Gmail and Yahoo sender requirements

The bulk sender rules introduced in 2024, who they apply to, and what they mean for transactional senders.

What changed

In February 2024 Google and Yahoo introduced a shared set of requirements for bulk senders. Microsoft announced comparable rules for high-volume senders afterwards. None of it was technically new: it made long-standing best practice a condition of delivery.

The result is that authentication is no longer a way to improve your chances. It is the entry requirement.

The requirements

Authenticate with SPF and DKIM. Both, not either. See SPF and DKIM.

Publish DMARC. A policy of p=none satisfies the letter of the rule, and the message must pass DMARC alignment: the domain in your visible From: must align with the domain that passed SPF or signed with DKIM. See DMARC.

Valid forward and reverse DNS. The sending IP must have a PTR record that resolves back to the same host. This belongs to whoever owns the IP.

TLS in transit. Connections must be encrypted.

One-click unsubscribe on promotional mail. List-Unsubscribe plus List-Unsubscribe-Post, honored within two days. See one-click unsubscribe.

Keep complaints low. Under 0.3%, measured in Google’s Postmaster Tools. Under 0.1% is the level to aim for; 0.3% is where enforcement begins, not a target.

Do not impersonate. A From: header using gmail.com when you are not Gmail fails DMARC and is refused.

Does this apply to transactional senders?

The 5,000-a-day threshold is measured per provider, per sending domain, on a single day. If you cross it once, you are treated as a bulk sender from then on. A password-reset-only service usually stays under it; a service that sends order confirmations at retail scale usually does not.

Two reasons not to relax if you are under the threshold:

1. The complaint rate and authentication signals apply to everyone. The 5,000 figure gates the formal requirements, not the filtering.
2. Volume is not stable. A product launch, a security incident forcing mass password resets, or ordinary growth can put you over the line on a day you were not planning for.

Treat the list as your baseline regardless of volume. Everything on it is worth doing at 100 messages a day.

In Mailverick

Most of the list is already handled:

• SPF and DKIM must both validate before a domain can send at all, so an unauthenticated domain cannot be the cause of a delivery failure. See Getting Started.
• Every message carries List-Unsubscribe and List-Unsubscribe-Post: List-Unsubscribe=One-Click, plus a Feedback-ID header for provider-side complaint reporting.
• Reverse DNS, TLS, and IP reputation on the sending infrastructure are ours to maintain.
• Complaints arrive as spam_reported events and the recipient is suppressed automatically, so a complaint cannot repeat.

What remains yours: publish a DMARC record, keep your From: domain aligned, and keep your list clean enough that complaints stay low.

Common mistakes

Counting total volume instead of per-provider volume. 10,000 messages a day split across many providers may be under the threshold at each one. 5,000 to Gmail alone is not.

Publishing DMARC without checking alignment. A record at _dmarc is not the requirement. Passing DMARC is. A domain with a policy whose mail fails alignment is worse off than it looks, because it now looks configured.

Assuming transactional mail is exempt from unsubscribe. The requirement follows the content, not the label. A “your weekly summary” email is promotional in the sense that matters here.

Ignoring Postmaster Tools. It is the only place you can see your own complaint rate as Gmail measures it. Without it you are guessing about the one number with a published threshold.

Reacting only after a block. Enforcement arrives as a rise in spam placement, not as an announcement. By the time it is obvious, reputation has already suffered.

FAQ

Am I a bulk sender?

If you send around 5,000 or more messages to a single provider on a single day, yes, and permanently from then on.

Is p=none really enough for DMARC?

For the requirement, yes. For protecting your domain, no. It publishes a policy that enforces nothing, so treat it as a starting point.

Do these rules apply outside Gmail and Yahoo?

Microsoft has equivalent requirements for high-volume senders, and other providers filter on the same signals without publishing thresholds. Meeting these requirements is close to meeting all of them.

Does one-click unsubscribe belong on a password reset?

Not required, and arguably wrong: a security email is not something a user should be able to switch off. Mailverick includes the header on every message it sends, which satisfies the requirement everywhere it applies without you having to classify each message.

What happens if I miss a requirement?

Nothing announced. Mail starts landing in spam or being rejected, gradually, and you find out from your own metrics.

Last updated: August 2026