Digital Marketing

Gmail sender rules: SPF, DKIM, DMARC and one-click unsubscribe

7 min readBy Davinder Kumar Meen

A hand writing beside an envelope sealed with orange wax on a white desk

To reach Gmail inboxes in 2026, every sender needs SPF or DKIM, valid forward and reverse DNS, TLS and a spam rate below 0.3%. Anyone who sends close to 5,000 messages a day to personal Gmail accounts must also have SPF and DKIM, a DMARC record, a From domain that aligns with one of them, and one-click unsubscribe on marketing mail. Yahoo has almost the same rules, and Outlook.com has required SPF, DKIM and DMARC from high-volume senders since May 2025. Since November 2025 Gmail has been rejecting more non-compliant mail.

Key takeaways

  • Gmail's rules took effect on 1 February 2024; from November 2025 Google said non-compliant messages can face temporary or permanent rejections.
  • A Gmail bulk sender is one that sends close to 5,000 or more messages to personal Gmail accounts in 24 hours, and that status is permanent once reached.
  • Google asks senders to keep the spam rate in Postmaster Tools below 0.1% and never let it reach 0.3%.
  • One-click unsubscribe means the RFC 8058 headers: List-Unsubscribe with an HTTPS link and List-Unsubscribe-Post: List-Unsubscribe=One-Click, both covered by the DKIM signature. Yahoo says honour unsubscribes within 2 days; Google recommends 48 hours.
  • DMARC is now RFC 9989 (May 2026), which replaces RFC 7489; records still start v=DMARC1, and the pct tag has been removed.

What does Gmail require from every sender?

Google's email sender guidelines set a baseline for anyone sending to personal Gmail accounts, whatever the volume:

  • SPF or DKIM authentication for your sending domains;
  • valid forward and reverse (PTR) DNS records for the sending servers;
  • a TLS connection for transmitting email;
  • a spam rate reported in Postmaster Tools below 0.3%;
  • messages formatted to RFC 5322, and no impersonation of Gmail From headers.

Google also says sending to personal Gmail accounts requires a DKIM key of at least 1,024 bits, and recommends 2,048-bit keys where your DNS provider supports them. If you send through an email service provider, most of this is its job, but the DNS records on your domain are yours.

What changes once you count as a bulk sender?

Three more requirements. Google defines a bulk sender as one that sends "close to 5,000 messages or more to personal Gmail accounts within a 24-hour period", counting all mail from the same primary domain. Its FAQ adds that senders who reach that once "are permanently considered bulk senders". A single newsletter to a large list can put you in that group for good.

Bulk senders must also:

  1. Authenticate with both SPF and DKIM, and publish DMARC. Google says the DMARC policy can be p=none.
  2. Align the From domain with the SPF domain or the DKIM domain, so the address the reader sees matches a domain that passed authentication.
  3. Support one-click unsubscribe in marketing and subscribed messages, and include a clearly visible unsubscribe link in the body.

Google set 1 June 2024 as the deadline for one-click unsubscribe for senders already including an unsubscribe link. Transactional messages, such as password resets and booking confirmations, do not need it.

What do Yahoo and Outlook.com require?

Much the same, which is why one setup covers all three:

Requirement Gmail (bulk) Yahoo (bulk) Outlook.com (over 5,000/day)
SPF and DKIM Both Both Both must pass
DMARC Required, p=none allowed At least p=none, must pass At least p=none, p=reject recommended
Alignment From aligns with SPF or DKIM From aligns with SPF or DKIM, relaxed alignment acceptable Aligns with SPF or DKIM, preferably both
One-click unsubscribe Required for marketing and subscribed mail Required; RFC 8058 POST "highly recommended" Not covered by the requirement quoted here
Unsubscribe timing Recommended within 48 hours Within 2 days Not covered by the requirement quoted here
Spam rate Below 0.3% (aim below 0.1%) Below 0.3% Not covered by the requirement quoted here
Since 1 February 2024 February 2024 5 May 2025

Microsoft's postmaster policy says that non-compliant mail from high-volume senders goes to the junk folder and, if problems remain, may be rejected with error 550; 5.7.515. Yahoo also recommends that senders who forward email implement ARC (RFC 8617).

