Any domain sending 5,000 or more messages per day to Gmail or Yahoo must authenticate with SPF, DKIM, and DMARC (minimum p=none), offer one-click unsubscribe via RFC 8058, and keep the spam rate reported in Postmaster Tools below 0.3% (Google, 2026). Those are the February 2024 bulk sender rules, and they remain the de facto baseline two and a half years in - non-compliant mail is filtered to spam or rejected at the SMTP boundary with no warning period.
This post walks through what's actually required, what's optional but recommended, what happens to non-compliant mail, and how Amazon SES senders typically configure each piece.
The Three Required Pieces
The 2024 enforcement consolidated three previously-recommended practices into hard requirements at the 5,000-messages-per-day-per-provider threshold (Google, 2026). All three are needed - not "any two of three" - and they apply per sending domain, not per AWS account or per IP address. Send 5,001 messages to Gmail addresses on a single day and the full requirement set applies to every message from that domain.
Authentication: SPF, DKIM, DMARC
Senders must have all three of:
- SPF: a DNS TXT record that lists the IP addresses (or includes like
amazonses.com) authorized to send for the domain. - DKIM: a cryptographic signature on each outgoing message, validated against a public key published in DNS.
- DMARC: a DNS TXT record at
_dmarc.yourdomain.comthat tells receiving servers what to do with mail that fails SPF or DKIM. Minimum policy isv=DMARC1; p=none. Stricter policies (p=quarantineorp=reject) are stronger but not required for compliance.
DMARC also requires alignment: the domain in the visible From: header must match either the SPF domain or the DKIM signing domain. Relaxed alignment (organizational-domain match, e.g. mail.example.com aligns with example.com) is accepted by both Gmail and Yahoo; strict alignment is not required. Mail that authenticates but fails alignment still fails DMARC.
For Amazon SES senders the SPF include is include:amazonses.com, the DKIM signing happens automatically (SES generates three CNAME records when you verify a domain), and DMARC is your responsibility to publish. Mail that is forwarded between providers also needs ARC (Authenticated Received Chain) headers, which preserve the original authentication results across the forwarding hop; major mailbox providers add ARC headers themselves, so this only matters if you operate your own forwarding infrastructure.
One-Click Unsubscribe (RFC 8058)
Bulk mail must include both:
- List-Unsubscribe header: a URL (and optionally mailto: address) that recipients can use to unsubscribe.
- List-Unsubscribe-Post header: the literal string
List-Unsubscribe=One-Click, which signals to mailbox providers that a POST to the URL acts as the unsubscribe.
Gmail and Yahoo render the one-click unsubscribe in the inbox UI. When the recipient clicks, the mailbox provider POSTs to your URL. Your server must process the unsubscribe within 2 days of the request. Failing this requirement causes mail to be filtered.
Mailblast handles the List-Unsubscribe headers automatically for campaigns sent through the platform. For senders running raw SES, the headers need to be added to each outgoing message.
Complaint Rate Under 0.3%
Gmail publishes 0.3% as the spam rate above which deliverability is materially affected, and recommends staying below 0.1% (Google, 2026). The rate is the one reported in Google's free Postmaster Tools dashboard, measured per-domain over a rolling window, and counts Gmail's "Report Spam" button along with any equivalent action at Yahoo. There is no useful way to estimate this rate without registering your sending domain in Postmaster Tools.
Enforcement is soft: a single spike (one bad campaign) does not immediately cause permanent damage, but persistent spam rates above 0.3% cause mail to be filtered to spam or rejected aggressively. Note that Amazon SES's account-suspension complaint threshold (0.1%) is stricter than Gmail's filtering threshold (0.3%), so an SES account in good standing is well clear of the Gmail band - the constraint that matters first is usually AWS's, not Google's.
| Requirement | What it is | Failure consequence |
|---|---|---|
| SPF | TXT record with `include:amazonses.com` (for SES) | Mail rejected (550-5.7.26) |
| DKIM | Three CNAME records from SES, valid signature on each message | Mail rejected (550-5.7.26) |
| DMARC | TXT record at `_dmarc.yourdomain.com` with minimum `v=DMARC1; p=none` | Mail rejected (550-5.7.26) |
| List-Unsubscribe + List-Unsubscribe-Post headers | RFC 8058 compliant unsubscribe | Mail filtered to spam |
| Complaint rate < 0.3% | Rolling per-domain complaint rate | Aggressive filtering, spam folder placement |
| From: header alignment with DKIM domain | Domain in From: must align with DKIM signing domain | DMARC failure even with valid auth |
What's Optional But Recommended
Beyond the three hard requirements, Gmail's and Yahoo's sender guidelines call out a handful of practices that influence inbox placement without being enforced as outright reject or filter conditions (Google, 2026). Senders chasing the last few percent of inbox placement typically implement all of them; senders just trying to clear the compliance bar can skip them:
- BIMI: brand indicators for message identification. Optional, but provides a brand logo in the inbox for compliant senders. Requires DMARC at
p=quarantineor stricter. - TLS: encrypted SMTP between your sending IP and the receiving server. Gmail rejects unencrypted mail. Amazon SES handles this automatically.
- DMARC at
p=reject: stricter than the requiredp=none. Better protection against domain spoofing; some receivers weight it positively for inbox placement. - PTR records: reverse DNS on your sending IPs. AWS SES manages these for shared IPs; dedicated IP customers should ensure PTRs are configured.
