Gmail and Yahoo Sender Requirements: The 2026 Compliance Checklist

Gmail sender requirements in one line: every sender to personal Gmail accounts needs SPF or DKIM, valid forward and reverse DNS, a TLS connection, RFC 5322-formatted messages and a spam rate in Postmaster Tools below 0.3%. Bulk senders (around 5,000 or more messages a day to Gmail) also need SPF and DKIM, a DMARC record (p=none is allowed), From: domain alignment and one-click unsubscribe on marketing mail. Yahoo's rules are very close, and add a requirement to honour unsubscribes within 2 days.

Last checked: 14 October 2026. Every requirement below was checked against Google's and Yahoo's own pages on that date. Mailbox providers update these pages, so follow the links to confirm before you change DNS.

In this guide:

• Who counts as a bulk sender, and why the status is permanent
• The full Gmail and Yahoo sender requirements checklist
• A step-by-step compliance setup, from SPF to spam-rate monitoring
• What Google and Yahoo say happens if you don't comply
• How Cresca handles parts of this for you
• Frequently asked questions

What the Gmail sender requirements are, and where they come from

Google publishes its rules in the Email sender guidelines, with a companion Email sender guidelines FAQ. Yahoo publishes its version on the Yahoo Sender Hub best practices page. Both set February 2024 as the start of enforcement.

Google's guidelines split the rules into two tiers: requirements for all senders, and extra requirements for senders who send 5,000 or more messages per day to Gmail accounts. Yahoo uses the same two tiers: "Requirements for All Senders" and "Requirements for Bulk Senders".

Two scope details matter before you start:

• Personal accounts only. Google's FAQ states: "The Email sender guidelines don't apply to messages sent to Google Workspace accounts." The rules cover mail sent to personal Gmail accounts, including mail sent from Workspace.
• Direct mail versus forwarded mail. Google's FAQ says DMARC alignment "isn't required for forwarded or mailing list messages", which it calls indirect messages. Your marketing campaigns are direct mail, so alignment applies to them.

Who counts as a bulk sender?

The wording differs slightly between Google's pages, which is worth knowing:

• The main guidelines page addresses senders "who send more than 5,000 messages per day to Gmail accounts".
• The FAQ defines it more loosely: "A bulk sender is any email sender that sends close to 5,000 messages or more to personal Gmail accounts" within a 24-hour period.
• The Postmaster Tools dashboards page describes a bulk sender as one that "sends about 5,000 messages or more to Gmail accounts in a 24-hour period."

Three further points from the FAQ change how you should plan:

1. Counting is by primary domain. "Messages sent from the same primary domain count toward the 5,000 limit." Splitting campaigns across subdomains does not reset the count.
2. The status is permanent. "Senders who meet the above criteria at least once are permanently considered bulk senders." One large send to your whole list can be enough.
3. Only Gmail recipients count. The threshold refers to messages to Gmail accounts, not your total volume across all mailbox providers.

Yahoo's best-practices page lists bulk sender requirements but does not give a numeric threshold on the page we checked. The practical advice is the same for both: if your list could ever produce a 5,000-message day to Gmail, set up for bulk-sender compliance from the start. The extra work is small, and it removes the risk of crossing the line during your biggest campaign of the year.

Gmail and Yahoo sender requirements checklist

This table combines both providers' published requirements. "All senders" and "Bulk senders" describe what each provider requires for that tier, quoting their wording where it matters.

Notice how much sits in the "all senders" column. Even a team sending a few hundred emails a week needs authentication, valid DNS, TLS and a low spam rate. The bulk tier mainly adds DMARC, alignment and one-click unsubscribe.

How to meet Gmail sender requirements: step by step

The order below matters. Each step depends on the one before it, and DMARC in particular should only be published once SPF and DKIM are working. For a deeper walkthrough of the DNS records themselves, see our guide to SPF, DKIM and DMARC done right.

Step 1: Send from your own domain

1. Pick the domain your subscribers recognise, such as yourbrand.com, and send from an address on it (news@yourbrand.com).
2. Avoid free mailbox addresses in the From: header. Google's guidelines list "Don't impersonate Gmail From: headers" as a requirement for all senders.
3. Decide whether marketing mail will use the root domain or a subdomain such as mail.yourbrand.com. Remember that Google counts volume by primary domain either way.

