Every email you send is evaluated before it reaches a customer. That evaluation happens automatically, repeatedly, and well before your subject line enters the picture.
Chronos Agency has served 500+ DTC brands as a Klaviyo Master Elite Partner, and the rules below apply to every one of them that sends to Gmail or Yahoo.
The gatekeepers are Gmail and Yahoo Mail, and in 2026, the rules they enforce are stricter and more consistently applied than they have ever been.
Here is the short version of what they require:
- SPF or DKIM for every sender, plus SPF, DKIM and DMARC with an aligned From: domain for bulk senders
- Spam complaint rates below 0.10%, never reaching 0.30%
- One-click unsubscribe on marketing email if you’re a bulk sender
- Unsubscribes honored within 2 days
- Valid forward and reverse DNS records
- TLS-encrypted transmission
Since November 2025, Gmail can reject mail that misses these rules, so it never reaches the inbox or the spam folder.
This guide walks through what these requirements actually mean, who they apply to, and how to confirm your setup meets the 2026 standard. It also covers BIMI, the layer that turns compliance into a visible brand signal in the inbox.
Watch the full breakdown above, or keep reading for the complete written guide.
Yahoo and Gmail sender requirements at a glance
What each provider states on its official sender pages. Bulk marks rules that apply to bulk senders only.
| Requirement | Gmail | Yahoo | What to check |
|---|---|---|---|
| Who counts as bulk | Close to 5,000 or more messages to personal Gmail accounts in 24 hours, counted across the primary domain. Status is permanent. | A sender of "a significant volume of mail." Yahoo does not publish a number. | Daily sends to gmail.com across your root domain and all sending subdomains. |
| SPF and DKIM | All senders: SPF or DKIM. Bulk SPF and DKIM. DKIM key 1024 bits or longer. |
All senders: SPF or DKIM. Bulk SPF and DKIM. DKIM key 1024 bits or longer. |
Both pass on a live campaign header. Your ESP's sending domain is in your SPF record. |
| Bulk DMARC |
DMARC record published. Policy can be p=none. From: domain aligned with the SPF or DKIM domain. |
Valid DMARC policy of at least p=none, and DMARC must pass. Relaxed alignment is acceptable. |
A TXT record at _dmarc.yourdomain.com and dmarc=pass in message headers. |
| Spam rate | Below 0.3% in Postmaster Tools. Google recommends below 0.1%. Above 0.3%, delivery mitigation is unavailable until 7 consecutive days below it. | Below 0.3%, measured on mail delivered to the inbox. | Daily spam rate in Google Postmaster Tools and complaints in Yahoo's Complaint Feedback Loop. |
| Bulk One-click unsubscribe |
Marketing and subscribed messages carry List-Unsubscribe and List-Unsubscribe-Post: List-Unsubscribe=One-Click (RFC 8058), plus a visible unsubscribe link in the body. |
A working List-Unsubscribe header with one-click support. RFC 8058 Post method highly recommended, mailto accepted. Visible unsubscribe link in the body. | Both headers in the raw source of a marketing send. Transactional email is exempt at both providers. |
| Bulk Honor unsubscribes |
Within 48 hours. Missing this makes you ineligible for delivery mitigation. | Within 2 days. | Time from unsubscribe to suppression in your ESP, including any synced tools. |
| Forward and reverse DNS | Required. Sending IPs need a PTR record whose hostname resolves back to the same IP. | Required for sending IPs. | PTR on any dedicated IP. On shared IPs, your ESP manages this. |
| TLS | Required for all senders. | Not listed in Yahoo's requirements. | "Standard encryption (TLS)" in Gmail's message details. |
| Message format | RFC 5322. | RFC 5321 and RFC 5322. | One From: address, a valid Message-ID, no duplicated single-instance headers. |
Sources: Google Email sender guidelines and FAQ, Yahoo Sender Hub requirements and FAQ. Checked October 2026.
What Is Gmail Trying to Stop?
