954-539-5678Free audit
Menu

Email marketing · Compliance

The Gmail and Yahoo rules, as a checklist

Authenticate your domain, make unsubscribing one click, and keep complaints under 0.3%. Here is what each rule means and how to check yours.

SPF, DKIM and DMARC for bulk

One-click unsubscribe on marketing

Spam complaints under 0.3%

Talk to us

Tell us what you need and we’ll get back to you. Or book a free 30-minute call. Or call 954-539-5678.

The short answer

Since February 2024, Gmail and Yahoo require anyone sending email to their users to meet basic standards, with stricter rules for bulk senders. Google defines a bulk sender as one that sends close to 5,000 or more messages to personal Gmail accounts in 24 hours. Bulk senders must:

  • Authenticate with both SPF and DKIM.
  • Publish a DMARC record (a policy of p=none is enough) and pass DMARC, with the From domain aligned to SPF or DKIM.
  • Support one-click unsubscribe in marketing email, plus a visible unsubscribe link in the message body.
  • Keep the spam complaint rate below 0.3%. Google recommends staying below 0.1%.
  • Have valid forward and reverse DNS, use TLS, and follow standard message formatting.

Microsoft’s Outlook added similar SPF, DKIM and DMARC requirements for domains sending over 5,000 emails a day in May 2025. Meeting the Gmail and Yahoo rules covers most of Outlook’s too.

Rules for all senders vs bulk senders

All senders

SPF or DKIM; valid forward and reverse DNS; TLS (Gmail); spam rate below 0.3%; messages formatted to email standards; no impersonating Gmail addresses in the From header.

Bulk senders

Everything for all senders, plus SPF and DKIM both, DMARC with alignment, one-click unsubscribe with a visible body link, and unsubscribes processed within two days.

Two details catch businesses out. First, Google counts all mail from the same primary domain, including subdomains, toward the 5,000 total. Second, Google says bulk sender status does not expire. Once you are classed as a bulk sender, sending less later does not remove the label.

Authentication, step by step

  1. List every service that sends as your domain: your email platform (Mailchimp, Klaviyo, HubSpot), Microsoft 365 or Google Workspace, your CRM, invoicing tools, website forms and booking software.
  2. SPF: publish one SPF record that includes each service’s sending servers. Only one SPF record is allowed per domain, so merge rather than add.
  3. DKIM: turn on DKIM signing in each platform and add the DNS records it gives you. Google requires keys of at least 1024 bits and recommends 2048.
  4. DMARC: publish a record starting with p=none and a reporting address (Yahoo strongly recommends the rua tag). Read the reports to find senders you missed.
  5. Alignment: make sure your marketing platform sends with your domain in the From address and signs DKIM with your domain, not the platform’s shared domain.
  6. Tighten later: once reports show all legitimate mail passing, move DMARC to quarantine, then reject, to stop others spoofing your domain.

One-click unsubscribe

Marketing and subscription email must include a List-Unsubscribe header supporting one-click unsubscribe. This is what powers the “Unsubscribe” button Gmail and Yahoo show next to the sender name. Yahoo highly recommends the RFC 8058 POST method. You also need a clearly visible unsubscribe link in the email body.

  • Most email marketing platforms, including Mailchimp, Klaviyo and HubSpot, can handle the header for you once your domain is set up. Check a test email’s headers to confirm yours does.
  • Yahoo requires unsubscribes to be honored within two days; Google recommends 48 hours.
  • Transactional messages such as password resets, order confirmations and form confirmations do not need one-click unsubscribe, according to Google’s FAQ.

Want your email setup checked?

Book a free 30-minute call. We look at your domain records, email platform and recent campaigns with you and tell you what we would fix first. No obligation. Pick a time.

The spam rate limit

The spam rate is the share of delivered messages that recipients mark as spam. Gmail measures it in Google Postmaster Tools; Yahoo calculates it from mail delivered to the inbox. The ceiling is 0.3%, and Google recommends staying below 0.1%.

Google says bulk senders above 0.3% are not eligible for mitigation, and become eligible again only after staying below 0.3% for seven consecutive days. To stay under the limit:

  • Send only to people who opted in. Never use purchased lists.
  • Set expectations at signup: what you send and how often.
  • Remove people who have not opened or clicked in months.
  • Make the unsubscribe link easy to find. People who cannot leave will press spam instead.

What happens if you do not comply

Google says unauthenticated messages may be marked as spam or rejected with a 5.7.26 error, and that from November 2025 Gmail ramped up enforcement with temporary and permanent rejections of non-compliant mail. Microsoft’s Outlook rejects high-volume mail that fails its authentication rules with a 550 5.7.515 error. In practice, non-compliance shows up as falling open rates, then bounces.

How to check your own setup in five minutes

  1. Send a campaign test to a personal Gmail address.
  2. Open it, choose the three-dot menu, then Show original. Gmail lists SPF, DKIM and DMARC results at the top. All three should say PASS.
  3. Check that the DKIM line shows your domain, not only your email platform’s domain.
  4. Look for a List-Unsubscribe header and a List-Unsubscribe-Post header in the message source.
  5. Confirm Gmail shows an Unsubscribe link next to your sender name. It may not appear for every message or new sender.

Repeat the test for every system that sends as your domain, including invoices and website form notifications. Those are often the ones that fail.

A compliance checklist

  1. SPF passes and lists every sending service.
  2. DKIM passes with your own domain on every platform.
  3. DMARC record published, with reports going somewhere someone reads.
  4. From address uses your domain and aligns with SPF or DKIM.
  5. One-click unsubscribe header present on marketing email, plus a body link.
  6. Unsubscribes processed within two days, including those from CRMs and other tools.
  7. Google Postmaster Tools set up and spam rate checked monthly.
  8. List cleaned of unengaged and bounced addresses.

How JLB USA helps

Our email marketing team sets up domain authentication, unsubscribe handling and list hygiene on MailChimp, Klaviyo and HubSpot. If you are choosing between those platforms, see Klaviyo vs Mailchimp vs HubSpot. Florida businesses can also read about email marketing in Fort Lauderdale.

Keep reading

Book it now · Free

Book a free 30-minute call

Pick a time. We look at what you have now with you and tell you what we would change first. No obligation.

Prefer to talk now? Call 954-539-5678, or send the form and we’ll contact you.

Questions we hear

Do the Google and Yahoo rules apply to small businesses?

The authentication, spam-rate and DNS basics apply to all senders. The stricter bulk-sender rules apply once you send close to 5,000 or more messages a day to Gmail users, counted across your whole domain.

Is a DMARC policy of p=none enough?

For the Gmail and Yahoo bulk-sender requirements, yes, as long as DMARC passes with alignment. Moving to quarantine or reject later gives stronger protection against spoofing.

What spam rate do Gmail and Yahoo allow?

Both set the limit below 0.3%. Google recommends staying below 0.1%.

Do transactional emails need one-click unsubscribe?

No. Google says one-click unsubscribe applies to marketing and promotional messages, not transactional ones such as password resets or order confirmations.

Related services

Want a second opinion on your website or marketing?

Pick a time for my free callCall 954-539-5678