Gmail and Yahoo's bulk sender rules
What they demand since 2024, and which parts are yours to keep.
In February 2024 Gmail and Yahoo introduced rules for anyone sending in volume. They changed the industry — it’s why no platform lets you send from a Gmail From address any more. Most of it is handled for you; one part isn’t.
What they require
| Requirement | Who handles it |
|---|---|
| Authenticate with SPF and DKIM | Us |
| A DMARC policy on your domain | You, if you use your own domain |
| From address aligned with the signing domain | Us |
| One-click unsubscribe | Us |
| Honour opt-outs within two days | Us — immediately |
| Keep spam complaints under 0.3% | You |
The complaint rate is the one you own
0.3% is three complaints per thousand
That is a small number. A single send to a list that hadn’t been mailed in two years can clear it on its own, and once you’re over, Gmail starts filtering everything you send — not just the campaign that caused it.
We stop sending well before that threshold, because recovery is slow and the damage is shared. What keeps you comfortably under it:
- Only mail people who asked. The single biggest factor, and no technique compensates for getting it wrong.
- Send regularly enough to be recognised. Someone who hasn’t heard from you in a year doesn’t remember subscribing.
- Make unsubscribing easy. A hidden link doesn’t reduce opt-outs; it converts them into complaints, which cost far more.
- Say who you are in the subject and From name. Unrecognised mail gets reported.
Does it apply to you?
The strict thresholds target senders above roughly 5,000 messages a day to Gmail. But the authentication requirements are effectively enforced on everyone now, and complaint rates influence filtering at any size.
Practically: if you’re sending through a proper platform with a verified address, you already meet the technical bar.
FAQs
How do I see my complaint rate?+
Your Analytics shows complaints per campaign and overall. For Gmail’s own view of you, Google Postmaster Tools is free and requires a verified domain.
Do I need a DMARC record?+
If you use your own domain and send in volume, yes. Start at p=none — monitoring only.
What about Outlook?+
Microsoft announced similar requirements afterwards. The practical advice doesn’t change: authenticate properly, mail people who asked, keep complaints low.