Your email platform has been sending warnings: “authenticate your domain”, “add a DMARC record”, “your sending will be affected”. Or a newsletter that used to arrive fine is now bouncing at Gmail addresses with a message about sender requirements. You are a small business, not a bulk mailer, so it is hard to tell whether any of this applies to you.
It probably does, at least in part. Google set out Gmail bulk sender requirements for anyone sending large volumes of email to personal Gmail accounts, Yahoo announced matching rules at the same time, and Microsoft has since set similar expectations for its consumer mailboxes. This guide explains what those rules ask for in plain terms, how to check your own setup, and why meeting them is sensible even if your list is small. It deliberately leaves out volume thresholds and dates, which providers can revise; check their current published guidance for those.
What changed for anyone sending in volume
For years, mailbox providers recommended good practice and filtered mail that ignored it. The newer rules turned several recommendations into requirements for senders above a certain volume. Mail that does not meet them may be marked as spam or rejected outright.
The requirements fall into four groups:
- Authenticate the mail with SPF and DKIM, and publish a DMARC record.
- Make sure the domain in the visible From address lines up with the authenticated domain.
- Offer one-click unsubscribe in marketing email, and honour it promptly.
- Keep the rate of spam complaints low.
Some basic technical points sit alongside these, but most of them are handled by your email platform rather than by you.
Authentication: SPF, DKIM and a DMARC record
These three records sit in your domain’s DNS. Together they tell a receiving server whether a message using your business name was genuinely sent by you.
- SPF lists which servers and services may send mail for your domain. Your email platform, your office mail provider and any website mail service all need to be included, in a single SPF record.
- DKIM signs each outgoing message with a key published in your DNS. Your platform gives you the records to add when you authenticate your domain with it.
- DMARC is a published policy saying what receivers should do with mail that fails, and where to send reports. The requirement is to have one; a monitoring-only policy is a reasonable start while you check every legitimate sender passes.
If these are unfamiliar, our explainer on what SPF, DKIM and DMARC do walks through each record. The common pitfalls are adding a second SPF record instead of editing the first, and authenticating the platform’s domain but never your own.
Alignment: the From domain must match
Passing SPF or DKIM is not quite enough on its own. DMARC also checks that the domain which passed is the same domain, or a subdomain of it, as the one in the From address your reader sees.
Here is why that matters. If your newsletter says it is from news@yourshop.in but is signed only with the platform’s own domain, the signature passes but does not prove anything about yourshop.in. Authenticating your own domain inside the platform, so DKIM signs with yourshop.in, fixes this.
To check, open a received newsletter in Gmail, choose to show the original, and look at the results near the top. You want DKIM to pass for your domain and DMARC to pass.
One-click unsubscribe
Marketing and promotional mail sent in volume is now expected to support one-click unsubscribe. That is a standard pair of email headers which lets the mail app itself show an unsubscribe option, and remove the person without them having to visit a page or log in.
- Reputable email marketing platforms add these headers automatically to campaigns. Check your platform’s documentation or a received email’s headers to confirm.
- You still need a visible unsubscribe link in the body of each email.
- Unsubscribes must take effect promptly. Providers have stated a short deadline for this; your platform handles it if the unsubscribe goes through its system.
The headers matter for complaints too. When unsubscribing is easy, fewer people reach for the “report spam” button instead.
Keeping spam complaints low
Every provider watches how often its users mark your mail as spam. The rules state a maximum complaint rate that senders should stay below, and well below in normal running. The figure is low enough that a single careless send to an old or bought list can breach it.
For Gmail, you can see your domain’s complaint rate in Google Postmaster Tools, a free service you set up by proving you own the domain. It shows data only once you send enough mail to Gmail users, so a very small sender may see nothing there.
The ways to stay low are the same as always: send only to people who asked, send what they expect at the pace you promised, make unsubscribing easy, and remove long-inactive addresses. Our troubleshooting guide for emails that keep landing in junk covers these causes in order.
Other technical basics
A few further requirements are mostly the platform’s job, but worth knowing about:
- Valid DNS for sending servers, including reverse DNS that matches. Established platforms handle this.
- Encrypted connections when passing mail between servers.
- Properly formatted messages that follow email standards.
- No impersonation of Gmail’s own addresses in the From field. Never send newsletters “from” a gmail.com address through a platform.
The last point catches some small businesses who signed up to a platform with a personal Gmail address. Use an address on your own domain instead.
Do Gmail bulk sender requirements apply to a small sender?
The strictest requirements are tied to sending volume, so a business with a modest list may fall below the line. Even so, most of the requirements apply to everyone in some form. Authentication is expected of all senders, low complaints matter at any size, and a list can grow past a threshold without anyone noticing.
There is also a practical reason: mail that meets these rules is simply more likely to arrive. Treat them as the baseline for any business that sends marketing email.
The rules concern the domain, so they touch your everyday mail as well. If quotes and invoices go out from the same domain as newsletters, a broken SPF record or a strict DMARC policy affects both. Our comparison of transactional and marketing email explains why many businesses send the two through separate routes.
For a small business these rules are part of doing email at all, one piece of the wider set of online marketing services that depend on your domain being in good order.
A checklist for your sending setup
- Your own domain is authenticated inside the email platform, and DKIM signs with it.
- Your domain has one SPF record, which includes the platform and every other service that sends for you.
- A DMARC record exists, with reports going to an address someone reads or a reporting service.
- A test email shows SPF, DKIM and DMARC passing, with DKIM for your domain.
- Campaigns carry one-click unsubscribe headers as well as a visible link.
- The From address is on your domain, not a free mailbox.
- Google Postmaster Tools is set up for your domain, if your Gmail volume is enough to show data.
- The list contains only people who asked, and inactive addresses are removed on a schedule.
The wider plan, from list to measuring, is in our small business guide to email marketing.
Frequently asked questions
Do these requirements apply only to mail sent to Gmail?
Google’s rules are written for mail sent to personal Gmail accounts, but Yahoo and Microsoft have published similar expectations for their consumer mailboxes, and other providers filter on the same signals. Meeting the requirements once covers you broadly, so there is little point setting up for one provider only.
What happens if my newsletters do not meet the requirements?
Mail that fails may be delivered to spam or rejected, and the rejection message often mentions authentication or sender requirements. You would see it as rising bounces at certain providers in your platform’s reports. Fixing authentication and alignment is usually the first step.
Does my everyday business email need one-click unsubscribe?
No. One-click unsubscribe is expected for marketing and promotional messages sent in bulk, not for one-to-one emails, quotes, invoices or order confirmations. Those still benefit from proper SPF, DKIM and DMARC on your domain, which is a requirement that covers all mail from it.
Is a DMARC policy of none enough?
For meeting the requirement to publish a DMARC record, a monitoring policy is generally accepted, and it is the sensible place to start. Once reports show that all your legitimate mail passes, you can move to a stricter policy, which gives your domain more protection against spoofing.
If your platform is warning you about sender requirements and you would like the records checked and fixed without breaking your everyday mail, our email marketing services include that setup.
Next in this series: Re-Engagement Email: Win Back Quiet Subscribers
