Your emails used to land. Now some bounce with a message about authentication, or quietly vanish into spam at Gmail and Yahoo addresses. Since early 2024, both providers enforce a set of sender requirements, and they apply most strictly to anyone sending in volume. The good news: the fixes are mostly one-time settings you can finish in an afternoon.
This guide covers what the rules ask for and how to meet each one. Providers update their guidance, so check Google's and Yahoo's current sender pages before relying on any detail here.
What the rules actually require
Google defines a bulk sender as someone sending close to 5,000 or more messages a day to personal Gmail accounts. Yahoo uses similar language without publishing a firm number. Even if you send far less, treat the full list as your baseline. Smaller senders still get filtered when basics are missing, and you don't want to rebuild your setup the day you grow.
The core requirements, in plain terms:
| Requirement | Applies to | What it means for you |
|---|---|---|
| SPF or DKIM | All senders | Your domain says which servers may send for it |
| SPF and DKIM | Bulk senders | Both must be in place |
| DMARC record | Bulk senders | Policy can be p=none to start |
| Alignment | Bulk senders | The From domain matches the SPF or DKIM domain |
| Valid PTR / reverse DNS | All senders | Usually handled by your email provider |
| TLS connection | All senders | Usually handled by your email provider |
| One-click unsubscribe | Bulk marketing mail | A header-based unsubscribe plus a visible link |
| Low spam complaint rate | All senders | Google says stay under 0.3%, ideally lower |
The 0.3% figure is Google's stated threshold, not a target. Aim well below it.
Step 1: Authenticate your domain (SPF, DKIM, DMARC)
This is where most delivery problems start, and it's the part you control directly in your domain's DNS settings.
- SPF: Add one TXT record listing the services allowed to send from your domain. Only one SPF record per domain; merge entries if you use several tools.
- DKIM: Turn it on inside your email provider (Google Workspace, Microsoft 365, or your SMTP service). It gives you a TXT record to add, then you click to start signing.
- DMARC: Add a TXT record at _dmarc.yourdomain.com. Starting with p=none and a reporting address is acceptable. Tighten to quarantine later once reports look clean.
We walk through every record with examples in how to set up SPF, DKIM and DMARC for cold email.
To confirm it worked, send a message to a personal Gmail address, open it, choose "Show original", and look for PASS next to SPF, DKIM and DMARC.
Step 2: Make sure your From address aligns
Alignment trips up people using third-party sending tools. If your email says it's from you@yourbusiness.com but DKIM signs as the tool's own domain, DMARC can fail.
Fix: set up DKIM for your own domain inside every tool that sends on your behalf. Avoid sending from a free @gmail.com address through an outside SMTP server, because you can't authenticate a domain you don't own.
If you're deciding between sending through a Google account or an SMTP provider, Gmail vs SMTP for cold email covers the tradeoffs.
Step 3: Add one-click unsubscribe
The rule for bulk marketing mail is two-part: a List-Unsubscribe header supporting one-click (so Gmail and Yahoo can show their own unsubscribe button), and a clearly visible link in the body. Requests should be honored within two days.
Practical steps:
- Check whether your sending tool adds the List-Unsubscribe-Post header. Look in "Show original" for it.
- Put a plain unsubscribe line at the bottom of every email, including follow-ups.
- Make sure unsubscribed addresses are excluded from every future campaign, not just the current one.
In GetClient, each email gets a one-click unsubscribe link with a signed URL unique to that recipient, and unsubscribed addresses are skipped automatically in later sends. Whatever tool you use, test it by unsubscribing a test address yourself.
Unsubscribe handling also overlaps with law. See our CAN-SPAM overview for the US basics, and check the rules in the countries you send to. This is not legal advice.
Step 4: Keep complaints low
Authentication gets you through the door. Complaints decide whether you stay. Every "Report spam" click counts against you, and you can't fix that in DNS.
What keeps complaints down:
- Send to relevant people. A tight lead list built around one niche and location beats a broad one. A dentist getting an offer clearly for dentists is less likely to report it.
- Verify addresses first. Bounces hurt reputation. Run verification before every campaign, especially on older lists.
- Say who you are and why you're writing in the first two lines.
- Don't over-follow-up. Two or three polite follow-ups with real spacing is a reasonable rule of thumb. Stop when someone replies or opts out.
- Ramp volume slowly on new domains and inboxes. Email warm-up explains why.
If you send cold email, consider a separate domain from your main business domain, so a bad week doesn't affect your invoices and client mail.
Step 5: Monitor with Google Postmaster Tools
Sign up for Google Postmaster Tools (free) and verify your domain with a TXT record. Once you send enough volume, it shows your spam rate, domain reputation and authentication results for Gmail recipients. Yahoo offers a sender hub with similar guidance and a complaint feedback loop.
Check weekly. If the spam rate climbs, pause, review who you're emailing and what you're saying, then resume at lower volume.
Your checklist for today
- Confirm SPF, DKIM and DMARC all pass using "Show original".
- Check that the DKIM domain matches your From domain.
- Verify the List-Unsubscribe header and a visible unsubscribe link.
- Remove unsubscribes and bounced addresses from every list.
- Verify your next list before sending.
- Set up Postmaster Tools.
- Cap daily volume per inbox and increase gradually.
Do these once, and the rules stop being a threat. They become the floor that keeps careless senders out of the inboxes you're trying to reach.