For many years, authenticating mail was a recommended but optional good practice. Since February 2024 Google and Yahoo have turned part of those recommendations into requirements: senders who don't comply see their messages rejected or moved to spam far more easily. The rules come in two tiers, one for all senders and a stricter one for those who send large volumes.
Who counts as a «bulk sender»
Google defines a bulk sender as one that sends roughly 5,000 or more messages in a day to personal Gmail accounts. The count is based on the From domain, subdomains included, and makes no distinction between promotional and transactional messages. Once the threshold has been crossed, the domain is permanently treated as a bulk sender, even if volumes drop in the following days.
Yahoo has not given a precise numerical threshold, but applies broadly similar rules. Microsoft later announced similar requirements for its consumer mail services too. The practical result is that the same rules now apply to most recipients' mailboxes.
Requirements for all senders
Even those sending a handful of emails a day must follow some basic rules:
- authenticate messages with SPF or DKIM;
- have a valid PTR record (reverse DNS) for sending IP addresses, consistent with the server name;
- use a TLS connection for transmission;
- keep a low spam complaint rate;
- follow the standard message format, without malformed headers or ambiguous From addresses.
Additional requirements for bulk senders
SPF and DKIM, both
One of the two is no longer enough: SPF and DKIM must both be configured for the sending domain.
DMARC published and aligned
The domain must publish a DMARC record. The minimum accepted policy is p=none, so the requirement is mainly that the record exists. In addition, the From domain must be aligned with SPF or DKIM: it is no longer acceptable to send with your own domain in From while relying on the provider's signatures and Return-Path.
_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"
One-click unsubscribe
Commercial and promotional messages must support one-click unsubscribe as defined in RFC 8058, using the List-Unsubscribe and List-Unsubscribe-Post headers, in addition to a clearly visible unsubscribe link in the body. Requests must be processed within two days. Transactional messages, such as order confirmations or password resets, are not subject to this obligation.
Spam rate under control
Google asks senders to keep the spam complaint rate, as measured in Postmaster Tools, below 0.3%, and recommends staying below 0.1%. The rate is the ratio between messages users mark as spam and those delivered to the inbox. Consistently exceeding the threshold reduces delivery and limits your ability to get support when problems arise.
What it means in practice
| Requirement | Where to check it |
|---|---|
| SPF and DKIM | Authentication-Results header of a test message |
| DMARC and alignment | _dmarc record and the dmarc=pass field in headers |
| PTR | dig -x on the sending IP |
| TLS | Received headers showing the protocol |
| One-click | message headers and a test unsubscribe |
| Spam rate | Gmail Postmaster Tools |
Anyone using a professional sending platform will find most of these requirements already met, on one condition: having completed the setup of their own domain, with custom DKIM and, ideally, a bounce domain. Many accounts left on default settings send with the provider's signatures and are not aligned.
The most common mistakes since the rules arrived
- Counting only marketing messages: application notifications and invoices often use the same domain and add to the volume.
- Forgetting a secondary service: the accounting system that sends payment reminders without DKIM is enough to break alignment for that portion of mail.
- An unsubscribe link that leads to a login page: that is not one-click unsubscribe.
- Ignoring the spam rate because the platform shows good open rates: they are different metrics.
In my work, a compliance check always starts from a real message for each mail stream, read with its full headers, not from screenshots of configuration panels.
In short
- Since 2024 Gmail and Yahoo enforce mandatory requirements, stricter for those sending roughly 5,000 or more messages a day to Gmail.
- All senders need SPF or DKIM, a valid PTR, TLS and a low spam rate.
- Bulk senders need both SPF and DKIM, a published DMARC record and an aligned From.
- Promotional messages must support one-click unsubscribe as defined in RFC 8058.
- The spam complaint rate must stay below 0.3%, ideally below 0.1%.
