In October 2023, Google and Yahoo jointly announced new requirements for anyone sending email to Gmail and Yahoo inboxes, effective February 2024. If you send marketing email, transactional email, or even just a lot of one-to-one email from a business domain, this almost certainly affects you.
Who does this apply to?
Google's official threshold is 5,000 messages per day to Gmail addresses, measured across your entire organization. In practice, though:
- Smaller senders who ignore these requirements still see declining deliverability, because the underlying signals (SPF/DKIM/DMARC) are increasingly used for all inbox placement decisions, not just the bulk-sender threshold.
- If you use a shared sending domain via any marketing platform, your reputation is tied to every other sender on that platform -- authentication is your best defense.
Bottom line: treat these as best practices for every domain that sends any email, not just high-volume senders.
The three requirements
1. A valid SPF or DKIM record (ideally both)
Your domain needs at least one working authentication method. Both is strongly recommended, since DMARC alignment can pass on either.
2. A DMARC record for your sending domain
This is the newest requirement for most senders. At minimum:
`
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com;
`
This won't block anything yet, but it satisfies the "has a DMARC record" check and starts collecting aggregate reports so you can see who's sending as you.
3. One-click unsubscribe for bulk senders
If you're a bulk sender (the 5,000/day threshold), Gmail and Yahoo also require List-Unsubscribe and List-Unsubscribe-Post headers that support one-click unsubscribe, and your complaint rate must stay under 0.3%.
What happens if you don't comply?
Google has stated non-compliant bulk senders will see increasing rates of temporary errors and rejections, not just spam-folder placement. Yahoo has signaled similar enforcement. For smaller senders below the bulk threshold, the risk is more gradual: missing authentication increasingly correlates with spam-folder placement across all major providers, not just Google.
A realistic rollout plan
- Week 1: Add SPF (if missing) and enable DKIM through your email provider.
- Week 1: Publish a
p=noneDMARC record so you start collecting reports without any risk of blocking legitimate mail. - Weeks 2-3: Review DMARC aggregate reports (or use a monitoring tool) to confirm every legitimate sending source passes alignment.
- Week 4+: Move DMARC policy to
p=quarantine, thenp=rejectonce reports are clean. - Ongoing: Monitor continuously -- DNS records get overwritten during platform migrations, registrar changes, and staff turnover far more often than teams expect.
Check your compliance in seconds
MailPosture's free scanner checks your SPF, DKIM, and DMARC setup against exactly these requirements and gives you the ready-to-paste DNS records to fix anything missing.