What are the Gmail and Yahoo sender requirements?

In February 2024 Gmail and Yahoo began enforcing a shared set of requirements on senders of more than 5,000 messages a day to their users. Microsoft announced comparable rules for Outlook consumer accounts afterwards. They are not standards in the RFC sense — they are the conditions under which the largest receivers will keep accepting your mail.

The requirements

Authenticate with SPF and DKIM. Both. See SPF and DKIM.

Publish a DMARC record. p=none satisfies the letter of it. See DMARC.

Align. The domain in the From: header must match the domain authenticated by SPF or by DKIM. This is the requirement that catches senders who thought they were already compliant, because SPF and DKIM can both pass without it. See DMARC alignment.

Keep spam complaints below 0.3%. Measured in Google’s Postmaster Tools. The stated target is below 0.1%; 0.3% is where enforcement starts. Complaint rates are not symmetrical with volume — a small number of complaints on a small send can cross the line.

One-click unsubscribe on marketing mail. A List-Unsubscribe header supporting one-click per RFC 8058, honoured within two days. This applies to promotional mail, not to transactional messages a recipient caused.

Valid forward-confirmed reverse DNS on sending IPs, and TLS on the connection. See forward-confirmed reverse DNS.

A valid, reachable From: domain that resolves, and no impersonation of Gmail or Yahoo domains in the From: header.

The threshold is not a safe line

5,000 messages a day is where the rules are enforced, not where they start mattering. Three things are worth knowing about it:

• It is counted per domain, per receiver. Several products sending under your one domain are added together.
• Crossing it once can be enough. It is not a rolling average you can sit just under.
• Everything on the list except one-click unsubscribe is something receivers already weighted for senders of any size. The announcement made explicit what was previously discretionary.

For a transactional sender the practical reading is: the authentication requirements apply to you at any volume, because they were always what receivers used to decide. The unsubscribe requirement does not, because your mail is not promotional.

Checking where you stand

1. Send a message to a Gmail address and read the raw headers. Authentication-Results gives you spf=, dkim= and dmarc= in one line. The dmarc= verdict is the one that covers alignment.
2. Register the domain in Postmaster Tools. It is the only place the complaint rate Google measures is visible to you. Without it you are guessing at the number the rules are enforced against.
3. Check your PTR with dig -x on each sending IP, and confirm the hostname resolves back.
4. Read your DMARC aggregate reports for systems sending as your domain that you had forgotten about. That is usually where the failing mail is.

What compliance does and does not get you

It gets you accepted for consideration. Every requirement on the list is about identity and consent, not quality, and meeting all of them puts you in the population of senders whose reputation is then judged normally.

It does not get you the inbox. Complaint rate, bounce rate, sending pattern and recipient behaviour still decide that, and no configuration changes it. Nobody controls inbox placement, and a provider claiming a placement percentage is describing something they cannot measure on your behalf.

Pharos enforces SPF, DKIM and alignment before a domain may send, and re-checks the records daily. What it deliberately does not claim is on the deliverability page.