In February 2024 the two largest mailbox providers on earth changed what it takes to reach an inbox. Enforcement has tightened every year since. Here's what's actually required, and how to check whether you comply.
Google defines a bulk sender as anyone sending roughly 5,000 or more messages a day to Gmail addresses. Yahoo's requirements run in parallel. If you run an ecommerce list, an operator's player base, or any consumer programme of size, you are a bulk sender — including on days you didn't plan to be, because the threshold counts messages, not campaigns.
Below the threshold the rules are still best practice, and providers increasingly apply the same signals to everyone. Treating them as optional because you're small is a decision that ages badly.
SPF and DKIM must be set up, and DMARC must exist for your sending domain. Crucially, your From domain must align with the domain that passes SPF or DKIM — authentication that passes on a different domain does not count.
Marketing mail must include a functioning List-Unsubscribe header so a recipient can leave in one click, and the request must be honoured within two days. A link buried in the footer is no longer sufficient.
Spam complaints reported in Google Postmaster Tools must stay below 0.3%. Above it, delivery degrades. Well above it, mail is rejected outright — and the damage outlives the campaign that caused it.
The rules landed in February 2024 with temporary errors and throttling for non-compliant mail. Through 2025 that escalated to permanent rejection for senders who never fixed their setup. The grace period is over, and the practical effect is that a configuration which quietly worked for a decade can now stop working entirely, without warning and without a bounce you'd notice.
Gmail's filtering scale is worth keeping in perspective: its systems block billions of unwanted messages every day. You are not being individually assessed by a human. You are a set of signals, and the signals are authentication, complaint rate and engagement.
One SPF record per domain, and it must stay within the ten-lookup limit. Exceed it and SPF silently fails — a common cause of sudden, unexplained deliverability collapse after adding a new tool.
Your ESP signs mail, but the signing domain has to align with your From domain for DMARC to pass. This is where most "we're authenticated" setups actually fail.
A record at p=none satisfies the letter of the requirement but protects nothing. It's a monitoring state, not a destination — and years-old p=none records are the most common finding in our audits.
Both the header and the POST endpoint. Test it by actually clicking it, not by confirming the header exists.
Free from Google, and the only place you see your real complaint rate and domain reputation. If you're a bulk sender and haven't set it up, do that before anything else on this list.
Authentication passing is the entry ticket, not the seat. Only a placement test tells you whether you're in Primary, Promotions, spam, or silently missing.
Treating compliance as a checklist completed once. Authentication is configuration; complaint rate and engagement are behaviour. You can be perfectly authenticated and still land in spam because you mail people who stopped caring two years ago. The senders who hold their placement are the ones who prune, segment and sunset — continuously, and against their own revenue instincts.
The second mistake: sharing one sending domain between transactional and promotional mail. When a discount campaign draws complaints, password resets and order confirmations degrade with it. Separate them by subdomain before you need to, because doing it during an incident is far more expensive.
The free scan answers the first three in about a minute. The placement test answers the last one within a business day.