In 2024 Google and Yahoo began enforcing a set of sender rules that changed how email is treated. The headline numbers apply to bulk senders, but several of the requirements apply to everyone who sends to Gmail or Yahoo accounts, including small businesses and developers sending transactional mail. This article explains what the rules ask for and how to meet them.
These rules are updated from time to time, so always confirm the details against the providers' current sender guidelines. What follows reflects the requirements as announced and widely documented.
Who counts as a bulk sender
Google defines a bulk sender as one that sends close to 5,000 or more messages a day to personal Gmail accounts, counted across the whole primary domain. Once you cross that line you are treated as a bulk sender permanently. Yahoo applies similar rules. Microsoft has also announced authentication requirements for high-volume senders to Outlook.com addresses.
If you send far less than that, you still benefit from following everything below, because the same signals feed the spam filters.
The requirements, in plain terms
| Requirement | Applies to | What it means |
|---|---|---|
| SPF or DKIM authentication | All senders | Messages must pass at least one, and valid DNS must be in place |
| SPF and DKIM, plus DMARC | Bulk senders | All three must be set up, with a DMARC policy (even p=none) |
| Alignment | Bulk senders | The From domain must align with the SPF or DKIM domain |
| Forward and reverse DNS | All senders | Sending IPs need valid PTR records |
| TLS | All senders | Messages should be sent over an encrypted connection |
| Low spam rate | Bulk senders | Stay below 0.10% in Postmaster Tools and never reach 0.30% |
| One-click unsubscribe | Bulk marketing senders | Support the List-Unsubscribe-Post header and honour requests within two days |
| Message format | All senders | Valid RFC 5322 format, no impersonating Gmail in the From |
What this means for transactional mail
Password resets, verification codes and receipts are not marketing, so the unsubscribe rule does not apply to them. Authentication, alignment and a clean complaint rate do. That makes setting up SPF, DKIM and DMARC the first job for any application that sends email from your own domain. Read the basics in what DMARC is and what SPF is.
What it means for newsletters and marketing
Anything promotional needs a visible unsubscribe link and the one-click header, so recipients can leave without opening the message. How to add it is in List-Unsubscribe and one-click unsubscribe. Honour requests promptly, because ignoring them turns unsubscribes into spam reports.
The spam-rate number is the one to watch
Google reports your spam rate in Postmaster Tools: the share of messages recipients marked as spam, calculated against mail delivered to the inbox. The target is under 0.10%, which is one complaint per thousand messages. Crossing 0.30% can make you ineligible for mitigation and hurts delivery. Keep it low by sending only to people who expect your mail, removing non-engaged contacts, and making unsubscribe easy.
Step-by-step compliance checklist
- Publish one SPF record and make sure it passes for your sending service.
- Enable DKIM signing with your own domain, so the
d=value aligns with your From domain. - Publish a DMARC record.
p=noneis the minimum; plan to tighten it (see rolling out DMARC). - Verify with a real message to a Gmail address and read the results (how to check).
- Register your domain in Google Postmaster Tools to watch spam rate and authentication.
- Add one-click unsubscribe to marketing mail.
- Keep bounces low by removing invalid addresses (bounce codes).
Common misunderstandings
- "I send 200 emails a day, so this does not apply." Authentication does. The bulk rules are the strictest, but unauthenticated mail is treated badly at any volume.
- "DMARC
p=nonedoes nothing." It does not block spoofing, but it satisfies the requirement and gives you the reports you need to go further. - "Passing the rules guarantees the inbox." It does not. It removes a reason for rejection; reputation and content still decide.
- "Sending from a free Gmail address is fine." Sending from a gmail.com address through a third-party server cannot be aligned. Use your own domain.
How Mailions supports compliance
Mailions gives every domain its own DKIM key, shows the SPF and DMARC records to publish, and checks them against live DNS. Your sending activity is logged in the panel. For marketing-style mail you must still manage your own lists and unsubscribe handling, and Mailions does not guarantee inbox placement. If you are unsure whether your volume or setup is in scope, contact us and describe what you plan to send.