Google has not published a single manifesto, but its enforcement actions across 2024 and 2025 make the underlying objectives clear. Gmail’s 2026 agenda centers on four things:
- Cryptographic sender verification. Every authenticated email carries a verifiable digital signature. Google said in October 2023 that Gmail blocks nearly 15 billion unwanted emails a day. SPF, DKIM and DMARC let it filter at that scale without catching legitimate senders.
- Enforced accountability for bulk senders. Any domain sending close to 5,000 or more messages a day to personal Gmail accounts is permanently classified as a bulk sender. That classification does not expire even if volume drops. The expectation is that bulk senders maintain clean infrastructure, low complaint rates, and proper list hygiene, indefinitely.
- Inbox noise reduction via hard complaint thresholds. The 0.10% / 0.30% spam rate framework turns user behavior into a direct enforcement mechanism. Gmail treats a high complaint rate as a sign the sender can’t be trusted.
- Frictionless user control. One-click unsubscribe (RFC 8058) is required for marketing email from bulk senders. Gmail surfaces this as a native button at the top of the email interface. The goal is to give users an alternative to hitting ‘Report Spam’, because spam reports hurt sender reputation in ways that automated unsubscribes do not.
For ecommerce brands, these objectives translate directly into infrastructure and behavioral requirements. The sections below cover each one.
What’s New in 2026 and Why Brands Need to Pay Attention
Enforcement of these requirements has become far less forgiving since they launched.
In 2026, Gmail and Yahoo are less tolerant of edge cases, partial setups, and “good enough” configurations. Issues that once caused mild performance dips now surface as clear deliverability problems.
In practice, this shows up in a few specific ways:
- Spam complaint thresholds are enforced more tightly
Staying below 0.10% used to be aspirational, but now, it’s the line most stable senders work to stay under. - DMARC is expected to exist and function properly
Even when the policy remains set to monitoring (p=none), inbox providers expect DMARC to be valid, aligned, and intentional.
You can check your DMARC record with EasyDMARC’s lookup.
- Domain alignment problems surface faster
Misalignment between the From domain and authentication domains is less likely to be overlooked. - Reputation builds over time
Volume spikes, falling engagement and list quality are judged together.
These changes mean that many brands experience deliverability issues without having “changed anything” in their email strategy.
The rest of this guide explains how Gmail and Yahoo evaluate senders, what the current requirements actually are, and how to ensure your email setup meets the standards being enforced today.
What Has Changed in 2026 (And Why It Matters Now)
Gmail and Yahoo began enforcing these rules in February 2024, and Yahoo’s one-click unsubscribe rule followed in June 2024. Microsoft added its own rules for Outlook.com in May 2025, and since November 2025 Gmail has been ramping up enforcement, including temporary and permanent rejections.
In 2026, Gmail and Yahoo are less tolerant of partial setups, edge cases, and configurations that are technically present but functionally broken. Issues that once caused mild performance dips now surface as clear deliverability failures.
In practice, this shows up as:
- Spam complaint thresholds are enforced more tightly. Stable senders now treat 0.10% as the ceiling.
- DMARC expected to be valid, aligned, and intentional, even at p=none (monitoring mode)
- Domain alignment problems flagged faster, mismatched From and authentication domains are less likely to be overlooked
- Reputation evaluated as a pattern over time, volume spikes, engagement drops, and list quality issues are assessed together
Many brands encounter deliverability issues in 2026 without having changed anything in their email strategy. That is usually a sign that a configuration issue has been present for some time and has finally crossed a threshold.
We saw Microsoft’s filtering up close with Nuvé, a foot-care device brand whose email and SMS we run. When Microsoft started deferring its email, our own inbox test showed Outlook sends landing in junk while Gmail and Yahoo were fine.
We moved every Microsoft address into separate, highly engaged sends with a stripped-back template, then ramped volume back up on the people who responded. It took four and a half months before those sends could merge back into the main ones.
How Gmail and Yahoo Evaluate Email
Every message is evaluated before delivery. That evaluation is based on a combination of technical signals and historical behavior.
Inbox providers look at factors such as:
- Sender reputation built over time
- The domain used to send the message
- Whether authentication passes and aligns correctly
- Spam complaints and user feedback
- Message structure and formatting
- Compliance with published sender requirements
Each email is judged independently, but those judgments are informed by past behavior. Meeting sender requirements does not guarantee inbox placement. Failing them makes filtering or blocking far more likely.