The Effect on Amazon SES Senders
Our Amazon SES open rate trend data shows the visible effect of Feb 2024 enforcement: a step up in aggregate open rate after Q1 2024 as low-quality senders left the ecosystem. SES senders who had been running clean SPF/DKIM/DMARC saw their delivery rates improve because they were no longer competing with spammy senders for inbox space.
For SES senders specifically, the Feb 2024 changes mean:
- DKIM is non-negotiable. SES generates three CNAME records when you verify a domain; publish all three. Mail without DKIM gets rejected outright by Gmail and Yahoo.
- A custom MAIL FROM domain matters more now. MAIL FROM is the envelope sender address used for SPF and bounce delivery, separate from the visible
From:header. Without a custom MAIL FROM, the envelope sender isbounce.amazonses.com, which will not align with yourFrom:domain for SPF-based DMARC alignment - so you have to lean on DKIM alignment alone. See our MAIL FROM setup guide for the DNS configuration. - Bounce and complaint monitoring is operational. AWS account-suspension thresholds (5% hard bounce, 0.1% complaint) are stricter than Gmail's filtering thresholds (the spam-rate enforcement band starts at 0.3%), so an SES account in good standing is automatically inside Gmail's compliance window. The AWS limit is the constraint that bites first. Spike events on a single campaign can still trigger short-term filtering even when the rolling rate is healthy.
What Happens to Non-Compliant Mail
Gmail and Yahoo both enforce the rules with technical responses rather than warnings; there is no notification email, no grace period, and no "first offense" leniency (Google, 2026). Either the mail meets the spec and lands in the inbox, or it does not and is silently filtered or rejected at the SMTP boundary. The three failure modes:
- Authentication failures: Gmail returns SMTP error
550-5.7.26 This mail is unauthenticated. Yahoo returns equivalent errors. The mail does not reach the inbox or the spam folder; it is rejected at the SMTP boundary. - Missing unsubscribe headers: mail is filtered to spam without explicit error to the sender. The sending application sees a successful delivery; the recipient sees nothing.
- High complaint rate: progressively more aggressive filtering. Initial messages may land in inbox; subsequent ones land in spam; sustained problems trigger reputation-level filtering across the domain.
There's no warning period. Senders who haven't complied with the Feb 2024 rules have been filtered or rejected since then.
What This Means Operationally
For a new sender starting in 2026 the compliance work is mostly DNS configuration plus one piece of operational discipline (monitoring the spam rate). None of the items below take more than an afternoon on their own; getting them wrong is what consumes time. The checklist:
- Verify your domain in SES (creates DKIM CNAMEs automatically).
- Publish SPF, DKIM (the three SES CNAMEs), and DMARC records at your DNS provider.
- Configure a custom MAIL FROM domain.
- Implement RFC 8058 one-click unsubscribe (or use a platform that does, like Mailblast).
- Register your sending domain in Google Postmaster Tools and monitor the reported spam rate. Keep it under 0.1%. Also wire SES SNS bounce and complaint feedback into your application so suppressions happen automatically.
For a sender migrating to SES from another provider, the same checklist applies. The DNS changes propagate within hours; the DMARC reports take 24-48 hours to start arriving once published.
See our broader SES best practices checklist for the full operational picture, and our SPF, DKIM, DMARC explainer for the authentication mechanics in detail.
FAQ
What are the Gmail and Yahoo bulk sender requirements?
Gmail and Yahoo's February 2024 rules require bulk senders (5,000+ messages per day to either provider) to authenticate mail with SPF, DKIM, and DMARC at minimum p=none; offer one-click unsubscribe (RFC 8058 List-Unsubscribe-Post header); and maintain a complaint rate below 0.3% (with 0.1% as the target) (Google, 2026).
What is the threshold for being a 'bulk sender' at Gmail?
Gmail defines bulk senders as those sending 5,000 or more messages to Gmail addresses in a single day (Google, 2026). The threshold is per-domain, not per-account. If you send 5,000+ messages to Gmail recipients on any day, you're a bulk sender for that day and must comply with the full requirements.
What is one-click unsubscribe?
One-click unsubscribe (RFC 8058) is a standardized header that allows recipients to unsubscribe from a mailing list with a single click in Gmail or Yahoo's inbox UI - no follow-up confirmation page. Both the List-Unsubscribe header (with a mailto: or URL) and the List-Unsubscribe-Post header (with the action 'List-Unsubscribe=One-Click') must be present and your server must honor the request within 2 days.
What complaint rate triggers Gmail or Yahoo enforcement?
Google publishes a 0.3% complaint rate as the threshold above which deliverability is materially affected (Google, 2026). Operationally, target a complaint rate below 0.1%. Both Gmail and Yahoo measure complaint rate as a rolling rate per-domain; spike events can trigger short-term filtering even if the overall rate is healthy.
What happens if I don't comply with the bulk sender rules?
Non-compliant mail is filtered to spam or rejected outright. Gmail returns specific SMTP error codes (550-5.7.26 for authentication failures, others for missing unsubscribe headers). Yahoo behaves similarly. There's no warning period - if your mail doesn't comply, it doesn't reach the inbox. The remediation is technical (fix the authentication, fix the unsubscribe header) and operational (clean the list, reduce complaints).
Disclosure: Mailblast is a hosted management layer for your own Amazon SES account. Mailblast automatically generates compliant List-Unsubscribe headers, monitors complaint rates, and handles SES integration; senders running raw SES need to implement these requirements themselves.