain, with its own short record.

DKIM

DKIM signs each message with a private key held by your provider; receivers verify it against a public key you publish in DNS. Your provider gives you the DNS records and a selector name. Add them, wait for the provider to show "verified", then send a test to a Gmail account and check "Show original" for DKIM: PASS and the domain that signed it.

DMARC

DMARC tells receivers what to do when SPF or DKIM does not line up with the visible From domain, and where to send reports. Publish a TXT record at _dmarc on your domain starting with v=DMARC1; p=none and add a reporting address. Read the reports for a few weeks to find every system that sends as you, fix the ones that fail alignment, and only then move to quarantine and later reject. Moving too early is how a forgotten billing tool ends up blocked.

Separate your streams

A stream is a group of messages with the same reputation risk. Receipts and password resets are wanted by definition; a product announcement is wanted by some. If both share a domain and an IP pool, complaints about the second can slow down the first. Postmark builds this in: its message streams page says "transactional and broadcast traffic never intersect in Postmark, including IP ranges", and a server can hold up to 10 streams. Amazon SES offers dedicated IP pools and lets a configuration set send only through the IPs in its pool.

Warm up and watch complaints

A new domain or IP has no history. Start with the recipients most likely to want the mail, such as people who signed up this week, and raise volume only while bounces and complaints stay low. Do not import an old list and send to everyone on day one. With dedicated IPs on SES, the FAQ describes a managed option that tracks warm-up status for you, as opposed to the standard option where you manage the addresses yourself.

Register your domains in Google Postmaster Tools and look at the spam rate for each. Treat a rise toward 0.10% as an incident for the stream responsible: pause the campaign, see which segment was mailed, and remove people who have not engaged. Yahoo's complaint figure is calculated in its own system on mail delivered to the inbox, so do not expect your provider's dashboard to match it.

When mail goes missing: a diagnosis table

Choosing a sending provider on cost and fit

Lifecycle tools such as Customer.io send on their own infrastructure under your authenticated domain, so check that the tool lets you use a dedicated subdomain and ask about dedicated IPs for your plan. For transactional mail from your own code, five providers are common:

The SES figures are arithmetic on the Essentials per-1,000 rate and exclude any other AWS charges or add-ons. A $55 Postmark bill and a $16 SES bill buy different things: SES leaves suppression handling, templates and reputation monitoring to your own code. Compare feature gaps in Postmark vs SendGrid, Resend vs SendGrid and Mailgun vs SendGrid.

Verdict

Authenticate each sending subdomain, start DMARC at p=none and read the reports before tightening, and put security and billing mail on its own subdomain and stream. If you want that separation without designing it, Postmark is the simplest route; Amazon SES is the cheapest for teams that can build the surrounding pieces; Resend and Mailgun sit between for developer-run sending. Related reading: the transactional versus marketing guide, the email platform security comparison and the list of deliverability-focused platforms.

Frequently asked questions