Google and Yahoo Sender Requirements: The Plain-English Checklist

In 2024 Google and Yahoo published a shared set of requirements for people sending them mail. Most coverage described it as a change for bulk senders. In practice it formalised what mailbox providers had been doing quietly for years, and it gave everyone a checklist to be judged against.

Here is the checklist, what each item actually means, and how to verify it.

The requirements

1. Authenticate with SPF and DKIM. Both. Not one.

2. Publish a DMARC record on the sending domain. p=none satisfies the requirement as written.

3. Keep spam complaint rates below 0.3%. Aim below 0.1%.

4. Support one-click unsubscribe on marketing and subscribed mail, using the List-Unsubscribe headers.

5. Ensure From alignment. The domain in the visible From header must align with the domain that passed SPF or DKIM.

6. Send from a domain with valid forward and reverse DNS, and use TLS for transmission.

The stated scope is senders above 5,000 messages a day to Gmail or Yahoo users. That threshold defines where formal enforcement begins. It does not define where the heuristics apply, and treating it as a permission slip is how small senders end up filtered without ever being told why.

What each one actually requires

SPF and DKIM

SPF publishes which servers may send for your domain. DKIM signs each message so tampering is detectable.

Two things go wrong in practice. First, the SPF ten-lookup limit: every include: counts, includes nest, and exceeding ten makes SPF fail permanently for everything. Check with a validator rather than counting by eye. Second, DKIM configured for one sending service and forgotten for the other three.

DMARC

The minimum viable record:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

This changes nothing about delivery and starts the aggregate reports that tell you what is actually being sent as your domain. Almost everyone who reads their first report finds a legitimate service they had forgotten about.

Move to p=quarantine once those reports are clean. The full sequence is in our guide to DMARC for cold email.

Alignment

The requirement people fail without realising.

A message can pass SPF perfectly for an envelope domain that the recipient never sees, while the From line shows your domain. SPF passed; it passed for the wrong thing; DMARC fails.

DKIM alignment is usually the more robust route when a third party sends on your behalf, because a correctly configured DKIM signature carries your domain regardless of which server relayed it. When you evaluate a sending service, the question is not "do you support SPF" but "does your DKIM signature use my domain, and what do I publish for that."

Complaint rate

This is the one with real teeth.

Under 0.3% is the stated ceiling. Under 0.1% is where healthy senders live. That is three complaints per thousand delivered, which sounds generous until you send to a list that was not expecting you.

Complaint rate is punishing because it is unambiguous. A bounce might be a stale address. A complaint is a person stating that your mail was unwanted, and providers weight it accordingly.

The two levers are relevance and exits. Relevance means sending to people who plausibly have the problem you solve. Exits means making unsubscribing trivial, because someone who cannot find the unsubscribe uses the spam button instead.

One-click unsubscribe

Two headers, and the second is the one people miss:

List-Unsubscribe: <https://example.com/unsub?id=abc>, <mailto:unsub@example.com>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

The List-Unsubscribe-Post header is what makes the mail client show an unsubscribe control at the top of the message and process it without the recipient loading a page. A footer link on its own does not satisfy the requirement.

The requirement is written for bulk and marketing mail. Put it on cold outreach anyway. It converts would-be complaints into unsubscribes, which is an enormously favourable trade.

How to verify compliance today

Check authentication. Send to a Gmail address, open the message, choose "Show original". You want three PASS results: SPF, DKIM, DMARC. A DMARC failure alongside an SPF pass is an alignment problem, not an SPF problem.

Check reputation. Set up Google Postmaster Tools for your sending domain. It shows domain reputation, spam rate over time, authentication success and delivery errors, straight from the source that matters.

Check the headers. Look for List-Unsubscribe and List-Unsubscribe-Post in the raw message.

Check your DMARC reports. They are XML and unpleasant by hand; any free parser will make them legible.

What this does not buy you

Passing every requirement gets you past a gate. It does not get you into the inbox.

Beyond the checklist, placement is decided by sender reputation, recipient engagement, list quality and complaint history. Authentication is necessary and nowhere near sufficient, which is why a perfectly authenticated domain sending to a purchased list still ends up in spam.

The full sequence, infrastructure then reputation then list then behaviour then content, is in our deliverability checklist.

The five-minute version

If you do one thing today, publish a DMARC record at p=none and add the one-click unsubscribe headers. Neither can break anything, both satisfy stated requirements, and the DMARC reports will tell you what to fix next.

Leads Ranger audits SPF, DKIM, DMARC and MX for every connected mailbox and reports the result in plain English rather than raw DNS, and outbound carries RFC 8058 unsubscribe headers by default, because the failure mode that matters here is not knowing something is broken.