In February 2024, Google and Yahoo began enforcing a common set of rules for anyone sending email to their users. They were not new ideas; they were long-standing best practices turned into requirements. Since then, enforcement has tightened, and other providers have moved in the same direction. If your newsletters, invoices or app notifications reach Gmail or Yahoo inboxes, the Gmail sender requirements apply to you in some form. This guide sets out what they are and what you need to do.
Two tiers: all senders and bulk senders
Google splits its rules into requirements for all senders and additional ones for bulk senders. Google defines a bulk sender as one that has sent close to 5,000 or more messages to personal Gmail accounts within a 24-hour period, counting all mail from the same primary domain. Once you qualify, Google treats you as a bulk sender permanently. Yahoo's guidance follows the same pattern without publishing an exact figure.
Note that the 5,000 counts all mail from your domain combined: marketing, transactional and staff mail together.
Requirements for all senders
- Authenticate with SPF or DKIM. At least one must pass for your domain.
- Valid forward and reverse DNS. Sending IP addresses need a PTR record that resolves to a host name, which resolves back to the same IP. Hosted providers handle this for you.
- Use TLS to encrypt the connection when transmitting mail.
- Keep spam complaints low. Google asks senders to keep the user-reported spam rate shown in Postmaster Tools below 0.3%, and recommends staying below 0.1%.
- Format messages correctly according to the Internet Message Format standard (RFC 5322), with valid headers such as a single From, a Date and a Message-ID.
- Do not impersonate Gmail. Do not put a
gmail.comaddress in the From header of mail sent through other services, because Gmail's own DMARC policy will cause it to fail.
Additional requirements for bulk senders
| Requirement | What it means in practice |
|---|---|
| SPF and DKIM | Both must be set up for your sending domain, not just one |
| DMARC record | Published at _dmarc.yourdomain; p=none is the minimum accepted |
| DMARC alignment | The From domain must align with the SPF domain or the DKIM signing domain |
| One-click unsubscribe | Marketing and subscribed messages need List-Unsubscribe and List-Unsubscribe-Post headers |
| Honour unsubscribes quickly | Process requests within two days |
| Visible unsubscribe link | A clear link in the message body as well |
What one-click unsubscribe looks like
One-click unsubscribe is defined in RFC 8058. Your sending platform adds two headers to each marketing message:
List-Unsubscribe: <https://example.com/unsub?u=8f3a2c>, <mailto:unsub@example.com?subject=unsub-8f3a2c>
List-Unsubscribe-Post: List-Unsubscribe=One-ClickWhen a recipient clicks the unsubscribe button shown by Gmail or Yahoo next to the sender name, the mailbox provider sends an HTTPS POST to that URL, and your system must unsubscribe the address without asking them to log in or confirm anything. The headers must be covered by your DKIM signature. Mainstream email marketing platforms add these automatically; custom-built applications that send newsletters need to implement it. Transactional messages, such as password resets and order confirmations, are not required to have it.
Compliance checklist
- List every system sending as your domain, including CRMs, helpdesks, billing and application servers.
- Check SPF: one record, every sender included, under 10 DNS lookups.
- Set up DKIM with your own domain on every platform, not the provider's default signing domain.
- Publish DMARC with a reporting address, for example
v=DMARC1; p=none; rua=mailto:dmarc@example.com, and plan to move towards enforcement. - Verify all three with our SPF, DKIM and DMARC checker and in real message headers.
- Confirm one-click unsubscribe headers on marketing mail by viewing the original message in Gmail.
- Register for Google Postmaster Tools to monitor your spam rate and authentication results. Google reports compliance status there too.
- Review list practices: confirmed opt-in where possible, prompt removal of bounces and unsubscribes.
What happens if you do not comply
Google's approach has been gradual: non-compliant mail first saw temporary errors on a portion of traffic, then increasing amounts were rejected or sent to spam. The exact enforcement thresholds are Google's to decide and change, so the practical answer is simple: do not rely on being below a cut-off. When mail is rejected for these reasons, the bounce usually includes an error code and a link to Google's sender guidelines, which tells you which requirement failed.
Other mailbox providers
Microsoft has announced similar authentication requirements for high-volume senders to its consumer services, including Outlook.com and Hotmail. Smaller providers increasingly follow the same baseline. Treat these rules as the minimum standard for email in general, not something specific to two companies.
If you send through your own servers
Hosted email providers take care of reverse DNS and TLS for you. If your application or office server sends directly, check that the server's IP has a correct PTR record, that it offers STARTTLS, and that its port 25 traffic is reaching the outside world. The port checker helps confirm network access, and many organisations find it simpler to relay through an authenticated email service instead of maintaining their own outbound reputation.
Key takeaways
- All senders need SPF or DKIM, valid reverse DNS, TLS and low complaint rates.
- Bulk senders (around 5,000+ daily messages to Gmail) also need SPF, DKIM, DMARC with alignment, and one-click unsubscribe.
- Set up DKIM with your own domain on every sending platform.
- Monitor with Google Postmaster Tools and DMARC reports, and treat these rules as the baseline everywhere.