Changes to the requirements for sending email to Gmail and Yahoo

Since February 2024, Gmail and Yahoo have applied specific requirements to senders. They are not the same for every volume: bulk senders must meet additional conditions.

• Gmail's guidelines for senders.
• Yahoo's requirements and recommendations.

Requirements for all senders

To send to personal Gmail accounts, as a minimum you must:

• Authenticate with SPF or DKIM.
• Have valid forward and reverse DNS for the sending IP address.
• Transmit over TLS.
• Follow the RFC 5322 message format.
• Keep the Postmaster Tools spam rate below 0.3%; Google recommends staying below 0.1%.

Yahoo also requires SPF or DKIM, valid forward and reverse DNS, compliance with RFC 5321 and 5322 and a complaint rate below 0.3%.

Additional requirements for bulk sending

Gmail considers a bulk sender to be one that sends close to 5,000 or more messages in 24 hours to personal Gmail accounts. Yahoo applies its bulk sender requirements without an equivalent threshold being given in this guide. In those cases you need to:

• Authenticate every message with SPF and DKIM.
• Publish DMARC, at least with p=none, and make the domain shown in From: align with SPF or DKIM.
• Include one-click unsubscribe for promotional or subscription messages and a visible unsubscribe link in the body. Gmail requires it to be processed within two days.
• Keep spam or complaint rates below 0.3%.

DMARC does not automatically adopt p=quarantine when there is no record. The policy must be published explicitly, and it is best to start with p=none, review the reports and tighten it once all legitimate sources are aligned. See Set up the DMARC record.

Check the configuration

Domains that use our DNS get the base SPF and DKIM setup and can review it from Email Deliverability. The PTR record belongs to the outgoing IP address and can only be set up by whoever controls that IP. If the domain uses Cloudflare or other DNS servers, its domain records must be published at that provider.

The automatic setup only covers messages sent from our systems. If Google Workspace, Microsoft 365, a campaign platform or another provider also sends for you, add their authorisations and signatures. There must be a single SPF record and each service must be correctly aligned with DMARC.

Apply them to your case

Do the check for every platform that sends with your domain, not just the main mailbox. A shop may send from a different SMTP server from the one your business email uses.

One-click unsubscribe for marketing is implemented with compatible headers; a link in the message footer does not replace it. Nor should it require logging in to complete the unsubscribe. Check that your platform processes it and stops sending to the recipient.

If a message is rejected, keep the receiver's code and check delivery tracking. Meeting the technical requirements reduces the causes of rejection, but does not guarantee acceptance or delivery to the inbox. Check the official sources from time to time: receivers' conditions can change.