The Email Stack Scan a domain
← All guides
Authentication

What Google and Yahoo now require from bulk senders

Authentication, one-click unsubscribe and a spam rate under 0.3%. What each rule means, and how to check you meet it.

In February 2024, Google and Yahoo began enforcing a shared set of rules for anyone sending large volumes of email. If you send more than 5,000 messages a day to their users, you now have to meet every requirement below — or watch your mail get throttled, filed as spam, or rejected outright.

The rules are not complicated, but they are strict, and they are checked automatically. Here is what each one means and how to confirm you meet it.

Authenticate every message

You must publish and pass all three of the core authentication standards.

  • SPF tells receivers which servers are allowed to send for your domain. Publish one v=spf1 record and keep it under the limit of 10 DNS lookups. Check yours with our SPF checker.
  • DKIM signs each message with a private key so receivers can verify it was not altered in transit. Confirm your keys resolve with our DKIM lookup.
  • DMARC ties SPF and DKIM together and tells receivers what to do when a message fails. You need at least a p=none policy published at _dmarc.yourdomain. Read yours with our DMARC checker.

A message that fails all authentication will not reach the inbox. This is the single most common reason bulk mail gets blocked.

Offer one-click unsubscribe

Every marketing or bulk message must include a working one-click unsubscribe, implemented with the List-Unsubscribe and List-Unsubscribe-Post headers. When a recipient clicks unsubscribe, you must honour it within two days.

This is a header requirement, not just a link in the footer. A footer link alone does not satisfy the rule — the headers must be present so the mailbox provider can render its own unsubscribe button.

Keep your spam rate under 0.3%

Google measures the share of your mail that recipients mark as spam, reported in Google Postmaster Tools. You must keep it below 0.3%, and ideally under 0.1%. Cross 0.3% and delivery degrades quickly; the threshold is not a suggestion.

The practical defence is list hygiene and relevance: only send to people who asked, remove unengaged recipients, and make unsubscribing easier than reporting spam.

Your launch checklist

  • One valid SPF record, under 10 lookups — check
  • DKIM signing enabled and keys resolving — check
  • DMARC published at _dmarc, at least p=none — check
  • List-Unsubscribe and List-Unsubscribe-Post headers on bulk mail
  • Unsubscribes honoured within two days
  • Spam rate under 0.3% in Postmaster Tools

Meet all six and you clear the bar. The next step is moving DMARC from monitoring to enforcement — covered in our guide on going from p=none to p=reject.

Check your own domain