Datahorses

Gmail and Yahoo sender requirements: what changed in 2024 and what to check

By · · 4 min read

Since February 2024, Gmail and Yahoo require every sender to authenticate their mail, and they set stricter rules for bulk senders: SPF and DKIM, a published DMARC record, a From domain aligned with SPF or DKIM, one-click unsubscribe for marketing mail, and a low spam complaint rate. Mail that misses these requirements can be delayed, sent to spam or rejected.

These rules apply to anyone sending to personal Gmail and Yahoo addresses, which for most companies means a large share of their customers. Invoices, password resets and order confirmations are affected just as much as newsletters.

Below is what each provider actually requires, with links to their own documentation, followed by the checks you can run yourself.

What Gmail requires

Google's email sender guidelines took effect in February 2024. For all senders to personal Gmail accounts:

  • SPF or DKIM authentication for the sending domain.
  • Valid forward and reverse DNS (PTR) records for sending IPs.
  • A TLS connection for transmitting mail.
  • Spam rates reported in Postmaster Tools below 0.3%.
  • Messages formatted according to RFC 5322.

For senders of 5,000 or more messages per day, Google adds:

  • Both SPF and DKIM.
  • A DMARC record for the sending domain (the policy may be p=none).
  • The From domain aligned with either the SPF domain or the DKIM domain.
  • One-click unsubscribe for marketing and subscribed messages, plus a visible unsubscribe link in the body.

Google's sender guidelines FAQ adds 3 details that matter in practice. Messages from the same primary domain count together toward the 5,000 threshold. A sender that crosses it once is permanently considered a bulk sender. And starting November 2025, Gmail ramped up enforcement, with non-compliant mail facing temporary and permanent rejections.

What Yahoo requires

Yahoo's sender best practices also took effect in February 2024. For all senders: SPF or DKIM, a spam rate below 0.3%, valid forward and reverse DNS, and compliance with RFC 5321 and RFC 5322.

For bulk senders, Yahoo requires:

  • Both SPF and DKIM.
  • A valid DMARC policy of at least p=none, and DMARC must pass.
  • The From domain aligned with the SPF or DKIM domain (relaxed alignment is acceptable).
  • A working List-Unsubscribe header that supports one-click unsubscribe. Yahoo highly recommends the POST method from RFC 8058.
  • Unsubscribes honored within 2 days.

Unlike Google, Yahoo does not publish a fixed number of messages that makes you a bulk sender, so it is sensible to meet the bulk requirements whenever you send marketing mail.

Where companies usually fall short

DKIM only on the main mailbox. Your office mail is signed, but the CRM, newsletter tool or invoicing system sends unsigned mail or signs with the tool vendor's domain, which breaks alignment.

SPF that passes for the wrong domain. Many sending services use their own bounce domain, so SPF passes for bounces.vendor.net, not for your domain. Without aligned DKIM, DMARC then fails.

No DMARC record at all. Even p=none is required for bulk senders by both providers. Our guide to SPF, DKIM and DMARC explains the record format.

Unsubscribe as a link only. One-click unsubscribe means headers the mailbox provider can act on directly, not only a link in the footer.

Old lists. Sending to addresses that never opted in drives up spam complaints, and the 0.3% ceiling is low.

How to check your domain

Start with DNS:

dig +short TXT yourcompany.com | grep spf1
dig +short TXT _dmarc.yourcompany.com

Then send a message from each system that mails your customers (office mail, CRM, newsletter, invoicing, help desk) to a Gmail address you control. In Gmail, open the message, choose "Show original" and look for:

SPF:   PASS with domain yourcompany.com
DKIM:  PASS with domain yourcompany.com
DMARC: PASS

The domain shown for SPF or DKIM should match your From domain. For marketing mail, the original source should contain both headers required for one-click unsubscribe:

List-Unsubscribe: <https://yourcompany.com/unsubscribe?id=...>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

Finally, register your domain in Google Postmaster Tools to see the spam rate Google measures for you.

A short checklist

  1. SPF published and passing for your domain.
  2. DKIM signing with your own domain in every sending system.
  3. DMARC published, at least p=none, with reports read regularly.
  4. From domain aligned with SPF or DKIM in every system.
  5. One-click unsubscribe headers on marketing mail, requests processed within 2 days.
  6. Spam rate monitored in Postmaster Tools and kept well below 0.3%.
  7. PTR records valid for any IP you send from directly.

Microsoft introduced similar rules for Outlook.com in 2025, covered in Outlook sender requirements and the 550 5.7.515 rejection.

How Datahorses helps

Email authentication is part of what Datahorses watches from the outside every day. If your SPF record changes, a DKIM key disappears, DMARC is weakened or your domain lands on a blocklist, a person reviews it and you get exact steps for your developer. See what we guard for the full list, or request a proposal if you would like this covered for your domains.

More articles

All articles