Step 2: Publish SPF

1. List every service that sends mail for your domain: your mailbox provider, your email marketing platform, your helpdesk, your billing tool.
2. Publish an SPF TXT record that includes each of them, merging entries into the existing record rather than adding a second one.
3. If your platform supports a custom MAIL FROM (bounce) subdomain, set it up. The Return-Path then sits on your domain, which is what allows SPF to align with your From: domain.

Example (hypothetical): a retailer sends staff email through one provider and campaigns through a marketing platform. Their SPF record includes both services. Campaign bounces go to bounce.yourbrand.com, so the SPF domain shares the organisational domain yourbrand.com with the From: address.

Step 3: Publish DKIM

1. In your sending platform, generate DKIM keys for your domain. Most platforms give you CNAME or TXT records to add.
2. Add the records at your DNS host and wait for the platform to confirm they are verified.
3. Send a test to a Gmail address, open the message, choose Show original and confirm DKIM: PASS with your own domain.

Yahoo's additional recommendations specify DKIM "with a minimum 1024-bit key length". DKIM signed with your own domain is also the simplest route to alignment in Step 5.

Step 4: Publish DMARC, starting at p=none

Google's guidelines say: "Your DMARC enforcement policy can be set to none." Yahoo says "at least p=none". Starting with a monitoring policy lets you see who is sending as your domain before you start rejecting anything.

1. Create a TXT record at _dmarc.yourbrand.com.
2. Start with a monitoring policy, for example: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourbrand.com
3. Read the aggregate reports for a few weeks. Look for legitimate services that fail SPF and DKIM alignment, and fix them.
4. Only then consider moving to p=quarantine and later p=reject. Neither provider requires this for bulk senders; it is an optional hardening step.

Note Yahoo's wording: "DMARC must pass". Publishing a record is not enough on its own. Each message needs aligned SPF or aligned DKIM to pass.

Step 5: Confirm alignment

Google's FAQ explains the rule for direct mail: "the organizational domain in the sender From: header must be aligned with either the SPF organizational domain or the DKIM organizational domain." It adds that only one needs to align, though aligning both is recommended. Yahoo says "Relaxed alignment is acceptable", meaning subdomains of the same organisational domain count as aligned.

1. Open a test email's raw headers.
2. Note the From: domain, the DKIM signature domain (d=) and the Return-Path domain.
3. Confirm at least one of DKIM d= or Return-Path shares your organisational domain, and that the header shows dmarc=pass.

Step 6: Add one-click unsubscribe headers

Google's guidelines show the two headers required for one-click unsubscribe:

• List-Unsubscribe-Post: List-Unsubscribe=One-Click
• List-Unsubscribe: <https://yourbrand.com/unsubscribe/example>

The technical standard is RFC 8058. Its key rules:

• "The List-Unsubscribe header field MUST contain one HTTPS URI."
• "The List-Unsubscribe and List-Unsubscribe-Post headers MUST be covered by the signature", meaning your DKIM signature. Without that, mailbox providers should not offer one-click unsubscribe for the message.
• "The mail sender MUST NOT return an HTTPS redirect" in response to the unsubscribe POST.
• The POST request "MUST NOT include cookies, HTTP authorization, or any other context information", so the URL itself must identify the subscriber and list.

Two clarifications from Google's FAQ. First, "One-click unsubscribe links that link to a landing or other type of web page don't comply with RFC 8058." A preference centre is fine as an extra, but it cannot replace the header. Second, "We'll continue to support mailto links but they don't meet our one-click unsubscribe requirement."

Scope matters too: "One-click unsubscribe is required only for marketing and promotional messages. Transactional messages are excluded from this requirement." Google gives password resets, reservation confirmations and form submission confirmations as examples of transactional mail.

Finally, keep a clearly visible unsubscribe link in the email body. Both providers require it for bulk senders, and our guide to GDPR and CAN-SPAM compliance covers the legal side of opt-outs.

