Gmail and Yahoo both require SPF or DKIM from every sender. Bulk senders, defined by Google as more than 5,000 messages a day to Gmail accounts, need SPF, DKIM and a DMARC record, aligned From domains, one-click unsubscribe for marketing mail, and a spam complaint rate under 0.3%.
Requirements for all senders
From Google's sender guidelines, in force since February 1, 2024:
- SPF or DKIM authentication for sending domains.
- Valid forward and reverse DNS (PTR records) for sending IPs.
- A TLS connection for transmitting mail.
- A spam rate in Postmaster Tools below 0.3%.
- Messages formatted per RFC 5322.
- No impersonation of Gmail From headers.
Yahoo's list is close: SPF or DKIM at minimum, spam rate below 0.3%, valid forward and reverse DNS, and compliance with RFC 5321 and 5322.
Extra requirements for bulk senders
Google applies these to senders of more than 5,000 messages per day to Gmail accounts. Yahoo lists its own bulk requirements.
- Both SPF and DKIM.
- A DMARC record. Google says the policy can be none. Yahoo asks for at least p=none and says it must pass, and strongly recommends a rua tag.
- Alignment. The From domain must align with the SPF domain or the DKIM domain. Yahoo says relaxed alignment is acceptable.
- One-click unsubscribe for marketing and subscribed messages, plus a visible unsubscribe link in the body. Yahoo asks that unsubscribes be honored within two days. See the one-click unsubscribe post.
Recommendations worth following
- Google recommends keeping the spam rate below 0.10% and avoiding ever reaching 0.30%.
- Use a DKIM key of 1024 bits or longer for Gmail, ideally 2048. Yahoo asks for at least 1024.
- Separate bulk mail from transactional mail by IP or DKIM domain, so one stream's reputation does not drag down the other. Yahoo recommends this explicitly.
- Send only to people who asked for the mail, and remove invalid recipients promptly.
- Forwarders should implement ARC, per Yahoo.
A one-page audit
- List every domain and subdomain that sends mail.
- For each: SPF record valid and under 10 lookups, DKIM signing with aligned domain, DMARC record present with rua.
- Check PTR records for any IPs you run, and that the forward record matches.
- Confirm TLS on outbound mail.
- Confirm marketing mail carries the List-Unsubscribe and List-Unsubscribe-Post headers.
- Check your spam rate in Google Postmaster Tools weekly.
These pages are subject to change. Google and Yahoo both say requirements may be updated, so recheck them before an audit.
Quick check
Do I need p=reject to meet these rules?
No. Google says a DMARC policy of none is enough for the requirement, and Yahoo asks for at least p=none. Moving beyond that is your decision for spoofing protection.
What if I send fewer than 5,000 messages a day?
The all-senders list still applies: SPF or DKIM, PTR records, TLS and a low spam rate. Google also says unauthenticated mail may be rejected or marked as spam.
Sources
Last reviewed: 19 October 2026.
