Email deliverability checklist for the Gmail, Yahoo and Outlook sender rules

This email deliverability checklist covers what Gmail, Yahoo and Outlook.com check before a marketing email reaches the inbox. Delivery only means the receiving server accepted your message; deliverability is whether it then lands in the inbox or the spam folder. Every rule below comes from the primary sources: Google's Email sender guidelines and FAQ, the Yahoo Sender Hub, Microsoft's Outlook.com announcement and the RFCs they cite. Where a threshold matters, we quote it word for word, because many summaries round the numbers or blur which rule applies to whom. Work through it in order, or skip to the one page version at the end.

When did the Gmail and Yahoo sender rules take effect?

The rules arrived in stages. Check older articles against these dates.

Who has to follow the Gmail and Yahoo bulk sender requirements?

Google's FAQ defines a bulk sender as any sender that sends "close to 5,000 messages or more to personal Gmail accounts" within 24 hours. The main guidelines page says more than 5,000 a day, so plan around the lower figure. Three details catch businesses off guard:

• Subdomains add up. Google counts all mail from the same primary domain. 3,000 messages from yourbrand.com plus 2,000 from news.yourbrand.com is 5,000 from yourbrand.com.
• The label never expires. Meet the criteria once and Google classifies you as a bulk sender permanently, whatever you send later.
• Only personal accounts count. The rules cover @gmail.com and @googlemail.com addresses, not companies on Google Workspace.

Yahoo is vague on purpose. Its FAQ says a bulk sender sends "a significant volume of mail" and adds: "We will not specify a volume threshold." Its rules cover every consumer brand Yahoo Mail hosts, AOL included. Microsoft applies its rules to domains sending more than 5,000 emails a day to Outlook.com, hotmail.com and live.com addresses.

Our advice: build to the bulk standard from day one. One holiday send to 6,000 Gmail users can cross Google's line for good, and Yahoo never says where its line is.

What are the Gmail and Yahoo sender requirements?

Both providers split their rules into a short list for every sender and a longer one for bulk senders. Where Gmail and Yahoo differ, the cell says so.

Gmail's spam rate guidance, word for word:

"Keep spam rates reported in Postmaster Tools below 0.10% and avoid ever reaching a spam rate of 0.30% or higher." Google, Email sender guidelines

Yahoo's version: "Keep your spam rate below 0.3%." Microsoft publishes no complaint number, but requires SPF and DKIM to pass and DMARC of at least p=none, aligned with SPF or DKIM.

How do you set up SPF, DKIM and DMARC?

Your email platform generates most values. You add them at your DNS host and prove they pass. Set them up in this order, because DMARC reads the results of the other two. If a term is new, our email marketing glossary defines it in plain English.

SPF: one record, ten lookups

SPF is a TXT record at your root domain listing the services allowed to send as you. Google's example for a domain on Google Workspace is v=spf1 include:_spf.google.com ~all.

• Keep a single record. Google's SPF help allows one per domain. Under RFC 7208, two records produce a permanent error.
• Stay at 10 lookups or fewer. Each include, a, mx, ptr and exists term counts, plus redirect. The ip4, ip6 and all terms do not. Go past 10 and SPF fails.
• End with ~all while you are still finding senders. Google notes a hard fail ending lets receivers reject mail from any service you forgot to list.
• Add only what your platform asks for. Some platforms handle SPF on their own bounce domain. Shopify Email, for example, covers SPF and DKIM through CNAME records.

DKIM: your domain in the signature

DKIM signs each message with a private key whose public half sits in DNS at selector._domainkey.yourbrand.com, usually as CNAME records pointing at keys your platform manages. Google and Yahoo both require keys of at least 1024 bits and recommend 2048. And the signing domain, shown as d= in the signature, must be yours. Mail signed only with the platform's domain passes DKIM but cannot align with your From address.

