In February 2024, Google and Yahoo stopped asking nicely. Requirements that had lived in "best practices" documents for a decade — authenticate your domain, make unsubscribing easy, don't get reported as spam — became enforced rules for anyone sending bulk email to Gmail and Yahoo inboxes. Two years on, the pattern is clear: senders who ignored the rules didn't get a warning letter. Their mail just quietly stopped arriving.
Here's what the requirements actually say, what enforcement has looked like in practice, and how to check where you stand.
Who counts as a "bulk sender"
The threshold is 5,000 or more messages per day to Gmail addresses. Two things trip people up about it. First, it's measured across your entire sending domain, not per campaign or per platform — marketing automation, sales sequences, and transactional mail from the same domain all count toward one number. Second, crossing the threshold once puts you in the bulk sender category permanently. If you did a 6,000-recipient send during last year's product launch, you're a bulk sender now, even on quiet weeks.
In practice, the safest assumption for any B2B company running a marketing automation platform is: the rules apply to you.
The three authentication requirements
SPF (Sender Policy Framework) publishes which servers are allowed to send mail for your domain. Most marketing platforms handle their part during setup — but SPF breaks silently when someone adds a new tool (a sales engagement platform, a survey tool, a billing system) without updating the record, or when the record exceeds its 10-DNS-lookup limit. Both failure modes are invisible until deliverability drops.
DKIM (DomainKeys Identified Mail) cryptographically signs each message so receivers can verify it wasn't tampered with and genuinely came from your domain. The requirement is signing with your own domain, not the platform's shared default. Instances still sending with a platform-default DKIM signature are the most common authentication failure we find in audits.
DMARC ties the two together: it tells receiving servers what to do with mail that fails SPF or DKIM, and where to send reports. The minimum requirement is a published DMARC record, even at p=none (monitor only). But p=none was always meant as a starting point — the ecosystem is steadily moving toward expecting p=quarantine or p=reject, and a domain that sits at p=none for years is a domain nobody is actually watching.
One more alignment rule that catches marketing teams: the domain in your visible From address must align with the authenticated domain. Sending "from" your corporate domain through a platform authenticated only for a vendor domain fails this test.
One-click unsubscribe
Marketing messages must support one-click unsubscribe — technically, the List-Unsubscribe and List-Unsubscribe-Post headers — and the request must be honored within two days. This is the header-level mechanism that powers the "Unsubscribe" link Gmail shows next to the sender name; a link buried in your footer doesn't satisfy it on its own.
Most major platforms now add these headers automatically, but "most" and "automatically" are worth verifying, especially if you use custom email templates, a smaller ESP, or route any bulk mail outside your main platform. The two-day honor window also has an operational implication: if your unsubscribe flow depends on a nightly sync into the CRM and back, check that the round trip actually completes in time.
The spam-rate threshold: the one you can't configure your way out of
Keep your user-reported spam rate below 0.3% in Google Postmaster Tools — and ideally below 0.1%, which Google names as the target. This is the requirement that has caused the most real-world pain, because it isn't a setting. It's a verdict on whether recipients want your mail.
Authentication failures announce themselves eventually. Spam-rate problems compound quietly: reputation degrades, inbox placement slips, engagement falls, which makes the remaining engaged audience a larger share of complainers, which pushes the rate higher. By the time open rates visibly crater, the spiral has usually been running for months.
The fix is unglamorous list hygiene: sunset policies for unengaged contacts, honest expectation-setting at signup, and frequency governance so three business units don't hit the same inbox in one week.
What enforcement has looked like
No cliff, no announcement — a ratchet. Non-compliant mail started seeing temporary failures and increased spam-foldering through 2024, and the tolerance has tightened since. The senders hit hardest were the ones who assumed a grace period meant the rules were optional. There is no manual review to request and no support ticket to file: compliance is evaluated continuously and algorithmically, which means it's also fixable continuously — clean up authentication and behavior, and placement recovers over weeks, not quarters.
Microsoft has since signaled similar requirements for Outlook.com senders, which settles any remaining debate: this is the new baseline for bulk email everywhere, not a Google quirk.
A 20-minute self-check
Five things to verify this week: (1) look up your domain's SPF, DKIM, and DMARC records with any free DNS checker — confirm all three exist and DKIM uses your domain; (2) send yourself a marketing email and confirm Gmail shows the one-click unsubscribe next to the sender name; (3) open Google Postmaster Tools — if nobody in your company has it set up, that alone is a finding — and check your spam rate against 0.3%; (4) list every system that sends email from your domain, then check each against your SPF record; (5) find out what your DMARC policy is and who, if anyone, reads the reports.
If any of those five turns up a surprise, the odds are good the others hide one too — authentication debt travels in groups.
Deliverability is one of the ten areas we check in a stack audit — 45 minutes, free, and you keep the findings either way. For the ongoing version — authentication, governance, and list hygiene as a managed practice — see email marketing operations.