Google’s own guidelines tell senders to raise volume slowly. Our rule for peak season is that send size grows by no more than 50% week over week, and each step up only happens while campaign click rate holds above 1%.
Who These Requirements Apply To
Some requirements apply to everyone who sends email. Others apply only once you cross a specific volume threshold.
All Senders
Any domain sending email is expected to meet baseline authentication, security, and formatting standards.
Bulk Senders
Gmail’s extra rules apply once you send close to 5,000 or more messages in a day to personal Gmail accounts, counting every subdomain of your primary domain. Yahoo applies its bulk rules to senders of “a significant volume of mail” and doesn’t publish a number.
| Sender Type | Volume Threshold | Requirements That Apply |
|---|---|---|
| All senders | Any volume | SPF or DKIM, forward and reverse DNS (PTR), spam rate below 0.3%, RFC 5322 (Yahoo adds RFC 5321), TLS (Gmail) |
| Bulk senders | Gmail: close to 5,000+ a day to personal Gmail accounts. Yahoo: no published number | All of the above, plus: SPF and DKIM, DMARC (p=none or stricter), aligned From: domain, one-click unsubscribe, unsubscribes honored within 2 days |
| Bulk status (Gmail) | Once triggered | Permanent: does not expire if sending volume decreases |
Why Brands Must Meet These Requirements
These requirements exist because inbox providers are responsible for protecting their users.
Every day, Gmail and Yahoo filter enormous volumes of malicious, misleading, and unwanted email. To do this at scale, they rely on signals that indicate whether a sender is legitimate, consistent, and trustworthy over time.
Authentication, domain alignment, and complaint thresholds are not arbitrary rules. They are the mechanisms inbox providers use to answer a basic question:
Can this sender be trusted with our users’ inboxes?
When a brand meets these requirements, it becomes easier for inbox providers to verify identity, confirm intent, and route messages appropriately. When requirements are missing or only partially implemented, inbox providers have fewer reasons to trust the sender, even if the email content itself is reasonable.
This is why deliverability issues often appear without changes to subject lines, offers, or cadence. Inbox placement depends as much on infrastructure and historical behavior as it does on what is written in the email.
The Authentication Foundation: SPF, DKIM, and DMARC
Authentication is the mechanism inbox providers use to verify that your email is actually from you. Every sender needs SPF or DKIM, and bulk senders need all three.
Pet Supplies Empire came to us sending from Klaviyo’s shared sending domain, and its emails were landing in spam. We set up a dedicated sending domain so its mail passed DMARC, connected Google Postmaster Tools and warmed up with text-based emails to recently active subscribers.
Its engaged profiles grew 230% between November 2024 and March 2025.
| Protocol | What It Does | 2026 Status | Failure Consequence |
|---|---|---|---|
| SPF | Specifies which IP addresses are authorized to send from your domain | Required for bulk senders; SPF or DKIM for all senders | Spam folder or temporary delay (4.7.27), escalating to permanent rejection (5.7.27) |
| DKIM | Attaches a cryptographic signature to the email to verify content integrity | SPF or DKIM for all senders; both required for bulk senders | Temporary rate limit (4.7.30), escalating to permanent rejection (5.7.30) |
| DMARC | Enforces alignment between the from domain and SPF/DKIM, and sets a policy for failures | Required (bulk senders) | Rate limited (4.7.31), and no delivery support or mitigation from Google |
| TLS | Encrypts the connection during email transmission | Required (all senders) | Protocol-level rejection |
| PTR/FCrDNS | Reverse DNS record confirming the sending IP maps back to your domain | Required (all senders) | Blocked by ISP & receiver filters |
SPF: Common Setup Issues to Watch For
Simply having an SPF record is not enough. Two issues trip up most ecommerce brands at scale:
- The 10-DNS-lookup limit. SPF authentication fails if resolving your record requires more than 10 DNS lookups. Brands using several sending tools (Klaviyo, Salesforce, Zendesk, HubSpot) often breach this without realizing it. SPF flattening or subdomain delegation resolves it.
