When did the Gmail and Yahoo requirements start?

Google and Yahoo announced them in late 2023 and began enforcing them from February 2024, with enforcement on bulk senders increasing over the following months.

Do the rules apply if I send fewer than 5,000 emails a day?

The strictest requirements are for bulk senders, but the basics (authentication, valid DNS, low spam rates) apply to everyone, and meeting all of them is the safe approach.

Is DMARC p=none enough?

For the Google and Yahoo bulk-sender minimum, yes: a policy of at least p=none is required. For protection against spoofing, move to quarantine or reject.

What spam rate do I need to stay under?

Google asks for under 0.30% and recommends staying below 0.10%. Yahoo also asks for complaint rates under 0.3%.

Does this tool check unsubscribe headers?

No. It checks DNS records. Inspect the headers of a real message to confirm List-Unsubscribe and List-Unsubscribe-Post are present.

Gmail and Yahoo sender requirements

In February 2024, Google and Yahoo began enforcing stricter authentication and unsubscribe rules. Here is what they ask for, in plain English, and how to check your domain against it.

Who the rules apply to

Some rules apply to everyone who sends to Gmail or Yahoo addresses. A stricter set applies to bulk senders. Google defines a bulk sender as one that sends close to 5,000 or more messages in a day to personal Gmail accounts. Once a domain has counted as a bulk sender, Google treats it as one from then on. Yahoo applies its requirements to bulk senders as well. Practically, if you send marketing, newsletters or notifications to many people, aim to meet every rule on this page.

These rules are policy set by Google and Yahoo and they are updated over time. Read the current versions in Google's email sender guidelines and Yahoo's sender best practices.

Requirements for all senders

Set up SPF or DKIM for your domain. Google asks for at least one for everyone.
Sending servers need valid forward and reverse DNS: the IP has a PTR record that points to a hostname, and that hostname resolves back to the IP.
Use a TLS connection to transmit email.
Keep the user-reported spam rate low. Google asks senders to stay below 0.10% in Postmaster Tools and never reach 0.30%.
Format messages according to the internet message format standard (RFC 5322), and do not impersonate Gmail From headers.

Extra requirements for bulk senders

Authenticate with both SPF and DKIM.
Publish a [DMARC](/dmarc-checker) record for the sending domain, with a policy of at least p=none.
Align the From domain with the domain that passes SPF or DKIM, which is what DMARC checks.
Support one-click unsubscribe for marketing and subscribed messages, and also include a visible unsubscribe link in the body. Unsubscribe requests should be processed within two days.
Keep the spam rate below 0.30% as reported in Google Postmaster Tools (Yahoo also asks for complaint rates under 0.3%).

Microsoft announced similar requirements for high-volume senders to Outlook.com consumer addresses in 2025, covering SPF, DKIM and DMARC. Check Microsoft's current guidance for the exact thresholds.

What one-click unsubscribe looks like

One-click unsubscribe is defined in RFC 8058. Your sending system adds two headers, and both must be covered by your DKIM signature. Most email service providers add them automatically when you switch the setting on.

One-click unsubscribe headers

List-Unsubscribe: <https://example.com/unsubscribe?u=abc123>, <mailto:unsubscribe@example.com>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

The HTTPS address must accept a POST request and unsubscribe the person without asking them to log in or confirm.

Common ways senders fail the rules

SPF and DKIM both pass, but for the provider's domain instead of yours, so there is no alignment and DMARC fails. Configure custom-domain authentication in your email service.
A DMARC record exists but is on the wrong hostname or is malformed. See the DMARC checker for the exact syntax.
Marketing email sent through a system that does not add the List-Unsubscribe headers.
Transactional and marketing mail share one domain, so a spike in complaints from marketing hurts password resets. Use separate subdomains such as mail.example.com for marketing.
Nobody watches the spam rate. Postmaster Tools is free and shows it directly.

How to check your domain

Scanning a domain here covers the DNS side of these rules: SPF, DKIM, DMARC and reverse DNS for the sending IPs, plus blocklist status. It cannot measure your spam rate, whether the unsubscribe headers are present on actual messages, or TLS use. Check those by sending a test message and inspecting its headers, and by registering for Google Postmaster Tools.

If something fails and you are not sure why, read why emails go to spam for the wider list of causes.

Frequently asked questions

When did the Gmail and Yahoo requirements start?: Google and Yahoo announced them in late 2023 and began enforcing them from February 2024, with enforcement on bulk senders increasing over the following months.
Do the rules apply if I send fewer than 5,000 emails a day?: The strictest requirements are for bulk senders, but the basics (authentication, valid DNS, low spam rates) apply to everyone, and meeting all of them is the safe approach.
Is DMARC p=none enough?: For the Google and Yahoo bulk-sender minimum, yes: a policy of at least p=none is required. For protection against spoofing, move to quarantine or reject.
What spam rate do I need to stay under?: Google asks for under 0.30% and recommends staying below 0.10%. Yahoo also asks for complaint rates under 0.3%.
Does this tool check unsubscribe headers?: No. It checks DNS records. Inspect the headers of a real message to confirm List-Unsubscribe and List-Unsubscribe-Post are present.