Email Authentication for Bulk Senders: 2025 Compliance Guide

December 22, 2025

Illustration of bulk email going through SPF, DKIM, and DMARC authentication checkpoints

If you send more than 5,000 emails per day, email authentication is no longer optional—it's mandatory. In February 2024, Google and Yahoo began enforcing new requirements for bulk senders. Those who don't comply see their emails land in spam or get rejected entirely.

This guide covers everything bulk senders need to know about email authentication compliance in 2025, including the specific requirements, implementation steps, and ongoing maintenance.

Who Is a "Bulk Sender"?

Google and Yahoo define bulk senders as anyone who sends approximately 5,000 or more messages to Gmail or Yahoo addresses in a single day.

What Counts Toward the Threshold

Marketing emails and newsletters
Transactional emails (order confirmations, shipping notifications)
Automated system messages
All emails from subdomains of your primary domain

The count is per sending domain, not per IP address. If you send 2,000 marketing emails and 3,000 transactional emails from the same domain, you're a bulk sender.

Even If You're Not a Bulk Sender

These authentication practices are recommended for everyone. Smaller senders who implement SPF, DKIM, and DMARC benefit from:

Better deliverability
Protection against domain spoofing
Improved sender reputation
Being ready if/when volume increases

The 2024-2025 Requirements

Google and Yahoo require bulk senders to meet these standards:

Authentication Requirements

Requirement	Details	Status
SPF	Valid SPF record for sending domain	Required
DKIM	DKIM signing for all outbound emails	Required
DMARC	DMARC record published (at minimum p=none)	Required
Valid rDNS	Reverse DNS for sending IPs	Required
TLS encryption	Use TLS for email transmission	Required

Sender Requirements

Requirement	Details
Valid From address	From header must have valid domain that matches SPF/DKIM alignment
One-click unsubscribe	Marketing emails must support RFC 8058 one-click unsubscribe
Visible unsubscribe link	Clear unsubscribe option in email body
Low spam complaint rate	Keep reported spam rate below 0.3% (Google recommends under 0.1%)

What Google Says

From Google's official guidelines: "Starting in February 2024, if you send more than 5,000 messages per day to Gmail accounts, you must authenticate your outgoing email, avoid sending unwanted or unsolicited email, and make it easy for recipients to unsubscribe."

Implementation Checklist

Follow this checklist to ensure compliance:

Authentication Setup

☐ SPF Record

Publish a valid SPF record in DNS
Include all sending sources (your servers, email services, marketing platforms)
Stay under the 10 DNS lookup limit
End with -all or ~all

☐ DKIM Signing

Enable DKIM for all email services
Use 2048-bit keys for strong security
Verify all sending sources have unique selectors
Test that DKIM signatures validate properly

☐ DMARC Record

Publish a DMARC record at _dmarc.yourdomain.com
Start with p=none for monitoring
Set up reporting (rua=) to receive aggregate reports
Plan progression to p=quarantine and p=reject

☐ Infrastructure

Configure valid PTR (reverse DNS) records for sending IPs
Ensure sending servers use TLS for connections
Use consistent From addresses that align with SPF/DKIM domains

Compliance Monitoring

☐ One-Click Unsubscribe

Implement RFC 8058 List-Unsubscribe-Post header
Include List-Unsubscribe header with mailto or HTTPS option
Honor unsubscribe requests within 2 days

☐ Spam Rate Monitoring

Register for Google Postmaster Tools
Monitor spam complaint rates (target: under 0.1%)
Investigate and address any spikes

Platform-Specific Implementation

Most bulk senders use third-party platforms. Here's what you need for each:

Email Service Providers (ESP)

Platforms like Mailchimp, HubSpot, and Klaviyo handle much of this for you, but you still need to:

Add their sending servers to your SPF record
Set up DKIM with your custom domain
Publish your own DMARC record

Google Workspace

See our Google Workspace setup guide for detailed instructions.

Microsoft 365

See our Microsoft 365 setup guide for detailed instructions.

Ecommerce Platforms

If you run a Shopify store or other ecommerce platform, you're likely a bulk sender due to order confirmations and marketing emails.

DMARC Policy Progression for Bulk Senders

As a bulk sender, you should plan to move beyond p=none. Here's the recommended progression:

Stage 1: Monitor (p=none)

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Duration: 2-4 weeks

During this phase:

Collect and analyze DMARC reports
Identify all legitimate sending sources
Fix any authentication issues
Add missing sources to SPF/enable DKIM

Stage 2: Quarantine (p=quarantine)

v=DMARC1; p=quarantine; pct=10; rua=mailto:dmarc@yourdomain.com

Start at 10% and gradually increase:

Week 1: pct=10
Week 2: pct=25
Week 3: pct=50
Week 4: pct=100 (or remove pct parameter)

Monitor reports at each stage for unexpected failures.

Stage 3: Reject (p=reject)

v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com

Maximum protection. Only move here when:

All legitimate sources pass authentication
You've been at p=quarantine with pct=100 with no issues
You're confident no legitimate email will fail

Common Compliance Issues

1. Missing Email Sources in SPF

Problem: Third-party services not included in your SPF record fail authentication.

Solution: Audit all services that send email for your domain. Common ones to check:

Marketing automation platforms
CRM systems
Support desk software
Invoicing/accounting software
HR/recruitment platforms

2. DKIM Not Configured for All Services

Problem: Some services sign with their domain, not yours, causing DMARC alignment failure.

Solution: Configure custom domain DKIM in each service. Most ESPs support this in their settings.

3. Subdomain Issues

Problem: Emails from subdomains (mail.example.com, news.example.com) fail authentication.

Solution:

Set up SPF and DKIM for each subdomain
Use DMARC sp= parameter to define subdomain policy
Or ensure DKIM signing domain aligns with the main domain

4. High Spam Complaint Rate

Problem: Spam complaints exceed 0.3% threshold.