- DMARC alignment. SPF passing is not sufficient on its own. The domain in your From header must match the domain validated by SPF (or DKIM). Without alignment, a technically passing SPF check can still fail DMARC.
DKIM: Key Requirements in 2026
- Minimum 1024-bit key length required. 2048-bit is recommended for stronger security and is best practice for any sender at scale
- For DMARC to pass, your From: domain must align with the DKIM d= domain or the SPF domain. Google recommends aligning both and says alignment with both will likely become a requirement.
- Rotating keys periodically reduces exposure if a private key is ever compromised
DMARC: Moving Beyond p=none
Gmail and Yahoo both accept p=none. Moving on to p=quarantine and then p=reject is still worth it: it stops others spoofing your domain, and Gmail and Yahoo show a BIMI logo only at quarantine or reject.
The steps from there:
- Publish p=none with a reporting address (rua=) to start receiving DMARC reports
- Monitor your spam rate and compliance status using Google Postmaster Tools. For DMARC aggregate report analysis (the XML reports sent to your rua= address), use a dedicated DMARC tool like EasyDMARC, Valimail, or dmarcian.
- Move to p=quarantine once you have confirmed all legitimate sending streams are authenticated
- Move to p=reject once quarantine produces no false positives
You can check your current DMARC record at easydmarc.com/tools/dmarc-lookup.
The Spam Rate Thresholds: The 0.3% Hard Limit
Spam complaints are among the strongest reputation signals inbox providers use. Google has published explicit thresholds, and crossing the top one has consequences that last well beyond fixing the underlying issue.
| Metric | Target | Warning Zone | Critical Threshold | Source |
|---|---|---|---|---|
| User spam complaint rate | Below 0.10% | 0.10% – 0.29% | ≥ 0.30% | Source: Google |
| Bounce rate | Below 1% | 1%-2% | Above 2% | Source: Klaviyo |
| Unsubscribe processing time | Within 48 hours | - | Not honored within 48 hours: no delivery support from Google (Yahoo: 2 days) | Source: Google |
A spam rate at or above 0.30% makes a domain ineligible for Google’s delivery mitigation program. Even if you identify and fix the underlying issue, you cannot request support from Google’s team until your spam rate has stayed below 0.30% for seven consecutive days. After those seven days you regain access to Google’s mitigation channel, but actual inbox recovery timelines vary based on your overall sender history. Google does not publish a guaranteed recovery period.
Before Garvee’s campaign volume went up, we split its engaged subscribers into 0 to 30, 31 to 60 and 61 to 90 day segments and suppressed inactive profiles.
Its campaign deliveries then grew from 425K in Q4 2024 to 4.4M in Q4 2025, and its spam rate held at 0.04%, well under Google’s 0.10% line.
Monitor your domain’s spam rate using Google Postmaster Tools (postmaster.google.com). It is the most accurate signal available for Gmail-specific deliverability health.
Spam Complaint Rate Expectations
Spam complaints are one of the strongest reputation signals inbox providers use.
Google states that senders should:
- Keep spam complaint rates below 0.10%
- Avoid ever reaching 0.30% or higher
These rates are calculated daily based on user-reported spam actions. Sustained increases matter more than isolated incidents, and elevated complaint rates make future filtering more likely.
Want a second pair of eyes on your sender setup? Our email and SMS retention team can check it against these rules.
Book a Free Strategy SessionOne-Click Unsubscribe (RFC 8058)
Bulk senders must include both a List-Unsubscribe-Post header and a List-Unsubscribe header in all marketing and promotional email, plus a clearly visible unsubscribe link in the body, and remove people within 2 days. Gmail surfaces this as a native unsubscribe button at the top of the interface.