DMARC: start with p=none

DMARC is a TXT record at _dmarc.yourbrand.com. A sound first record:

• The v and p tags come first, per Google. p=none meets the Gmail, Yahoo and Outlook.com minimum and asks receivers to take no action on failing mail.
• Send rua reports to a dedicated mailbox, not a personal inbox; Google warns the volume can be high. Skip the ruf tag, which Gmail does not support.
• Google recommends SPF and DKIM run for at least 48 hours before you turn on DMARC.
• Once reports show every legitimate sender passing, move to p=quarantine, then p=reject. A BIMI logo needs one of those two.

Alignment: the step most senders miss

Passing SPF or DKIM is not passing DMARC. DMARC passes when one of them passes using the same domain as your visible From address. Under relaxed alignment, the default, news.yourbrand.com aligns with yourbrand.com; Google warns that strict alignment can push your own subdomain mail to spam. Gmail requires one aligned check today, recommends both, and says requiring both is likely.

Where the setting lives in common platforms

Klaviyo and Shopify both say DNS changes can take up to 48 hours, so finish before a launch week. If you send from HubSpot or a Shopify store, our pages on HubSpot email marketing and email marketing for Shopify stores explain how we run campaigns inside each one.

What do Gmail and Yahoo check for one click unsubscribe?

Both providers want two exits in every marketing email: a one click unsubscribe in the header and a clearly visible link in the body. The body link may open a preferences page. The header may not.

1. The header pair. RFC 8058 defines a List Unsubscribe header holding one HTTPS link and a List Unsubscribe Post header carrying the one click value. Your platform adds both; confirm they appear in a real message.
2. DKIM must cover them. RFC 8058 requires a valid DKIM signature that includes both headers.
3. A mailto link is not enough for Gmail. Google says mailto does not meet its requirement. Yahoo calls the RFC 8058 method highly recommended and mailto acceptable. The HTTPS method satisfies both.
4. Remove people fast. Google recommends 48 hours; Yahoo says 2 days. Both beat the federal deadline in our CAN-SPAM compliance checklist.
5. Transactional mail is exempt. Order confirmations and password resets need no one click unsubscribe.
6. The Gmail button is earned. Gmail shows its unsubscribe link beside your name only for mail that passes automated eligibility checks, so a missing button does not prove a missing header.

What spam rate do Gmail and Yahoo allow?

Gmail calculates spam rate daily as the share of messages delivered to the inbox that recipients then mark as spam. Google's FAQ says the effect is graduated: above 0.1% already hurts inbox delivery for bulk senders, and 0.3% or higher hurts more. Above 0.3%, Google offers no mitigation, and you regain eligibility only after 7 consecutive days below it. Yahoo draws the same 0.3% line, also measured on inbox delivered mail.

In plain numbers: on a campaign that lands in 10,000 inboxes, 0.1% is 10 spam reports and 0.3% is 30. Already past that line? A checklist will not fix it on its own; the work starts with finding which audience or campaign drew the reports. Here is how we fix emails going to spam.

Postmaster Tools reports spam rate only for DKIM authenticated mail and may skip low volume days to protect privacy. Google also says it does not track opens, and that low opens are not necessarily a deliverability sign. Our guide to email marketing metrics shows how to calculate complaint and bounce rates from your own reports.

How do you check your deliverability setup in 15 minutes?

1. Send a real campaign, not a plain test, to a personal Gmail address and a Yahoo address you control.
2. In Gmail, click the down arrow under the sender name. You want Mailed by and Signed by lines, with your domain under Signed by, as Google's guide to authenticated messages explains.
3. Click More next to Reply, choose Show original, and look for spf=pass, dkim=pass and dmarc=pass.
4. In the same raw message, find both List Unsubscribe headers and confirm the link starts with https.
5. Use the Dig tool in the Google Admin Toolbox on your root domain and _dmarc. You should see exactly one SPF record and one DMARC record.
6. Open the Compliance status dashboard in Postmaster Tools. Google says a fix can take up to 7 days to show.
7. Test unsubscribing in Yahoo webmail, which Yahoo names as the place to check its header setup.

