// how to fix
Gmail and Yahoo bulk sender requirements
Since 2024, Gmail and Yahoo require large senders to authenticate their emails, offer one-click unsubscribe and keep spam complaints very low. Here is the checklist.
What it means
Gmail and Yahoo now apply strict rules to anyone who sends a lot of email to their users. Google counts a "bulk sender" as a domain that sends around 5,000 or more emails a day to Gmail addresses. Once you reach that level, you stay in that category.
The rules are simple to list:
- SPF and DKIM must both be set up for your domain.
- DMARC must be published, at least with
p=none, and your From address must align with SPF or DKIM. - One-click unsubscribe must be offered on marketing emails, and requests handled within two days.
- Spam complaints must stay under 0.3%, and ideally under 0.1%.
- Your sending servers need valid reverse DNS and must use TLS encryption.
Why it matters
Emails that do not follow these rules are sent to spam or rejected with an error. Even if you send less than 5,000 emails a day, SPF or DKIM is required for everyone, and following the full list protects you as you grow.
How to check
- Send a test email: on the home page, copy your unique test address, send it a normal email from the mailbox or tool you want to check, then open the report. It shows SPF, DKIM, DMARC, reverse DNS and TLS in one place.
- Use the Domain scanner: type your domain at
/domain-scannerto check your SPF, DKIM and DMARC records. - Watch your spam rate in Google Postmaster Tools (free), which shows the share of your emails marked as spam by Gmail users.
How to fix it
- Set up SPF for every service that sends email for you. See the guide on missing SPF records.
- Turn on DKIM in each sending tool (mailbox provider, newsletter tool, shop) and publish its key in DNS.
- Publish a DMARC record, for example:
_dmarc.yourdomain.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com"
- Check alignment. The domain in your From address must match the domain used by SPF or DKIM. Most newsletter tools offer a "custom domain" or "authenticate your domain" setting for this.
- Add one-click unsubscribe. Your newsletter tool usually adds the
List-UnsubscribeandList-Unsubscribe-Postheaders for you. Also keep a visible unsubscribe link in the email itself. - Lower complaints. Only email people who asked for it, say clearly who you are, and remove inactive contacts.
Things that do not count
- Sending marketing email from a free address such as
@gmail.comor@yahoo.com: those domains have a strict DMARC policy, so your emails will fail. - An unsubscribe link that requires logging in: it must work in one click.
Check that it is fixed
DNS changes are not instant. Most are visible within a few minutes, but some providers take up to 24 to 48 hours.
Send a new test email from the home page, from the tool you use for bulk sending. SPF, DKIM and DMARC should all pass for your domain. Then follow your spam rate in Postmaster Tools over the next weeks.
Official rules: Google email sender guidelines and Yahoo sender best practices.
Check that it is fixed
DNS changes can take from a few minutes to a few hours. Then send a new test email or scan your domain again.
Related guides
- No DMARC record on your domainDMARC tells receivers what to do with emails that fail SPF and DKIM, and sends you reports. Gmail and Yahoo require it for bulk senders. Start with a safe monitoring record.
- DMARC fails: SPF and DKIM do not match your domainSPF or DKIM can pass and DMARC still fail, because they passed for another domain. Make at least one of them use the same domain as your From address.
- Move DMARC from p=none to quarantine or reject safelyp=none only watches. To really stop fake emails using your domain, move step by step to quarantine and reject, without blocking your own emails.
- High SpamAssassin spam scoreSpamAssassin scores the content of your email. Above 5, it is treated as spam. Learn what raises the score and how to bring it down.
- Your emails land in Gmail's spam folderWhen Gmail sends your emails to spam, the cause is almost always authentication, reputation or content. Here is how to find which one and fix it.