How does one-click unsubscribe work?

It is two email headers and an endpoint. RFC 8058 (January 2017) requires the sender to include:

List-Unsubscribe: <https://example.com/unsub?token=OPAQUE-TOKEN>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

The List-Unsubscribe header must contain one HTTPS link (a mailto: link can be added as well), and the DKIM signature must cover both headers. When the reader clicks the mail app's unsubscribe button, the mailbox provider sends an HTTPS POST to that link with no cookies or login. Your endpoint must unsubscribe the address from the token alone, with no confirmation page and no redirect. Use an opaque token rather than a plain email address, so nobody can unsubscribe other people.

Most email platforms add these headers for you. If your website or app sends its own marketing mail, for example through SendGrid or Amazon SES, check the raw headers of a sent message, because the endpoint is your code. Our SendGrid integration page covers that kind of work.

What changed in DMARC in 2026?

The standard moved. In May 2026 the IETF published RFC 9989, a Standards Track document that obsoletes RFC 7489 (the original, informational DMARC) and RFC 9091. The essentials for a business sender:

  • Records still use v=DMARC1, so existing records keep working.
  • The pct tag has been removed. The new t=y flag is a test mode that asks receivers to apply a policy one level below the one published.
  • The np tag, which sets the policy for non-existent subdomains, is part of the core standard, and the organisational domain is now found by a DNS "tree walk" instead of the Public Suffix List.

A typical starting record, with reports sent to a mailbox you read:

_dmarc.example.com  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

In what order should you fix your email setup?

Start with an inventory, because most failures come from a forgotten sender. A safe order:

  1. List everything that sends as your domain: your mailbox provider, newsletter platform, CRM, booking system, invoicing tool, website forms and any app.
  2. Publish one SPF record that includes each authorised service, and stay within SPF's limit of 10 DNS lookups (RFC 7208).
  3. Turn on DKIM in each service with your own domain, using 2,048-bit keys where supported.
  4. Publish DMARC at p=none with a rua address, and read the aggregate reports for a few weeks to find senders that fail.
  5. Fix or move the failing senders, then raise the policy to p=quarantine and later p=reject.
  6. Add one-click unsubscribe to every marketing stream and test it from a Gmail and a Yahoo inbox.
  7. Watch Postmaster Tools for spam rate and compliance status. Google says senders with a spam rate above 0.3% are ineligible for mitigation until they stay below 0.3% for 7 consecutive days.

Technical setup gets mail accepted; permission keeps it there. Send only to people who asked, make unsubscribing easy, and remove inactive addresses. Our digital marketing trends for 2026 post covers where email fits among other channels, and customer retention tactics covers what to send. If you want help with email setup as part of a wider plan, see our digital marketing and SEO services.

FAQ

Do these rules apply if I send fewer than 5,000 emails a day?

The baseline does: SPF or DKIM, valid DNS, TLS and a spam rate below 0.3%. The bulk-sender rules start at close to 5,000 messages a day to personal Gmail accounts, but DMARC, alignment and easy unsubscribing help any sender.

Does Google Workspace mail count as personal Gmail?

No. Google's FAQ says the sender guidelines do not apply to messages sent to Google Workspace accounts; the requirements and enforcement apply only to mail sent to personal Gmail accounts. A business that uses Workspace must still meet them when it sends to personal Gmail addresses.

Is DMARC p=none enough?

For Gmail's and Yahoo's requirements, yes. It does not stop anyone spoofing your domain, though, so move to quarantine or reject once the reports show that all your real senders pass.

Do order confirmations need an unsubscribe link?

Google says one-click unsubscribe is required for marketing and promotional messages, not for transactional messages such as password resets and reservation confirmations.

How quickly must I process unsubscribes?

Yahoo says within 2 days; Google recommends within 48 hours. With RFC 8058 one-click unsubscribe the removal can be immediate.

Do I need to change my DMARC record because of RFC 9989?

Not to keep it working: records still start v=DMARC1. If your record uses pct, plan to remove it, since RFC 9989 drops that tag.

Sources (8 links)
Share this article