Recap
- Since February 2024, bulk senders to Gmail and Yahoo must pass SPF, DKIM, and DMARC, with at least one of those aligned to the From domain.
- You must offer one-click unsubscribe (RFC 8058) and honor it within two days, and keep your spam complaint rate under 0.3 percent.
- Your sending IP needs valid reverse DNS that matches forward DNS. A bulk sender is roughly 5,000 messages a day to one provider.
- For cold senders the real lever is fit and complaint rate. Authentication gets you to the door. Low complaints keep you in the room.
In February 2024, Google and Yahoo both started enforcing a shared set of requirements for anyone sending bulk mail to their users. If you send to Gmail or Yahoo addresses at volume, you must authenticate with SPF, DKIM, and DMARC, offer one-click unsubscribe, and keep your spam complaint rate under 0.3 percent, with a valid reverse DNS record on your sending IP. Miss these and your mail gets throttled, sent to spam, or rejected outright.
What exactly do the bulk sender rules require?
They require three things at once: prove who you are, make leaving easy, and keep people from marking you as spam. Concretely that means SPF, DKIM, and DMARC all passing with alignment, a one-click unsubscribe header that you honor inside two days, and a spam complaint rate that stays under 0.3 percent. A bulk sender is anyone sending around 5,000 messages a day to one provider.
Here is the full checklist in one place.
| Requirement | What it means | Who must do it |
|---|---|---|
| SPF | DNS record listing servers allowed to send for your domain | All senders |
| DKIM | Cryptographic signature proving the mail was not altered in transit | All senders |
| DMARC | Policy record telling receivers what to do when SPF or DKIM fail | Bulk senders (p=none is enough to comply) |
| Alignment | Your From domain matches the SPF or DKIM domain | Bulk senders |
| One-click unsubscribe | RFC 8058 header, opt-out honored within two days | Bulk commercial and marketing mail |
| Complaint rate | Stay under 0.3 percent, target under 0.1 percent | Bulk senders |
| Reverse DNS (PTR) | Sending IP resolves to a hostname matching forward DNS | All senders |
| Valid forward and reverse DNS | Hostname and IP agree in both directions | All senders |
What does authentication and alignment actually mean?
Authentication is three records that together prove a message really came from your domain and was not tampered with. SPF lists which servers may send for you. DKIM signs the message so the receiver can verify it. DMARC ties the two together and tells receivers what to do on failure. Alignment is the part people miss: the visible From domain has to match the domain that SPF or DKIM authenticated.
You can have all three records and still fail if nothing aligns to your From address. A common trap is sending through a tool that signs DKIM with its own domain while your From shows yours, with no aligned SPF either. The fix is to set up authentication on your own sending domain inside whatever platform you use, not to rely on the provider's shared signing.
How strict does the complaint rate really have to be?
Strict. Google asks you to keep spam complaints below 0.3 percent and says to aim for under 0.1 percent. That sounds generous until you do the math: 0.3 percent of 5,000 messages is just 15 people hitting the spam button before you are over the line. Complaint rate is the single metric most likely to sink an otherwise clean sender.
The number is reported in Google's Postmaster Tools, which every serious sender should be watching. Treat 0.1 percent as your ceiling, not 0.3. Once you cross 0.3 even briefly, Gmail starts treating your domain with suspicion, and reputation is far slower to rebuild than it is to lose.
What do these rules mean for cold email specifically?
For cold senders the rules cut two ways. The authentication and DNS requirements are non-negotiable table stakes you should already meet. The harder reality is the complaint rate, because cold mail by definition goes to people who did not ask for it, and irrelevant cold mail gets marked as spam fast. That makes targeting, not volume, the thing that keeps you compliant.
Practical implications for outbound:
- Authenticate every sending domain. SPF, DKIM, DMARC, and a matching PTR record before you send a single message. If you use separate domains for outbound, each one needs its own full setup.
- Warm up and stay slow. A brand new domain blasting volume looks exactly like a spammer to a filter. Ramp gradually and keep per-domain volume modest.
- Target tightly. The lower your relevance, the higher your complaint rate. Reaching 200 people who plausibly have the problem beats 5,000 who do not.
- Make opting out trivial. An easy reply-to-stop or visible opt-out turns a would-be spam complaint into a quiet unsubscribe, and that swap directly protects the metric Google watches.
- Watch your numbers. Postmaster Tools for Gmail, plus your own bounce and complaint tracking. Pause and diagnose the moment complaints climb.
How do you keep your spam complaint rate under 0.3 percent?
You keep it down by sending mail people are glad to get, and by making the unhappy ones leave quietly instead of clicking spam. That comes from three habits: tight targeting so most recipients are actually relevant, a frictionless opt-out so annoyance does not become a complaint, and an automatic stop when bounces or complaints spike on any domain or inbox.
The trap is volume without fit. A sender mailing a huge, loosely matched list will blow past 0.3 percent no matter how clean their DNS is, while a disciplined sender hitting a narrow, well-chosen audience stays comfortably under 0.1. This is why the bulk rules quietly favor software built around fit and reputation. A system like LaunchSurface treats authenticated sending, tight targeting, and an automatic stop on complaints as defaults rather than features you remember to turn on, because the rules now punish anyone who does not.
What happens if you ignore the rules?
Your mail stops landing. Receivers respond on a spectrum: first your messages quietly route to spam, then they get rate limited or temporarily rejected with errors, and eventually a domain with a bad reputation sees most of its mail bounced outright. None of this comes with a clear warning, and recovery is slow because reputation is sticky in both directions.
These rules made the inbox honest, not harder. Authentication proves identity, complaint rate measures whether people want your mail, and reverse DNS proves your infrastructure is real. Senders who target well and send from healthy, authenticated domains were already doing all of this. For everyone else, February 2024 turned best practice into the cost of entry.