Step 7: Process unsubscribes fast

1. Make sure an unsubscribe from any route (header, body link, reply) updates one suppression list.
2. Target removal well inside Yahoo's "within 2 days". Google's FAQ recommends "within 48 hours".
3. Test it: unsubscribe a seed address, then schedule a send and confirm the address is excluded.

Step 8: Check DNS, PTR and TLS

Google requires that "sending domains or IPs have valid forward and reverse DNS records, also referred to as PTR records" and that you "Use a TLS connection for transmitting email." If you use an email service provider, these sit with the provider's sending infrastructure, so ask them to confirm. The Postmaster Tools Compliance status dashboard also reports DNS records and encryption.

Step 9: Set up Google Postmaster Tools and watch spam rate

Google's Postmaster Tools setup guide describes the process:

1. Sign in to Postmaster Tools and add the domain you use for SPF or DKIM authentication.
2. Copy the TXT or CNAME verification record and add it at your DNS host.
3. Return to Postmaster Tools and click Verify. Google notes verification can take up to 10 minutes to update.

Then check two dashboards regularly:

• Spam rate. Google's guidelines say: "Keep spam rates reported in Postmaster Tools below 0.10% and avoid ever reaching a spam rate of 0.30% or higher." The FAQ adds that "Spam rate is calculated daily." The dashboard shows spam rate for DKIM-authenticated mail to Gmail accounts.
• Compliance status. This shows each requirement as Compliant, Needs work or No data found, grouped into requirements for all senders and for bulk senders. Google notes that compliance data applies to primary domains rather than subdomains.

If the dashboards are empty, it may be volume. Google's setup page says: "Data might be missing if the total number of messages for a given day is too low."

To keep spam rate low, send only to people who asked for your mail, confirm sign-ups (see double opt-in explained), increase volume gradually on new domains (see our domain warmup guide) and stop mailing people who never engage.

What happens if you don't meet the Gmail and Yahoo sender requirements

Here is what each provider states.

Google. The guidelines say: "If you don't meet the requirements described in this article, your email might not be delivered as expected, or might be marked as spam." The FAQ is more specific:

• "Messages that fail to meet the email sender requirements will experience disruptions, including temporary and permanent rejections."
• "Starting November 2025, Gmail is ramping up its enforcement on non-compliant traffic."
• Enforcement for bulk senders "will be gradual and progressive", and for new domains (any domain that hasn't sent more than 5,000 emails a day to personal Gmail accounts since 1 January 2024) "the enforcement progression for new domains will be on an accelerated timetable."
• Rejected messages come with "a rejection code and a reason for the rejection", and temporary failures include error codes that indicate which requirement is failing.
• Mitigation: "Starting in February 2024, we won't provide mitigation for email delivery issues to senders that don't meet the guidelines." From June 2024, "bulk senders with a user-reported spam rate greater than 0.3% will be ineligible for mitigation." Eligibility returns "when their spam rates remain below 0.3% for 7 consecutive days."
• Missing DMARC (the minimum policy being p=none) is listed as a failure that makes delivery support or mitigations unavailable.

Yahoo. The Sender Hub says: "Beginning in February 2024, enforcement of the following sending standards will take effect," and "Enforcement will be gradually rolled out, as we monitor compliance through the first half of the year." The page we checked does not describe specific penalties beyond that.

The practical reading: non-compliance doesn't fail in one dramatic moment. It shows up as more mail in spam, deferrals and bounces with policy error codes, and no route to support when you ask for help. Your bounce and complaint numbers are often the first signal, which is why our email deliverability guide recommends checking them after every send.

Gmail vs Yahoo sender requirements: the differences that matter

The two sets of rules overlap almost entirely. The differences worth knowing:

If you build to the stricter of each line, you satisfy both. In practice that means the RFC 8058 POST method, unsubscribes processed within two days, TLS, and a spam rate kept well under 0.1%.

