Google & Yahoo Sender Requirements 2026
The 2026 Yahoo & Google bulk-sender rules — SPF, DKIM, DMARC alignment, one-click unsubscribe, and the 0.3% spam-rate limit — in one checklist to confirm you comply.
What changed
In February 2024, Google and Yahoo began enforcing a shared set of requirements for senders. They are no longer "best practices" — for bulk senders they are the price of admission to the inbox. Mail that does not meet them gets rate-limited, junked, or rejected outright.
The rules split into two tiers. Every sender must authenticate and keep their infrastructure clean. Bulk senders — anyone sending roughly 5,000 or more messages a day to Gmail accounts — face additional obligations around DMARC, unsubscribe, and spam complaints.
The 5,000/day threshold is per-sending-domain and, once you cross it, it is permanent. So if you ever send a large campaign, treat yourself as a bulk sender from then on.
Requirements at a glance
| Requirement | All senders | Bulk senders (5,000+/day to Gmail) |
|---|---|---|
| SPF and DKIM pass | Required | Required |
DMARC record (at least p=none) |
Required | Required |
| Clean infrastructure — valid PTR/rDNS, TLS, no Gmail/Yahoo impersonation | Required | Required |
DMARC alignment (authenticated domain matches From:) |
— | Required |
| One-click unsubscribe (RFC 8058) | — | Required |
| Spam-complaint rate under 0.3% (aim under 0.1%) | — | Required |
Each item below has the exact record, header, or setting to check.
The bulk-sender checklist
Walk through each item and confirm it is true for every domain you send from — including subdomains and any third-party platforms sending on your behalf.
1. SPF and DKIM both pass
You need both, not either. SPF authorizes the sending IPs; DKIM cryptographically signs the message so it survives forwarding. Use a 2048-bit DKIM key where your provider supports it.
A common failure: marketing mail sent through a SaaS platform passes that platform's DKIM but not yours. Confirm the signing domain aligns with your
From:address.
2. A DMARC record exists, at minimum p=none
Publish a DMARC policy at _dmarc.yourdomain.com. The minimum bar is monitoring mode:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
p=none satisfies the letter of the requirement, but it gives you no protection against spoofing. It is a starting point, not a destination — see the rollout playbook for moving to enforcement safely.
3. DMARC alignment
This is the part most teams miss. It is not enough for SPF or DKIM to pass — the authenticated domain has to align with the domain in the visible From: header. At least one of:
- SPF passes and the return-path domain matches your
From:domain, or - DKIM passes and the
d=signing domain matches yourFrom:domain.
If you send from news.yourbrand.com but your platform signs with mail.vendor.com, you authenticate but you do not align — and DMARC fails.
4. One-click unsubscribe
Bulk marketing and promotional mail must include one-click unsubscribe via the List-Unsubscribe and List-Unsubscribe-Post headers (RFC 8058). The link must work without forcing the recipient to log in, and you must honor it within two days.
5. Keep spam complaints under 0.3%
Register for Google Postmaster Tools and watch your user-reported spam rate. Google's guidance: stay below 0.1% and never hit 0.3%. Once you spike past 0.3%, deliverability degrades and is slow to recover.
6. Clean sending infrastructure
- Valid forward- and reverse-DNS (PTR) records for your sending IPs.
- TLS for transmission.
- A
From:header that does not impersonate Gmail or Yahoo.
How to verify
Do not assume — measure. Send a test message to a Gmail account and use Show original to read the authentication results: you want SPF: PASS, DKIM: PASS, and DMARC: PASS.
Then turn on DMARC aggregate reporting (the rua= tag above) so receivers send you daily XML summaries of who is sending as your domain and whether they pass. That data is the difference between hoping you are compliant and knowing it. We cover how to read those reports in Reading DMARC aggregate reports. You can also check your domain's current DMARC record to confirm everything is in place. If you are weighing a platform to monitor all of this continuously, see our comparison of DMARC tools and DDMARC's pricing.
The bottom line
Compliance is binary at the gate but continuous in practice. Authenticate every stream, publish DMARC, align your domains, make unsubscribe trivial, and keep complaints low. Then keep watching — the requirements do not change often, but your sending footprint does. Whether you run a single domain or manage email for many clients, continuous DMARC monitoring is what keeps you on the right side of the gate.
Questions we get asked
Every sender to Gmail and Yahoo must authenticate with SPF and DKIM and publish a DMARC record (at least p=none), on clean infrastructure — valid forward and reverse DNS, TLS, and no impersonation of Gmail or Yahoo. Bulk senders (roughly 5,000+ messages a day to Gmail) must additionally enforce DMARC alignment, offer one-click unsubscribe, and keep their spam-complaint rate under 0.3%. The rules have been enforced since February 2024 and remain in force in 2026.
Both, at different levels. Every sender must pass SPF and DKIM, publish a DMARC record, and keep infrastructure clean. The extra obligations — DMARC alignment, one-click unsubscribe, and the under-0.3% spam rate — apply to bulk senders sending about 5,000 or more messages a day to Gmail. That threshold is per sending domain and, once crossed, is treated as permanent.
Yes for compliance, no for protection. A DMARC record at p=none satisfies the letter of the requirement, but it is monitor-only and gives you no defense against spoofing. Treat it as a starting point and move toward p=quarantine or p=reject once your aggregate reports confirm every legitimate sender aligns.
No. For bulk senders the authenticated domain must align with the domain in your visible From: address — either SPF passes and the return-path domain matches your From: domain, or DKIM passes and the d= signing domain matches it. Mail that authenticates through a third-party platform but signs with the vendor's domain authenticates without aligning, and DMARC fails.
Keep your user-reported spam rate in Google Postmaster Tools below 0.1%, and never let it reach 0.3%. Once you spike past 0.3%, deliverability degrades and is slow to recover.
Field notes, twice a month.
When a mailbox provider changes the rules, you hear it here with the record you need to change. No digest, no roundup, no product news.
DMARC field notes, twice a month, from PlatOps Security, LLC (Gaithersburg, MD). We use your address only to send it. Unsubscribe with one click in any issue. Privacy policy.