What happens if you miss a requirement?

Google says mail from senders who skip its guidelines may not be delivered as expected or may be marked as spam. When Gmail slows or rejects a message, the bounce code names the rule that failed. Codes starting with 4 mean rate limited for now; codes starting with 5 mean blocked.

Which list habits keep spam complaints low?

Authentication gets your mail accepted; how recipients react decides where the next campaign lands. Google and Yahoo both publish guidance on these habits:

• Mail only people who opted in. No prechecked boxes, no purchased lists.
• Confirm new addresses, and occasionally ask long quiet subscribers if they still want your mail.
• Remove addresses that keep bouncing.
• Keep volume steady. Google warns that suddenly doubling volume can bring rate limits or a reputation drop.
• Keep the frequency people signed up for. Yahoo warns against turning a weekly list into a daily one.
• Use a From name that identifies you, not the offer, per Google's display name guidance.
• Keep promotions out of receipts and other transactional mail. Google lists mixing content types in one message as a practice to avoid.

Seasonal businesses feel this most, because their lists go quiet between peaks. For sends like the "Red Rock Days" email we wrote for Moab RV Park or the "42 New Big Rig Sites" announcement for Honey Bear By The Sea in Gold Beach, OR, the safe pattern is recent guests and clickers first, a day of watching complaints, then a wider audience. A sale like "The Console Edit" for HomeStop follows the same rule. See them in our campaign portfolio, and plan ramp up sends with our 2027 email marketing calendar.

How do you warm up a new domain or email platform?

Google's guidelines say to "start with a low sending volume to engaged users, and slowly increase the volume over time." They ask for the same gradual ramp after significant infrastructure changes, such as moving your list to a new email platform. In practice:

1. Authenticate the new domain and confirm spf=pass, dkim=pass and dmarc=pass before the first campaign.
2. Send the first campaigns only to people who opened, clicked or bought recently.
3. Add older segments over several sends. Google notes that the more email you send, the more slowly you should increase volume.
4. If messages start bouncing or getting deferred, cut volume until the error rate drops, as Google advises.

Two shortcuts that do not exist. No platform can get you allowlisted, because Google says it does not accept allowlist requests from email providers. And a shared IP address is no shield: Google says the activity of every sender on a shared IP affects the reputation of all of them.

The one page email deliverability checklist

Set up once

• Send from an address on a domain you own, never a free gmail.com or yahoo.com address
• One SPF record, 10 lookups or fewer, ending in ~all
• DKIM of at least 1024 bits (2048 where supported), signed with your domain
• DMARC TXT record at _dmarc with p=none and a dedicated rua mailbox
• From domain aligned with SPF or DKIM, ideally both
• Domain verified in Google Postmaster Tools; Yahoo feedback loop enrollment confirmed
• New domains and new platforms warmed up with engaged contacts first

Before every send

• One click unsubscribe headers present and a visible unsubscribe link in the body
• Audience excludes hard bounces, unsubscribes and past complainers
• Volume close to your usual level, with big jumps spread over several sends
• Accurate From name and subject line, visible links and no hidden content

Every month

• Gmail spam rate trend under 0.1%, with no day at 0.3% or above
• Every row of the Compliance status dashboard marked Compliant
• DMARC reports reviewed for services you do not recognize
• SPF rechecked after adding any new tool that sends email
• Long inactive contacts reconfirmed or suppressed

Want this checklist run for you every month?

At EmailMarketingAgency.com, deliverability monitoring is part of the flat $1,000 a month plan, alongside 8 finished campaigns built in the platform you already use. We check your records monthly, QA every send for links, rendering and spam score, and explain the numbers in a plain English report. Read how our email deliverability services work, or start with a free email audit of your records, list health and recent campaigns.

Frequently asked questions