Google and Yahoo Sender Requirements, Explained

For years, the rules of bulk sending were unwritten. Mailbox providers published guidance, senders treated it as advice, and enforcement was inconsistent enough that plenty of people ignored it and got away with it. That period is over. Google and Yahoo now publish explicit requirements for bulk senders and enforce them at the gateway, which means a configuration that would have been merely suboptimal a few years ago is now a reason for your mail to be rejected outright.

The requirements are not complicated. What makes them worth understanding properly is that several of them are easy to satisfy on paper while still failing in practice, and the gap between those two states is where most senders lose deliverability without realising anything is wrong.

Authentication is now the entry ticket

The first group of requirements is about proving that your mail is really yours. You need SPF and DKIM published for your sending domain, and you need a DMARC record on that domain. This is the part most senders believe they have already done.

The subtlety is alignment. SPF and DKIM can both pass while your mail still fails DMARC, because DMARC does not just ask "did these checks pass?" — it asks whether the domain those checks authenticated is the same domain your recipient can see in the From line. A message sent through a third-party platform can easily pass SPF for the platform's own domain while showing your domain to the recipient. Both checks green, alignment failed, DMARC failed.

This is why "we have SPF and DKIM" is not an answer to "do you pass?". The only reliable verification is to send a real message to an address you control and read the Authentication-Results header it arrives with. That header states, explicitly, what the receiver concluded. Nothing else you can inspect is as trustworthy, because nothing else is the receiver's own verdict.

A published DMARC policy of p=none is enough to satisfy the requirement as written. It is worth being honest about what that buys you: nothing, defensively. p=none asks receivers to take no action on failures and simply report them. That is a legitimate and sensible first stage — you want the reports before you start enforcing — but a domain left at p=none indefinitely is a domain whose owner never finished the job.

The complaint rate is the rule with teeth

The authentication requirements are one-time work. The complaint rate is the one you live with forever, and it is the one that ends most sending programmes.

The published ceiling is 0.3% of delivered messages, with guidance to stay below 0.1%. Those numbers are smaller than they sound. At 0.3%, three people in a thousand marking your message as spam is enough to trigger enforcement. A single badly-targeted campaign to a list you did not properly qualify can clear that in an afternoon.

Two things about this metric are worth internalising. First, it is measured by the receiver, not by you: you cannot audit it directly, and you will find out you have a problem from your delivery rate before you find out from any dashboard. Google Postmaster Tools and your platform's own complaint reporting are the closest you get to visibility, and both are lagging indicators.

Second, and less obvious: enforcement is not binary. Crossing the line does not flip a switch. What happens is that filtering becomes progressively more aggressive — more of your mail goes to spam, which lowers engagement, which further lowers your reputation. By the time you notice, you are usually already in the reinforcing part of the cycle, which is why recovery takes far longer than the decline did.

One-click unsubscribe means the headers, not the footer

The unsubscribe requirement is the one most commonly satisfied incorrectly, because almost every sender already has an unsubscribe link and reasonably assumes that covers it.

It does not. The requirement refers to the List-Unsubscribe and List-Unsubscribe-Post headers, which let the mailbox provider render its own unsubscribe control at the top of the message, above your content. That control is what "one-click" means: the recipient never visits your page, never sees a confirmation step, and never has to find your footer. The request comes to you as a machine-readable signal, and you must act on it within two days.

The reason this requirement exists is directly connected to the complaint rate. When unsubscribing is harder than reporting spam, recipients report spam — it is the faster button. Every unnecessary step between "I want out" and being out converts a harmless opt-out into a complaint against your domain. Making unsubscribe genuinely trivial is not a compliance chore; it is the cheapest complaint-rate protection available to you.

What the requirements do not do

It is worth being clear about the limit of all this, because the framing invites a misunderstanding that costs people months.

Meeting these requirements does not get you into the inbox. It stops you being rejected at the door. Authentication proves identity; it says nothing about whether your mail is wanted. A perfectly authenticated domain with an aligned DMARC policy and a clean unsubscribe flow can still land every message in spam if the recipients do not engage, the volume ramps too fast, or the targeting is poor.

Think of the requirements as the difference between having a valid passport and being welcome in the country. The passport is not optional and nothing happens without it, but nobody is impressed by it either.

The work that actually earns placement — sending at a rate your domain's history supports, writing mail specific enough that people reply, and keeping your list clean enough that bounces stay rare — is the same work it always was. What has changed is that you no longer get to skip the paperwork first.

RepMail publishes SPF and DKIM for your verified sending domain as part of domain setup, adds the required List-Unsubscribe headers to every message automatically, and enforces suppression at send time so an opt-out is honoured on the next campaign rather than two days later. The complaint rate is still yours to manage — no platform can target your list for you — but the mechanical requirements are handled rather than left as homework.