Why authentication is not optional any more
Google’s sender guidelines, which apply to mail sent to personal Gmail accounts, split senders into two groups. Every sender needs SPF or DKIM, valid forward and reverse DNS, TLS, and a spam rate below 0.3% in Postmaster Tools. Senders of 5,000 or more messages a day to Gmail accounts also need SPF and DKIM and DMARC (a policy of none is accepted), a From: domain aligned with SPF or DKIM, and one-click unsubscribe for marketing mail. [4]
Yahoo’s requirements are close to the same. Bulk senders must implement SPF and DKIM, publish a valid DMARC policy of at least p=none that passes, align the From: domain, support one-click unsubscribe, honor unsubscribes within 2 days and keep the spam rate below 0.3%. [5]
systeme.io removes the choice for its users: its help center states that authenticating a domain name is mandatory to send emails from systeme.io. A small list that never reaches 5,000 a day still has to finish this setup before the first broadcast. [1]
| Requirement | Gmail, all senders | Gmail, 5,000+ a day | Yahoo, bulk senders |
|---|---|---|---|
| SPF / DKIM | SPF or DKIM | Both | Both |
| DMARC | Not required | Required, p=none accepted | Required, at least p=none, must pass |
| From: alignment | Not listed | Aligned with SPF or DKIM domain | Aligned with SPF or DKIM domain (relaxed accepted) |
| One-click unsubscribe | Not listed | Marketing and subscribed mail | Marketing and subscribed mail; honor within 2 days |
| Spam rate | Below 0.3% | Below 0.3% | Below 0.3% |
What systeme.io asks you to add
The systeme.io procedure starts in Settings, then Emails, then Domains. You enter the domain without www and save, and systeme.io generates the records. You then add three CNAME records and one TXT record at your DNS host. [1]
The help article’s examples show one CNAME pointing to inbound.systeme.io. and two _domainkey CNAMEs pointing to key1.systeme.io. and key2.systeme.io. The DMARC TXT record goes at _dmarc with a value such as v=DMARC1; p=none; rua=mailto: followed by a reporting address. Copy the exact values from your own account rather than from these examples. [1]
The article does not ask you to edit an SPF TXT record. If another service already sends mail for your domain, leave its existing SPF record alone and add only what systeme.io generates.
| Record | Type | Name field | Value |
|---|---|---|---|
| Inbound | CNAME | Part before your domain, as generated | Generated value, example inbound.systeme.io. (trailing period) |
| DKIM key 1 | CNAME | Generated _domainkey name | Example key1.systeme.io. |
| DKIM key 2 | CNAME | Generated _domainkey name | Example key2.systeme.io. |
| DMARC | TXT | _dmarc | v=DMARC1; p=none; rua=mailto:your-report-address |
Prerequisites that block people before DNS
- The domain must have an active website. systeme.io warns that if the domain leads to a 404 page, email providers may block your emails. [1]
- You cannot authenticate free mailbox domains such as Gmail, Yahoo or ProtonMail; only a domain you own works. [1]
- A domain can be authenticated in only one systeme.io account or sub-account. Agencies running several sub-accounts need a separate domain or subdomain per account. [1]
- After DNS, confirm a sender address: Settings, Emails, Verified email addresses, enter the address, then click the confirmation link sent to that inbox until its status shows Verified. [3]
DMARC: start at p=none and read the reports
systeme.io’s DMARC article uses p=none with an rua address and recommends a dedicated mailbox for reports so daily aggregate reports do not flood your main inbox. Several report addresses can be listed in rua, each separated by a comma without spaces. [2]
The same article warns that there must be only one DMARC record per domain; a second record can conflict and stop the policy working. If your domain already has a _dmarc record from Google Workspace or Microsoft 365 setup, edit that record instead of adding another. [2]
p=none is what both Gmail and Yahoo accept as the minimum. Tightening the policy later is a separate decision; do it only after the reports show every legitimate sender passing. [4] [5]
Verification and common errors
systeme.io suggests checking each CNAME in a DNS checker using the full record name. A green check next to the exact value for all three CNAMEs means the domain is authenticated; a red result means a DNS error. For DMARC it points to a lookup tool such as MXToolbox. The article does not give a propagation time. [1] [2]
| Symptom | Likely cause | Fix |
|---|---|---|
| CNAME shows red in a DNS checker | Host appended your domain twice, or value missing its trailing period | Enter only the part before your domain in Name; end the value with a period |
| Two DMARC results or policy ignored | An older _dmarc TXT record already existed | Keep one record; merge rua addresses into it |
| Domain will not authenticate | Already authenticated in another systeme.io account or sub-account | Remove it there, or use a different subdomain |
| Cannot add the domain | It is a free mailbox domain like gmail.com | Use a domain you own |
| Emails blocked after setup | Domain shows a 404 instead of a live site | Point the domain at a working page before sending |
| Still red after fixes | Host-specific DNS behavior | systeme.io says to contact your host, then systeme.io support with a DNS screenshot |
Pre-send checklist
- Domain resolves to a live page, not a 404.
- Three CNAMEs copied from your own systeme.io account, each verified green.
- Exactly one _dmarc TXT record, p=none, rua pointing to a dedicated mailbox.
- Sender address on the domain shows Verified in Settings, Emails.
- Existing mail records (MX and any SPF for your mailbox provider) left untouched; see the domain-move guide if you are also changing hosts.
- An unsubscribe link in every marketing email and a plan to keep complaints well under 0.3%.
Questions before you decide
Does systeme.io need an SPF record?
Its domain authentication article lists three CNAME records and a DMARC TXT record and does not mention SPF. Copy exactly what your account generates.
Can I send from a gmail.com address through systeme.io?
No. systeme.io says free email provider domains such as Gmail, Yahoo or ProtonMail cannot be authenticated, and authentication is mandatory to send.
Is p=none enough for Gmail and Yahoo?
Google accepts a DMARC enforcement policy of none for senders of 5,000+ messages a day, and Yahoo requires at least p=none that passes.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- systeme.io help: how to authenticate your domain name for email sending Accessed 30 Oct 2026
- systeme.io help: how to create a DMARC record Accessed 30 Oct 2026
- systeme.io help: how to confirm your email sender address Accessed 30 Oct 2026
- Google Workspace Admin Help: email sender guidelines Accessed 30 Oct 2026
- Yahoo Sender Hub: sender best practices and requirements Accessed 30 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.