In February 2024 Google and Yahoo began enforcing a shared set of requirements for bulk senders — anyone sending roughly 5,000 or more messages a day to their users. Messages that fail are rejected or filtered to spam, and enforcement has tightened since.
The requirements are not new best practice dressed up as rules. They are checkable conditions, and either your mail satisfies them or it does not.
The three requirements
1. Authenticate with SPF, DKIM and DMARC
All three, with DMARC aligned to your visible From domain.
- SPF publishes which servers may send for your domain.
- DKIM signs each message so its origin can be verified cryptographically.
- DMARC tells receivers what to do when the first two fail, and — this is the part people miss — requires that the domain in SPF or DKIM matches the domain your recipients see in the From field.
Alignment is where most failures happen. A message sent through a platform can pass SPF against the platform's own domain while your From address shows yours. SPF passes, DMARC still fails, because they do not align. The fix is authenticating your own sending domain, which means publishing DKIM records that the platform gives you.
A DMARC policy of p=none satisfies the letter of the requirement. It also means you have told the world to do nothing when your domain is spoofed, so move to p=quarantine once your reports look clean. Generate all three records with our SPF DKIM DMARC generator, and there is a fuller explanation in SPF, DKIM and DMARC explained.
2. One-click unsubscribe
Marketing and subscribed messages must include a List-Unsubscribe header supporting one-click removal — List-Unsubscribe-Post: List-Unsubscribe=One-Click — and requests must be processed within two days.
This is the header that produces the "Unsubscribe" link Gmail shows next to your sender name. It is worth wanting rather than merely complying with: recipients who cannot find your unsubscribe link mark you as spam instead, and a spam complaint costs you far more than a subscriber. The implementation details are in the List-Unsubscribe header and one-click unsubscribe.
Note the two-day processing window is shorter than the ten business days CAN-SPAM permits. Meet the tighter number.
3. Stay under a 0.3% spam complaint rate
Measured in Google Postmaster Tools, with 0.1% named as the level to stay under and 0.3% as the threshold where enforcement bites.
These numbers are smaller than they look. Three complaints per thousand delivered messages puts you at the limit. A single campaign to a list you have not mailed in a year can produce that on its own, which is why list hygiene is a deliverability control rather than housekeeping.
You cannot see this number without Google Postmaster Tools, so set it up before you need it — it reports on the trailing period, so registering during an incident shows you nothing about what caused it.
The other conditions
- Valid forward and reverse DNS on your sending IP. On shared infrastructure your provider handles this; if you run your own, see reverse DNS for email.
- TLS for transmission. Standard on any reputable platform.
- A valid, resolvable From domain. No sending from a domain that does not exist.
- Format compliance with RFC 5322. Malformed headers get rejected.
- No impersonating Gmail From headers, which broke a common pattern of sending "from" a customer's gmail.com address. Send from your own domain and put theirs in Reply-To.
Checking whether you pass
Send a message to a Gmail address you control, open it, and use "Show original". You want three lines reading PASS for SPF, DKIM and DMARC. If DMARC says fail while SPF passes, that is the alignment problem above.
Then check Postmaster Tools for your complaint rate and domain reputation. If reputation reads Low or Bad, the requirements are the floor rather than the issue — work through why emails go to spam.
Our deliverability audit checks the DNS side in one pass.
What this changed in practice
The requirements formalised what good senders were already doing, and they ended the era where a small sender could ignore authentication indefinitely. The senders hurt were the ones mailing purchased or ancient lists, because the complaint threshold is unforgiving of audiences that never asked for the mail.
If you are starting a new sending domain, warm it properly rather than sending your full list on day one — see domain warming — because a new domain with no history and a sudden 40,000-message spike is the exact profile these rules were designed to catch.
Frequently asked questions
Do the Google and Yahoo requirements apply to small senders?
The bulk sender rules trigger at roughly 5,000 messages a day to that provider, but authentication and unsubscribe handling affect filtering at every volume. Both providers have signalled that the standards apply broadly, and there is no advantage to being unauthenticated at any size.
Is p=none enough for DMARC?
It satisfies the requirement. It provides no protection against spoofing, because you have instructed receivers to take no action on failures. Start at p=none to collect reports, then move to p=quarantine once you can see that legitimate mail is passing.
What is a safe spam complaint rate?
Below 0.1% is the stated target and 0.3% is where enforcement begins. Since 0.3% is three complaints per thousand delivered, the practical control is who you send to rather than what you write.
My SPF passes but DMARC fails. Why?
Alignment. DMARC requires the authenticated domain to match the From domain your recipients see. If your platform's SPF record authenticates its own domain while your From shows yours, SPF passes and DMARC does not. Publishing DKIM for your own sending domain fixes it.
