Gmail sender requirements in 2026: the complete list

One set of rules, two tiers

Google's sender guidelines took effect on February 1, 2024 and apply to anyone sending email to personal Gmail accounts. They come in two tiers: a baseline that every sender must meet, at any volume, and a stricter set for bulk senders — domains that send 5,000 or more messages in a day to personal Gmail accounts. The count covers everything sent from your primary domain, subdomains included, and the classification is sticky: Google says bulk-sender status has no expiration date, so crossing the threshold once puts you in the stricter tier for good.

Google didn't act alone. Yahoo rolled out matching requirements on the same schedule, and Microsoft brought equivalent rules to Outlook in May 2025 — so treating Google's list as the target effectively covers every major mailbox provider.

Requirements for every sender

Whatever your volume — a five-person newsletter or a monster list — Gmail expects all of this:

• Authenticate with SPF or DKIM. At least one must pass for your sending domain. Unauthenticated mail risks being rejected or marked as spam (Gmail's 5.7.26 error).
• Valid forward and reverse DNS. Your sending IP needs a PTR record that resolves back to the hostname it claims.
• Send over TLS. Messages must arrive on an encrypted connection.
• Format to RFC 5322. Well-formed headers, a valid Message-ID, no malformed MIME.
• Keep spam complaints below 0.3%. Measured in Postmaster Tools; Google recommends staying under 0.1% and treats 0.3% as the ceiling.
• Don't impersonate Gmail. Sending with a gmail.com From: address through your own infrastructure fails DMARC — Google is moving Gmail to a quarantine DMARC enforcement policy for exactly this.
• Forwarders: preserve authentication. Google points forwarding services at its forwarding best practices; ARC headers keep the original authentication results intact.

Extra requirements for bulk senders

At 5,000+ messages a day, four more requirements switch on — and these are the ones enforcement has focused on:

• Both SPF and DKIM. Either alone is no longer enough.
• A DMARC record on the sending domain, with a policy of at least p=none. The Gmail DMARC requirements guide has the exact DNS record and a sane rollout path.
• An aligned From: domain. The domain your reader sees must match the domain SPF or DKIM validated — the detail that catches most ESP setups still signing with the ESP's own domain.
• One-click unsubscribe. Marketing and subscribed messages need the RFC 8058 List-Unsubscribe headers plus a clearly visible unsubscribe link in the body. Google recommends honoring opt-outs within 48 hours — and its enforcement FAQ flags senders who miss that window.

The enforcement timeline

The rules arrived with a deliberately slow ramp, and the ramp is over:

• February 2024 — guidelines in force for Gmail and Yahoo.
• Through 2024 — Google returned temporary errors on a slice of non-compliant traffic, giving senders bounce messages to debug with.
• November 2025 — Google announced escalation to temporary and permanent rejections of non-compliant bulk mail.
• 2026 — the ramp is over. Non-compliant bulk mail faces temporary and permanent rejections rather than warnings — a bulk-sending domain without DMARC or one-click unsubscribe should expect bounces.

How to comply, step by step

1. Inventory every service that sends as your domain — the ESP, the CRM, billing, support, surveys. Each one must authenticate.
2. Set up SPF and DKIM at your ESP with custom-domain signing, so DKIM signs as your domain rather than the ESP's. Usually a few CNAME records; the ESP-by-ESP guide covers where each provider hides these settings.
3. Publish a DMARC record at p=none with a rua= reporting address, and watch the reports for senders you missed.
4. Enable one-click unsubscribe — most major ESPs add the RFC 8058 headers automatically once list settings are right.
5. Watch Postmaster Tools for your complaint rate and authentication dashboard; 0.3% is the line you must never cross.
6. Re-test with a real message after every change — send yourself the newsletter and check the actual headers, not the settings screen.

Frequently asked questions

What are Google's email sender guidelines?

Google's email sender guidelines are the rules every domain sending to personal Gmail accounts must follow: authenticate with SPF or DKIM, publish valid forward and reverse DNS, send over TLS, keep spam complaints in Postmaster Tools below 0.3%, and format messages to RFC 5322. Domains that send 5,000 or more messages a day are bulk senders and must additionally set up both SPF and DKIM, publish a DMARC record of at least p=none with an aligned From: domain, and support one-click unsubscribe.

Do Gmail's sender requirements apply if I send fewer than 5,000 emails a day?

Yes — the baseline applies to everyone. Any sender, at any volume, must authenticate with SPF or DKIM, have valid PTR records, use TLS, and stay under the 0.3% spam-complaint rate. The stricter tier (SPF and DKIM together, DMARC, one-click unsubscribe) only kicks in at 5,000 or more messages a day to Gmail — but once you cross that line even once, bulk-sender status is permanent.

What happens if I don't meet the requirements?

Gmail's enforcement started in 2024 with temporary errors on a portion of non-compliant traffic, and Google announced that from November 2025 it would escalate to temporary and permanent rejections. In practice non-compliant mail now bounces or lands in spam — a missing DMARC record or one-click unsubscribe header on a bulk-sending domain is a delivery failure, not a style point.

Is there a tool to check Gmail sender requirements?

Yes. Upload a raw .eml of your newsletter to the willitspam checker and it verifies the requirements it can read from the message itself: SPF, DKIM and DMARC results with From: alignment, the List-Unsubscribe and List-Unsubscribe-Post one-click headers, a visible unsubscribe link, and content signals — with a plain-English fix for each failure.

Are Gmail's and Yahoo's sender requirements the same?

Nearly. Yahoo rolled out matching requirements at the same time as Google in February 2024 — authentication, DMARC for bulk senders, one-click unsubscribe, and the same 0.3% complaint-rate ceiling — and Microsoft followed with equivalent rules for Outlook in May 2025. Complying with Google's list effectively satisfies all three; the differences are in enforcement pace, not substance.

Test a real message

The settings screen can say everything is on and the headers can still be wrong. Export a real send as .eml (Gmail: three-dot menu → “Show original” → download) and run it through the checker — it reads your SPF, DKIM and DMARC results, verifies From: alignment and the one-click unsubscribe headers, and tells you in plain English what Gmail would do with it.