Gmail & Yahoo Sender Requirements (2026)
In early 2024, Google and Yahoo rolled out stricter sender requirements — and they’ve been the baseline for reaching the inbox ever since. If you send cold email, or any volume of email, meeting them isn’t optional: mail that doesn’t comply is filtered or rejected.
Here’s exactly what they require and how to comply.
What changed, and why
Google and Yahoo tightened the rules to cut spam and spoofing. The headline: bulk senders must authenticate their mail, make unsubscribing easy, and keep spam complaints low. The strictest thresholds target high-volume senders (often framed around 5,000+ messages a day to Gmail), but the requirements are now the de facto standard for everyone — and cold senders should treat them as mandatory.
Grade your domain in seconds. The free Domain Health Checker tests SPF, DKIM, DMARC and MX in one pass and tells you exactly what to fix first. Run the check →
The three core requirements
1. Authenticate your email (SPF, DKIM, DMARC)
You must have SPF and DKIM, plus a DMARC policy (at minimum p=none) published, with alignment between your from-domain and the authenticated domain. This is the big one. See our SPF, DKIM & DMARC guide, and check yours with the Domain Health Checker.
2. Make unsubscribing easy
Bulk senders must support one-click unsubscribe (the list-unsubscribe header) and honor opt-outs promptly — within a couple of days. A working, easy unsubscribe also lowers spam complaints, which helps everyone’s deliverability.
3. Keep your spam rate low
Keep spam complaints below 0.3%, and ideally well under 0.1%. Above that, deliverability drops fast. This is driven by relevance — sending wanted mail to people who expect it.
Do these apply to me?
The formal bulk-sender thresholds focus on senders pushing thousands of messages a day, but in practice every sender is judged on the same signals. For cold email specifically, treat all three as requirements regardless of volume — filters apply the same logic to small senders.
How to comply
- Publish SPF, DKIM and DMARC, and confirm they pass (Domain Health Checker).
- Ensure DMARC alignment — your from-domain matches the authenticated domain.
- Add one-click unsubscribe / list-unsubscribe support and honor opt-outs quickly.
- Keep spam complaints under 0.3% by targeting tightly and personalizing.
- Use a separate, warmed sending domain and ramp volume gradually.
- Monitor placement and complaints continuously.
What happens if you don’t comply
Non-compliant mail gets filtered to spam or rejected outright — often silently. You’ll watch open and reply rates fall with no obvious cause. Because the providers enforce these rules, there’s no appeal beyond fixing the underlying signals.
Frequently asked questions
Do these rules apply to cold email?
Yes, in practice. Even below the formal bulk thresholds, providers apply the same authentication and engagement logic to everyone, so comply regardless.
What’s the spam complaint rate limit?
Keep it under 0.3%, ideally under 0.1%. Higher rates rapidly hurt deliverability.
Do I need one-click unsubscribe for cold email?
You should support list-unsubscribe and an easy opt-out — it’s required for bulk senders and reduces complaints for everyone.
How do I check if I meet the authentication requirements?
Run your domain through the free Domain Health Checker; it grades SPF, DKIM, DMARC and MX in one pass.
Compliant by default
Outboundry ships compliant by default — authenticated mailboxes, easy opt-out handling, and deliverability monitoring that keeps your complaint rate in check. Start your free trial, or check your domain with the free Domain Health Checker.