Does this matter if AI only drafts replies in Outlook or Gmail?
It matters less in that case. If an AI tool drafts a reply and a person sends it from Microsoft 365 or Google Workspace, the email leaves through the same servers as the rest of your mail, and authentication depends on your existing setup. The risk rises when a tool sends through its own servers or a sending service: a follow-up platform, CRM, helpdesk or marketing tool. Each of these is a separate sender that must be authorised for your domain. Ask every vendor in writing whether their service sends email as your domain from their own servers, and if so, how you authorise it.
What do SPF, DKIM and DMARC each do?
SPF is a DNS record listing the servers allowed to send email for your domain. DKIM adds a cryptographic signature to each message, checked against a public key published in your DNS. DMARC tells receiving servers what to do with mail that fails those checks, and asks them to send you reports. Google's guidelines say that to pass DMARC, a message must pass SPF or DKIM, and the authenticating domain must be the same domain that appears in the From header. That match is called alignment, and it is the part most often missed when a new tool is added.
- SPF: one record per domain, listing every authorised sending service.
- DKIM: a key for each service that signs mail as your domain; Google requires at least 1024 bits for personal Gmail accounts and recommends 2048.
- DMARC: a policy of none, quarantine or reject, plus an address for reports.
What do Gmail and Outlook.com require?
Google requires all senders to Gmail accounts to set up SPF or DKIM, and senders of 5,000 or more messages a day to set up SPF, DKIM and DMARC. Above 5,000 a day, marketing and subscribed messages must also support one-click unsubscribe. Google asks senders to keep the spam rate shown in Postmaster Tools below 0.10% and avoid ever reaching 0.30%. Microsoft announced that from 5 May 2025, Outlook.com requires domains sending over 5,000 emails a day to pass SPF and DKIM and publish DMARC of at least p=none, aligned with SPF or DKIM. Its announcement says non-compliant mail goes to Junk first and may later be rejected.
How do you add a new sending tool safely?
Start with an inventory of every service that sends as your domain, including the website contact form, accounting reminders, the CRM and any AI follow-up tool. The ACSC's guidance says to identify your outgoing mail servers and the other entities that send email on your behalf. Add each service to your single SPF record using the include value the vendor documents, and set up DKIM with the keys the vendor provides. Watch the SPF limit: RFC 7208 caps the terms that trigger DNS lookups at 10, and a record that goes over returns a permanent error.
- Remove services you no longer use before adding new ones.
- Prefer DKIM for vendors that support it, which keeps SPF short.
- Record who owns each entry and why it is there.
Where should DMARC start?
The ACSC says to implement DMARC immediately, even if only in monitoring mode with p=none, and to collect the reports. Aggregate reports show which services send as your domain and whether they pass, which often turns up a forgotten tool. Once every legitimate sender passes, move the policy to quarantine and then reject. The ACSC prefers a hard fail SPF policy (-all), suggests soft fail (~all) while testing, and recommends publishing v=spf1 -all for domains that never send email. A DMARC record on your main domain also applies to subdomains, while SPF has to be set for each subdomain.
How do you test before customers see it?
Send test messages from the new tool to a Gmail address and an Outlook.com address you control. Open the full message headers (in Gmail, Show original) and confirm SPF, DKIM and DMARC each show a pass, and that the DKIM domain matches your From address. Check whether the message landed in the inbox or junk. Repeat after any DNS change. Google also advises starting a new sending stream at low volume to engaged recipients and increasing slowly, since a sudden jump in volume can lead to rate limiting. Authentication does not cover Australian spam law; consent and unsubscribe rules are separate.