In October 2023, Google and Yahoo announced major changes to email authentication requirements, taking effect in February 2024. These requirements affect anyone sending email to Gmail or Yahoo users—and failing to comply means your emails may not be delivered.
This guide explains exactly what's required, who it applies to, and how to ensure compliance.
The New Requirements at a Glance
Starting February 2024, email senders must meet these requirements to reach Gmail and Yahoo inboxes:
All Senders Must:
- Have valid SPF or DKIM authentication
- Have valid forward and reverse DNS (PTR records)
- Use a TLS connection for transmitting email
- Keep spam complaint rates below 0.3%
- Format messages according to RFC 5322
Bulk Senders (5,000+ daily emails) Must Also:
- Have both SPF and DKIM configured
- Have a DMARC record published (minimum p=none)
- Pass DMARC alignment
- Include easy one-click unsubscribe in marketing emails
- Honor unsubscribe requests within 2 days
Who is a "Bulk Sender"?
You're classified as a bulk sender if you send more than 5,000 messages in one day to Gmail or Yahoo addresses. This is counted per sending domain, not per email address.
Important considerations:
- The count includes all email types: marketing, transactional, and internal
- Once classified as a bulk sender, the status is permanent
- Multiple subdomains sending to the same recipients may be combined
Email Authentication Requirements Explained
SPF (Sender Policy Framework)
SPF tells receiving servers which IPs are authorized to send email for your domain.
Requirement: Publish an SPF record for your sending domain that includes all services sending on your behalf.
Example record:
v=spf1 include:_spf.google.com include:sendgrid.net -all
DKIM (DomainKeys Identified Mail)
DKIM adds a cryptographic signature to verify messages are authentic.
Requirement: Enable DKIM signing for all outbound email. Each email service needs its own DKIM configuration.
DMARC (Domain-based Message Authentication)
DMARC ties SPF and DKIM together and provides policy enforcement.
Requirement for bulk senders: Publish a DMARC record at _dmarc.yourdomain.com
Minimum required record:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
Note: While p=none is the minimum requirement today, Google and Yahoo have indicated they may require stricter policies (p=quarantine or p=reject) in the future.
The DMARC Alignment Requirement
This is where many senders fail. DMARC alignment means:
- The domain in your From header must match (or be a subdomain of) the domain that passed SPF or DKIM
- If you send from
newsletter@yourdomain.com, either SPF or DKIM must authenticateyourdomain.com
Common alignment failure: Using an email marketing service that authenticates using their domain instead of yours.
Solution: Configure custom domain authentication (often called "domain authentication" or "sender authentication") in your email service.
Spam Rate Requirements
Both Google and Yahoo now enforce spam complaint rate limits:
- Target: Keep spam rates below 0.1%
- Maximum: Never exceed 0.3%
- Measurement: Based on recipients who click "Report spam" in their email client
How to Monitor Spam Rates
- Google Postmaster Tools: Free tool showing your domain's spam rate and reputation with Gmail
- Yahoo Complaint Feedback Loop: Sign up to receive notifications when Yahoo users mark your emails as spam
Reducing Spam Complaints
- Only send to people who explicitly opted in
- Make unsubscribe easy and obvious
- Send relevant, expected content
- Don't email too frequently
- Maintain clean email lists (remove inactive subscribers)
One-Click Unsubscribe Requirement
For bulk senders, marketing and promotional emails must include:
- A one-click unsubscribe mechanism in the email header (List-Unsubscribe-Post)
- A visible unsubscribe link in the email body
- Processing of unsubscribe requests within 2 days
This is implemented via email headers:
List-Unsubscribe: <mailto:unsubscribe@yourdomain.com>, <https://yourdomain.com/unsubscribe> List-Unsubscribe-Post: List-Unsubscribe=One-Click
Most email marketing platforms handle this automatically, but verify it's enabled.
Infrastructure Requirements
PTR Records (Reverse DNS)
Sending IPs must have valid PTR records that resolve back to a domain you control. This is typically configured by your email service provider.
TLS Encryption
All email connections must use TLS (Transport Layer Security). Most modern email servers do this by default.
RFC 5322 Compliance
Emails must be properly formatted according to internet email standards. This includes valid headers, proper encoding, and correct syntax.
Compliance Checklist
For All Senders
- ☐ SPF record published and valid
- ☐ OR DKIM enabled and signing correctly
- ☐ Valid PTR records for sending IPs
- ☐ TLS enabled for email transmission
- ☐ Spam complaint rate under 0.3%
- ☐ Emails properly formatted
For Bulk Senders (5,000+ daily)
- ☐ All requirements above
- ☐ Both SPF AND DKIM configured
- ☐ DMARC record published
- ☐ DMARC alignment passing
- ☐ One-click unsubscribe in email headers
- ☐ Unsubscribes honored within 2 days
What Happens If You Don't Comply?
Non-compliant emails face:
- Delivery to spam folder: Emails bypassing authentication often land in spam
- Temporary failures: Receiving servers may delay or retry delivery
- Rejection: Severely non-compliant emails may be blocked entirely
- Reputation damage: Ongoing issues harm your domain's sender reputation
Google has stated they're implementing requirements gradually, giving senders time to comply. However, the longer you wait, the higher the risk of deliverability issues.
Implementation Steps
-
Audit your email sources
- List every service that sends email for your domain
- Include: email provider, marketing tools, CRM, transactional services, web applications
-
Implement SPF
- Create an SPF record including all senders
- Verify with an SPF checker tool
-
Enable DKIM for all services
- Configure DKIM in each email platform
- Add DNS records for each selector
- Test DKIM is passing
-
Set up DMARC
- Start with p=none for monitoring
- Set up a reporting address
- Monitor for 2-4 weeks
-
Verify alignment
- Check DMARC reports for alignment failures
- Configure custom domain authentication in marketing platforms
-
Check unsubscribe implementation
- Verify one-click unsubscribe headers are present
- Test the unsubscribe flow
-
Monitor spam rates
- Set up Google Postmaster Tools
- Address any spam rate issues
Future Requirements
Google and Yahoo have indicated these requirements will evolve:
- Stricter DMARC policies: The minimum may increase from p=none to p=quarantine or p=reject
- Lower spam thresholds: Acceptable spam rates may decrease
- Additional requirements: Other authentication or reputation requirements may be added
Implementing strong email authentication now prepares you for future requirements.
Resources
Summary
The Google and Yahoo requirements represent a major shift toward mandatory email authentication. Key takeaways:
- Everyone needs SPF or DKIM and must maintain low spam rates
- Bulk senders need SPF, DKIM, DMARC, and one-click unsubscribe
- Compliance is essential for reaching Gmail and Yahoo inboxes
- Requirements will likely get stricter over time
Don't wait until your deliverability suffers—implement email authentication today.
0 comments