Gmail & Yahoo Sender Requirements (2024 Rules, Explained)

On October 3, 2023, Google and Yahoo jointly announced the biggest change to email deliverability in a decade: starting February 2024, senders would have to authenticate their mail properly, keep complaint rates low, and make unsubscribing effortless — or watch their mail stop arriving. Enforcement began as promised, and both providers have tightened it every quarter since. If your open rates from Gmail or Yahoo addresses collapsed in 2024, these rules are almost certainly why.

This guide explains every requirement, who it applies to, and how to fix each gap. When in doubt, Google's Email Sender Guidelines and Yahoo's Sender Requirements pages are the authoritative, periodically updated source.

Who counts as a bulk sender

Gmail's rules kick in for senders of 5,000 or more messages per day to Gmail accounts. Two details that surprise people:

• The count is across all your domains combined. Splitting campaigns across five sending domains does not get you under the threshold.
• Gmail tracks the threshold continuously: cross 5,000 per day even once, and you are treated as a bulk sender going forward. There is no opting back out.

Yahoo never published a numeric threshold; its rules cover senders of "significant volume." If you are anywhere near 5,000 a day, assume Yahoo treats you as bulk too.

Requirements that apply to every sender

Below the bulk threshold, the bar is lower but not zero. Both providers expect all senders to:

• Authenticate with SPF or DKIM at minimum. A message failing both is a candidate for rejection, not just the spam folder. Google requires DKIM keys of at least 1024 bits and recommends 2048.
• Have valid forward and reverse DNS on every sending IP — a PTR record resolving to a hostname that resolves back to the same IP.
• Send over a TLS connection and format messages per RFC 5321 and RFC 5322.
• Keep spam complaint rates below 0.3% as reported in Google Postmaster Tools.
• Never impersonate a gmail.com From header — Gmail now applies a quarantine-style DMARC policy to its own domain — and make sure your From domain exists and can receive mail.

Bulk sender requirements

SPF, DKIM and DMARC — all three

Bulk senders need both SPF and DKIM set up (not just one), plus a published DMARC record with a policy of p=none or stronger. A minimal record satisfies the letter of the rule:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

But the record alone is not enough — your mail must actually pass DMARC: the domain in the visible From header must align with the domain that passed SPF or DKIM. Start with p=none, read your reports, then move toward quarantine and reject. Never jump straight to p=reject — see the DMARC setup guide for the safe sequence.

Spam complaint rate below 0.3%

Google measures your spam rate in Postmaster Tools and expects it under 0.3%. The realistic target is 0.1%: senders hovering between the two already see throttling. Yahoo calculates its rate only on mail that reached the inbox, so its number can differ from your own system's.

One-click unsubscribe for marketing mail

Commercial and subscribed messages must carry a working List-Unsubscribe header plus the RFC 8058 one-click flag:

List-Unsubscribe: <https://yourdomain.com/unsubscribe?id=123>, <mailto:unsub@yourdomain.com>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

Gmail began enforcing the one-click (POST) method in June 2024; Yahoo strongly recommends it and still accepts mailto. Three non-negotiables for both:

• The unsubscribe must work in one click — no login, no confirmation page before the request is honored.
• Requests must be processed within 2 days.
• The body must also contain a clearly visible unsubscribe link, which may point to a preference center.

Transactional mail — password resets, order confirmations, security notices — is exempt.

How enforcement actually rolled out

Neither provider flipped a switch on February 1, 2024:

• February 2024: temporary errors (4xx) on a small percentage of non-compliant bulk mail — warning shots visible as climbing deferrals in sending logs.
• April 2024: permanent rejections (5xx) of a growing percentage of non-compliant traffic.
• June 2024: one-click unsubscribe enforcement for marketing and subscribed mail.
• November 2025 onward: Gmail announced it is ramping up enforcement on non-compliant traffic, with temporary and permanent rejections.

Forwarding and indirect mail flows

Forwarded mail and mailing lists break authentication in specific ways: SPF fails because the forwarder's IP is not in the original sender's record, while DKIM survives only if the body is untouched. Receivers handle this with ARC (Authenticated Received Chain), which preserves authentication results across each hop. Forwarders should seal messages with ARC headers — the ARC protocol introduction covers what intermediaries must do.

Compliance checklist

Work through this list in order:

• One SPF record covering every sender — verify with the SPF Checker, build with the SPF Generator.
• DKIM enabled in every sending service, signing with your domain — check with the DKIM Checker.
• DMARC published with an rua address, From-domain alignment passing — generate with the DMARC Generator, monitor with the DMARC Report Analyzer.
• From domain exists and accepts mail.
• PTR records valid on every sending IP, with matching forward DNS.
• Unsubscribe headers on all marketing mail, requests honored within 2 days.
• Spam rate under 0.3% (target 0.1%) in Postmaster Tools and the Yahoo feedback loop.
• TLS for all outbound SMTP.

Planning a new domain or IP? Budget time for reputation building — see the sender reputation warm-up guide.

Verify your compliance

Run the full Email Deliverability Test for authentication, DNS and blacklist status in one report, or the Email Health Check for a quick pass over all records. Then send a real campaign to seed Gmail and Yahoo addresses, open Show original, and confirm SPF, DKIM and DMARC all read PASS with your From domain. Authentication failures are diagnosed in the DMARC failure guide.

Common mistakes

• Counting per domain. 2,000 messages a day across three domains is 6,000 as far as Gmail is concerned.
• DKIM passes but DMARC fails. The provider signs with its own bounce domain, alignment breaks, compliance still fails — the most common "I have everything configured" complaint.
• Leaving a mailto-only unsubscribe. Gmail requires the one-click POST method.
• Watching the spam rate only after it spikes. Postmaster Tools data arrives with a delay; by the time you see 0.4%, the damage is done.
• Fixing authentication without warming reputation. Compliant mail from a brand-new domain still lands poorly until warmed.

Frequently asked questions

What happens if I ignore the requirements?

Non-compliant traffic gets temporary errors, then increasingly permanent 5xx rejections; whatever survives is spam-foldered. Since November 2025 Gmail has been explicitly ramping this up, so the problem grows over time.

I send fewer than 5,000 emails a day. Do these rules apply to me?

The full bulk requirements do not, but the all-sender baseline does: SPF or DKIM at minimum, valid PTR records, TLS, RFC-compliant formatting, low spam rate. And crossing 5,000 on one big campaign day reclassifies you as bulk going forward.

Is p=none enough for DMARC compliance?

Yes — both providers accept p=none or stronger, as long as your aligned mail actually passes. p=none is monitoring, not protection; move to quarantine or reject once reports confirm your senders are clean.

Do these requirements apply to transactional email?

Authentication applies to everything you send. One-click unsubscribe applies only to marketing and subscribed messages — order confirmations, password resets and similar transactional mail are exempt.

Do Outlook and other providers have similar rules?

Microsoft rolled out comparable requirements for bulk senders to Outlook.com, Hotmail and Live addresses phased in from May 2025. The work you do for Gmail and Yahoo — SPF, DKIM, aligned DMARC, PTR records, low complaint rates — is the same work every major receiver now expects.