The practical impact: when a one-click unsubscribe is available, users who no longer want email have a clear path that does not involve hitting ‘Report Spam.’ Every automated unsubscribe that replaces a spam report is a meaningful protection for your sender reputation.
| Questions | Answer |
|---|---|
| Who does this apply to? | Bulk senders sending marketing or subscribed email (Gmail: close to 5,000 or more a day; Yahoo publishes no number) |
| Does it apply to transactional email? | No. Order confirmations, shipping notifications, and account alerts are excluded |
| What happens if it is missing? | Gmail won't reject or spam-folder the message for this alone, but you lose eligibility for Google's delivery support, and more people hit Report spam. A mailto link or a link to a landing page doesn't meet Gmail's rule; Yahoo accepts mailto. |
| Does my ESP handle this automatically? | Most major platforms (Klaviyo, Attentive, etc.) implement RFC 8058 headers by default. Confirm in your account settings. |
2026 Compliance Checklist
Before troubleshooting copy or cadence, these foundations should be in place.
DNS and authentication
- SPF configured correctly
- DKIM enabled
- DMARC published (required for bulk senders)
Infrastructure
- Valid forward and reverse DNS (PTR)
- TLS enabled
- Messages compliant with RFC 5322 (and RFC 5321 for Yahoo)
Reputation and behavior
- Spam rate below 0.10%
- Never reaches 0.30%
- Consistent send volume
- Clean, engaged lists
Bulk sender requirements
- DMARC enabled
- Domain alignment passes
- One-click unsubscribe for marketing email
- Visible unsubscribe link in the body
- Unsubscribes honored within 2 days
I’ve Setup All 3, Now What? (BIMI)
There are a few more things to do before your email deliverability trail is safe and secure. Those last steps are part of BIMI.
BIMI stands for brand indicators for message identification. It uses your DNS settings to authenticate your visual brand identity in emails you send, thus leading to:
- Increased brand recognition
- Legitimizing your business
Follow these steps to get the most out of BIMI:
1) After confirming you have SPF, DKIM, and DMARC set up, ensure that your DMARC policy is set to p=quarantine OR p=reject with pct=100
2) Prepare your logo image, ensuring it meets BIMI’s logo criteria:
- In SVG format
- Image is square, with a centered logo and no additional text
- Stored using HTTPS
- No larger than 32kb
- Get a Verified Mark Certificate (VMC), which needs a trademarked logo and shows Gmail’s checkmark, or a Common Mark Certificate (CMC) if your logo isn’t trademarked.
Real-World Results: What Fixing These Issues Actually Produces
One question brands consistently ask: does fixing deliverability actually improve email performance?
It does.
StopWatt and ESaverWatt, two energy-saving brands, came to us with low domain reputation and a large buyer list that had never been warmed up.
We sent only to contacts active in the past 30 to 60 days and widened reach as opens and clicks improved. Within 30 days, both brands’ inbox rates and engagement were climbing.
The full breakdown is in the StopWatt and ESaverWatt deliverability case study.
How Chronos Helps Ecommerce Brands Navigate This
Deliverability sits at the intersection of infrastructure, domain strategy, and sender reputation. Most inbox issues that brands attribute to creative or cadence have a technical root: misaligned domains, broken SPF records or a complaint rate that has quietly crossed a threshold.
Chronos runs structured deliverability audits that identify exactly where a setup falls short, and then builds a remediation plan to address it. That includes:
- Auditing SPF, DKIM, and DMARC configuration across all sending domains and subdomains
- Identifying and resolving DMARC alignment failures between From domains and authentication domains
- Building ongoing monitoring frameworks so complaint rate spikes surface before they become suppression events
- Establishing list hygiene practices that keep engagement healthy and reduce dependence on re-engagement to maintain deliverability
If your emails are landing inconsistently, or you have never audited your authentication setup, the issues above are the right starting point.
Chronos Agency is an email, SMS and push retention agency and Klaviyo Master Elite Partner for 8 to 9 figure DTC brands, and deliverability checks like these are part of what our email and SMS retention team handles.
Frequently Asked Questions
What are Gmail’s sender requirements for 2026?
Every sender to Gmail needs SPF or DKIM, valid forward and reverse DNS (PTR) records, a TLS connection, messages formatted to RFC 5322, and a spam rate in Postmaster Tools below 0.3%. Bulk senders, those sending close to 5,000 or more messages a day to personal Gmail accounts, also need both SPF and DKIM, a DMARC record (p=none is enough), a From: domain aligned with SPF or DKIM, and one-click unsubscribe plus a visible unsubscribe link on marketing email. Google recommends keeping the spam rate below 0.1%.