How Cresca handles parts of the sender requirements

No platform can make you compliant on its own. Spam rate depends on who you mail and what you send, and DMARC lives in your DNS. Here is what Cresca does and doesn't do:

• Own-domain SPF and DKIM. You send from your own domain with SPF and DKIM. If your domain's DNS is on Cloudflare, Cresca can set up the records automatically.
• Custom MAIL FROM (bounce) subdomain. Bounces use a subdomain of your domain, which lets SPF align with your From: address.
• DMARC is yours to publish. Cresca does not create a DMARC record. It recommends starting with a monitoring policy (p=none), as in Step 4.
• One-click unsubscribe. Campaign emails carry the RFC 8058 headers (List-Unsubscribe with an https link and List-Unsubscribe-Post: List-Unsubscribe=One-Click) plus a visible unsubscribe link, and unsubscribes are processed automatically.
• Suppression. Unsubscribed, bounced and complaining addresses are suppressed so they are not mailed again.
• Reporting. Each campaign shows recipients, deliveries, bounces, complaints and unsubscribes, so you can spot a complaint problem before it shows up in Postmaster Tools.

Lists, tags and CSV imports live in contact management, which makes it easier to send only to people who opted in. You still need to publish DMARC, verify your domain in Postmaster Tools and watch your spam rate yourself.

Frequently asked questions

Do Gmail sender requirements apply if I send fewer than 5,000 emails a day?

Yes. The all-senders tier applies to everyone sending to personal Gmail accounts: SPF or DKIM, valid forward and reverse DNS, TLS, RFC 5322 formatting, no Gmail From: impersonation and a spam rate below 0.3%. DMARC, alignment and one-click unsubscribe are formally bulk-sender requirements, but setting them up early costs little and protects you if your volume grows.

Is a DMARC policy of p=none enough?

For the requirement itself, yes. Google says "Your DMARC enforcement policy can be set to none," and Yahoo asks for "at least p=none". Yahoo adds that "DMARC must pass", so your mail also needs aligned SPF or DKIM.

Moving to quarantine or reject later is optional hardening, best done after reviewing aggregate reports.

What is the spam rate threshold for Gmail and Yahoo?

Both require a spam rate below 0.3%. Google goes further: "Keep spam rates reported in Postmaster Tools below 0.10% and avoid ever reaching a spam rate of 0.30% or higher." Google calculates the rate daily. Bulk senders above 0.3% lose eligibility for mitigation until the rate stays below 0.3% for 7 consecutive days.

Do transactional emails need one-click unsubscribe?

No. Google's FAQ says: "One-click unsubscribe is required only for marketing and promotional messages. Transactional messages are excluded from this requirement." It gives password resets, reservation confirmations and form submission confirmations as examples, and notes the distinction "can vary depending on industry and applicable regulations." Newsletters and promotions need one-click unsubscribe.

How quickly do I have to honour an unsubscribe?

Yahoo requires bulk senders to "Honor unsubscribes within 2 days." Google's FAQ recommends fulfilling unsubscribe requests "within 48 hours, a reasonable timeline for removing recipients from a mailing list." Aim to stop mailing the address immediately and process every route, including header, body link and replies, into one suppression list.

Can my one-click unsubscribe link go to a preferences page?

Not as the one-click mechanism. Google's FAQ says links to "a landing or other type of web page don't comply with RFC 8058." The List-Unsubscribe header must point to one HTTPS URL that accepts a POST and unsubscribes without further steps. You can still offer a preference centre through a separate link in the email body.

Does sending from a subdomain avoid bulk sender status?

No. Google's FAQ states: "Messages sent from the same primary domain count toward the 5,000 limit." Mail from news.yourbrand.com and yourbrand.com counts together. Once you qualify, Google says bulk senders "are permanently classified as such", so plan for bulk-sender compliance if you might ever reach the threshold.

Meet the sender requirements without the guesswork

The checklist above works with any platform: authenticate your domain, publish DMARC at p=none, align your From: domain, add RFC 8058 unsubscribe headers, honour opt-outs within two days and keep spam rate under 0.1% in Postmaster Tools. Recheck the official pages every few months, because Google says enforcement is still ramping up.

If you want a platform that sends from your own domain with SPF, DKIM and a bounce subdomain, handles unsubscribes and suppression, and lets an AI agent design on-brand email campaigns from a short brief, Cresca is built for every team.

Try Cresca free for 30 days.

Continue learning

Related Cresca resources

• Email deliverability guide
• SPF, DKIM and DMARC done right
• Email marketing with Cresca

External references

• Gmail email sender guidelines
• RFC 8058: one-click unsubscribe