← NewsNews

Gmail and Yahoo Sender Rules Since February 2024: A Checklist

Since February 2024 Gmail and Yahoo require SPF, DKIM and DMARC from bulk senders, plus one-click unsubscribe and a spam rate under 0.3%. What to check.

Published: · 3 min read

Event date: 2024-02-01 (start of enforcement) · Sources: Google, Email sender guidelines and Yahoo Sender Hub, Sender Best Practices, both read 2026-09-21.

What happened

On 3 October 2023 Google announced new requirements for mail sent to Gmail users, and Yahoo announced matching rules for its mailboxes. Enforcement began in February 2024 and was rolled out gradually; Yahoo's page speaks of a gradual rollout through the first half of that year, and Google gave senders that already had an unsubscribe link until 1 June 2024 to add the one-click variant. Google's FAQ adds that Gmail has been ramping up enforcement against non-compliant traffic since November 2025. The rules are still in force and both providers keep them on the pages linked above, which is why this post describes them as they read today rather than as they were announced.

What was new was not the technology (SPF, DKIM and DMARC are all more than a decade old) but that two of the largest mailbox providers made them a condition of delivery and published numbers.

Who is affected

Everybody who sends mail to Gmail or Yahoo addresses, in two tiers:

Requirement All senders Bulk senders
SPF or DKIM required both required
DMARC record recommended required, p=none is enough
From domain aligned with SPF or DKIM domain required
Valid forward and reverse DNS (PTR) for sending IPs required required
TLS for transmission (Gmail) required required
Spam complaint rate below 0.3% below 0.3%
One-click unsubscribe (RFC 8058) in marketing mail required
Messages formatted per RFC 5322 required required

Google defines a bulk sender as one that sends close to 5,000 messages or more to personal Gmail accounts within 24 hours. Mail from subdomains counts toward the total of the primary domain, and bulk-sender status has no expiry date once it has been reached. Yahoo publishes no number. Google additionally advises staying below a 0.1% spam rate and never reaching 0.3%. Yahoo asks that unsubscribe requests are honoured within two days.

The unsubscribe requirement applies to marketing and subscribed messages; transactional mail such as password resets and order confirmations is excluded from it.

What to do

  1. Find every system that sends with your domain in the From header: mailbox provider, newsletter tool, shop, CRM, invoicing, help desk, the web server's contact form.
  2. Check SPF and DKIM for each of them, and check alignment: a DKIM signature with d=esp.example passes DKIM but does not help DMARC for example.com. Set up the custom DKIM domain every serious sending service offers.
  3. Publish a DMARC record and read the reports before tightening the policy:
_dmarc.example.com.  3600  IN  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com"
  1. Verify PTR and the matching A/AAAA record if you run your own mail server. With a sending service, that part is theirs.
  2. Add one-click unsubscribe to marketing mail. Both headers are needed, and they must be covered by the DKIM signature:
List-Unsubscribe: <https://example.com/unsubscribe/abc123>
List-Unsubscribe-Post: List-Unsubscribe=One-Click
  1. Watch the complaint rate in Google Postmaster Tools and in Yahoo's Sender Hub. Complaint rates are fixed with consent and list hygiene, not with DNS.

Small senders are not exempt from the first column, and nothing in the second column harms a small sender: a DMARC record and aligned DKIM are worth having at any volume.

How to check

The OrbitProbe DMARC checker reads the record at _dmarc for your domain and explains the policy, the alignment modes and the report addresses. The SPF checker and the DKIM checker cover the other two records.

Background

Sources

May we count visits with Google Analytics? It sets cookies and sends usage data to Google. Nothing loads unless you allow it. Cookie details