What are Yahoo’s sender requirements for 2026?
Every sender to Yahoo needs SPF or DKIM, a spam rate below 0.3%, valid forward and reverse DNS for its sending IPs, and messages that comply with RFC 5321 and RFC 5322. Bulk senders also need both SPF and DKIM, a DMARC policy of at least p=none that passes, a working one-click List-Unsubscribe header, a visible unsubscribe link in the body, and unsubscribes honored within 2 days. Yahoo measures spam rate on mail delivered to the inbox, and its Complaint Feedback Loop shows you the complaints.
What is Gmail trying to achieve with its sender rules?
Google’s October 2023 announcement said Gmail would require bulk senders to authenticate their email, offer one-click unsubscribe and stay under a spam rate threshold. The same post said Gmail blocks nearly 15 billion unwanted emails a day.
Who counts as a bulk sender?
At Gmail, a bulk sender is any domain that sends close to 5,000 or more messages to personal Gmail accounts within 24 hours, counting every subdomain of the same primary domain. The status is permanent once you reach it. Yahoo doesn’t publish a number, so plan as if its bulk rules apply to you.
What is DMARC and what policy should I use?
DMARC (Domain-based Message Authentication, Reporting, and Conformance) is a protocol that enforces alignment between the domain in your From header and the domains validated by SPF or DKIM. It also sets what happens to messages that fail: none (monitor only), quarantine (send to spam) or reject (bounce). Gmail and Yahoo require bulk senders to publish DMARC and both accept p=none. Moving to quarantine or reject protects your domain from spoofing and is required for a BIMI logo.
What happens if my spam rate hits 0.30%?
A spam rate at or above 0.30% makes your domain ineligible for delivery mitigation by Gmail. Even after fixing the underlying issue, your domain remains ineligible for Google’s delivery support until your spam rate stays below 0.30% for seven consecutive days. Inbox recovery after that depends on your overall sender history. This creates a feedback loop where poor engagement leads to prolonged inbox exclusion. Manage against 0.10%, since Google says rates above 0.1% already hurt inbox delivery for bulk senders.
Does one-click unsubscribe apply to transactional email?
No. One-click unsubscribe (RFC 8058) applies to marketing and promotional email from bulk senders. Transactional email (order confirmations, shipping notifications, password resets and other operational messages) is excluded.
Do small senders need DMARC?
DMARC is required for bulk senders only. For lower-volume senders, it is strongly recommended. Without DMARC, you have no visibility into whether your domain is being spoofed or used in phishing campaigns, and you have less control over how inbox providers handle authentication failures.
Why is my domain alignment failing even though SPF and DKIM pass?
SPF and DKIM passing does not automatically mean DMARC alignment passes. Alignment requires that the domain in the From header matches the domain validated by SPF or DKIM. If you are using a sending subdomain or a third-party ESP’s tracking domain in your authentication records, they may not align with the From domain your recipients see. This is one of the most common deliverability issues for brands using multiple sending platforms.
Does Gmail evaluate email content?
Yes. Content is evaluated alongside authentication and reputation signals. Spam-like patterns, misleading subject lines, broken formatting, and suspicious link structures all increase filtering risk. Authentication establishes the baseline of trust; content and engagement determine whether that trust is reinforced or eroded over time.
Ready to get started? Let's discuss how we can help your ecommerce business thrive.
Book a Free Strategy SessionKey Takeaways
Every sender to Gmail and Yahoo needs SPF or DKIM, valid forward and reverse DNS and a spam rate below 0.3%.
Bulk senders also need SPF and DKIM together, DMARC at p=none or stricter, an aligned From: domain and one-click unsubscribe honored within 2 days.
Keep spam complaints under 0.10%. Above 0.3%, Google won't help with delivery issues until your rate has stayed below 0.3% for 7 days in a row.
Since November 2025, Gmail can reject non-compliant mail, and Microsoft has enforced its own rules on Outlook.com since May 2025.
Raise volume gradually, sending to engaged subscribers first and widening only while clicks hold.
