toolhq.io

All posts
8 min readby Jameel Haider

The bulk sender rules for Gmail and Yahoo, and how to meet them

In February 2024 Gmail and Yahoo began enforcing a shared set of requirements on anyone sending significant volume to their users. The rules were announced together and are close enough to identical that meeting one set meets the other. Enforcement moved from warnings to rejections over the following months, and messages from non compliant senders now get temporary failures or land in spam.

The threshold is roughly 5,000 messages a day to a single provider. Below that, the requirements are still good practice and parts of them still apply. Above it, they are conditions of delivery.

Authenticate with SPF and DKIM

Both must be in place. Not one of them.

SPF authorises the sending IP for the envelope sender domain. DKIM signs the message with a key published in your DNS. They fail in different circumstances, which is why both are required: SPF breaks when mail is forwarded, DKIM survives forwarding but breaks when the message is modified.

Verify both resolve correctly with the email health check, which reads your SPF, DKIM and DMARC records in one pass. If SPF returns a permanent error, too many DNS lookups is the usual cause and it counts as a failure, not a warning.

Publish a DMARC policy

A DMARC record is required. The minimum accepted is p=none, which enforces nothing but makes the domain's policy explicit and turns on aggregate reporting.

v=DMARC1; p=none; rua=mailto:dmarc@example.com

p=none satisfies the requirement, but it is a starting point rather than a destination. The reports it produces are what let you move to quarantine and eventually reject without breaking legitimate mail. Reading them is covered in understanding DMARC aggregate reports, and the DMARC report viewer parses the compressed XML attachments locally.

To build a correct record, the DMARC generator assembles the syntax, and DMARC reject bouncing legitimate email covers what to check before tightening the policy.

Align the From domain

Authentication alone is not enough. The domain that passes must align with the domain in the visible From header.

If your From address is news@example.com but DKIM signs as mailer.vendor.com and SPF authorises vendor.com, both checks pass and DMARC still fails, because neither aligned with example.com. This is the single most common reason a sender believes they are compliant and is not.

The fix is to configure your sending platform to sign with a key on a subdomain of your own domain, usually via a CNAME your provider gives you, so DKIM signs as example.com or mail.example.com.

One-click unsubscribe

This is the requirement that catches people, because it is a message header rather than a DNS record and often needs a change in the sending application.

Marketing and subscribed messages must include both headers defined in RFC 8058:

List-Unsubscribe: <https://example.com/unsub?id=abc123>, <mailto:unsub@example.com?subject=abc123>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

Three details matter:

  • List-Unsubscribe-Post is what makes it one click. Without it, List-Unsubscribe on its own is the older convention and does not satisfy the requirement.
  • The URL must accept a POST and act on it immediately. No confirmation page, no login, no preference centre. The provider sends the POST on the user's behalf and expects the unsubscribe to be recorded.
  • You have two days to honour it. Requests must take effect within 48 hours.

Transactional mail such as receipts and password resets does not need these headers. Applying them to genuinely transactional messages is harmless but usually unnecessary.

You can confirm the headers are present on a real send by mailing yourself and reading the raw source with the email header analyzer, which is also the fastest way to see what your platform is actually emitting rather than what its settings claim. How to read email headers covers the rest of what shows up there.

Keep the spam complaint rate low

The stated threshold is 0.3 percent, measured in Google Postmaster Tools. The practical target is below 0.1 percent, because the rate is evaluated over time and brief spikes at 0.3 are treated as a problem.

Complaint rate is the requirement you cannot fix with configuration. It reflects list quality:

  • Send only to addresses that asked. Purchased and scraped lists produce complaint rates far above the threshold immediately.
  • Make the visible unsubscribe link easy to find. Users who cannot find it press the spam button instead, and that is precisely the metric being measured.
  • Remove addresses that bounce repeatedly and those that have not engaged in a long time.
  • Keep sending patterns steady. A dormant domain that suddenly sends a large campaign draws scrutiny.

Register the domain in Google Postmaster Tools before you need it. Without it you have no visibility into the number that decides your delivery.

Valid forward and reverse DNS

The sending IP needs a PTR record that resolves back to a hostname, and that hostname must resolve forward to the same IP. This is the oldest check in the list and usually handled by whoever provides the IP, but it is worth confirming rather than assuming, especially on a self managed server.

Check it with the reverse DNS lookup, and see reverse DNS and PTR records for how the delegation works when you control the address space.

Transmit over TLS

Connections must use TLS. Every mainstream sending platform does this already. If you run your own MTA, confirm STARTTLS is offered and the certificate is valid. MTA-STS and TLS-RPT covers enforcing the same thing for mail arriving at your domain.

A verification order that works

  1. Run the email health check on your sending domain and resolve anything it flags in SPF, DKIM or DMARC.
  2. Send a test message to an address you control and read the raw headers with the email header analyzer. Confirm DKIM signs with your domain, that alignment holds, and that both unsubscribe headers are present.
  3. Check the sending IP with the reverse DNS lookup, and confirm it is not listed using the blacklist check.
  4. Register in Google Postmaster Tools and watch the complaint rate for a full sending cycle before assuming you are done.

The configuration items are a day of work. The complaint rate is the one that takes ongoing attention, and it is the one that decides whether the rest of it matters.