# What does Gmail require from senders? _Not the Junk Folder — Scott Anderson. Last reviewed 4 August 2026._ ## Short answer Since 1 February 2024, every sender to Gmail needs SPF or DKIM authentication, valid forward and reverse DNS on the sending server, a TLS connection, RFC-compliant message formatting, and a spam complaint rate under 0.3%. Senders of more than 5,000 messages a day additionally need SPF and DKIM and an aligned DMARC record, plus one-click unsubscribe on marketing mail. ## Key facts - The requirements took effect on 1 February 2024 and apply to mail sent to personal Gmail accounts. [Google sender guidelines](https://support.google.com/a/answer/81126) - Every sender: SPF or DKIM, valid reverse DNS (PTR), TLS in transit, RFC 5322 formatting, and spam complaints below 0.3%. [Google sender guidelines](https://support.google.com/a/answer/81126) - Bulk senders — more than 5,000 messages a day — need SPF and DKIM and DMARC, with the From: domain aligned to SPF or DKIM. A p=none policy satisfies the DMARC requirement. [Google sender guidelines](https://support.google.com/a/answer/81126) - Marketing and subscribed mail from bulk senders must support one-click unsubscribe and include a visible unsubscribe link. [Google sender guidelines](https://support.google.com/a/answer/81126) Google published these requirements in late 2023 and began enforcing them on 1 February 2024. Yahoo announced a matching set at almost the same time. Between them they cover a very large share of the personal email addresses your customers use. The framing matters: these are described as requirements, not recommendations, and the consequence for failing them is not a lower spam score but non-delivery. ## What every sender must do This list applies whether you send five messages a day or five million. - **SPF or DKIM** — At least one form of authentication on your sending domain. In practice, set up both — they fail in different circumstances. - **Valid forward and reverse DNS** — Your sending server's IP address must resolve back to a hostname, and that hostname forward to the IP. If you send through Google Workspace, Microsoft 365 or any reputable platform, this is handled for you. - **A TLS connection** — Mail must be transmitted encrypted. Again, handled by any modern platform; a problem only for old self-hosted servers. - **RFC 5322 formatting** — Standards-compliant message headers, and a From: header that doesn't impersonate Gmail itself. - **Spam complaints under 0.3%** — Measured in Google Postmaster Tools. Three complaints per thousand messages is the ceiling, and it is easier to breach than people expect on a stale list. ## The extra requirements for bulk senders Cross five thousand messages a day to Gmail addresses and three more obligations apply: SPF and DKIM both, a published DMARC record, and alignment between the domain in your visible From: address and at least one of those two checks. Google accepts a DMARC policy of p=none for this purpose. That's a low bar — it's the policy that takes no action — but publishing it means you can receive aggregate reports, which is where the actual value is. The five-thousand threshold is measured per day, and a single campaign can put a business over it for one day without anyone planning to become a bulk sender. > If you send under the threshold, the extra rules don't apply — but the baseline does, and it applies from the first message. "I'm too small for this" is the single most common reason a small business is failing authentication today. ## What a small business actually needs to change 1. **Check what you publish today** — Read your current SPF, DKIM and DMARC records. Most businesses find at least one of the three missing or malformed. 2. **Cover every sending tool in SPF** — Not just your mailbox provider. Invoicing, CRM, newsletter and website forms all send as you and all need authorising. 3. **Enable DKIM in every platform that offers it** — In Google Workspace this is a two-minute job in the admin console that a surprising number of domains have never done. 4. **Publish DMARC with a reporting address** — Start at p=none with rua= set, read a few weeks of reports, then tighten to quarantine and reject. 5. **Make unsubscribing trivial on marketing mail** — One-click unsubscribe headers plus a visible link. This is also the cheapest way to keep complaint rates below the threshold — people who can't unsubscribe hit Spam instead. ## Why the 0.3% figure is the one to watch Authentication is a fixed problem: you configure it once and it stays configured. The complaint rate is a living number that reflects how people feel about receiving your mail. The practical implication is unglamorous. Stop emailing people who never opted in, delete addresses that have never once opened anything, and make the unsubscribe link obvious. Every recipient who can't find it and clicks Spam instead is worth several who quietly leave. ## Frequently asked ### Does this apply to Google Workspace addresses as well as personal Gmail? The published requirements target mail sent to personal Gmail accounts. In practice, Workspace inboxes run the same filtering infrastructure, and the direction of travel is identical, so configuring for the requirements is the right call regardless of which kind of address you're writing to. ### How do I know my complaint rate? Google Postmaster Tools, which is free and requires verifying your domain. It shows spam rate, authentication results and reputation. If you send any volume at all, it's worth the ten minutes to set up. ### I use Mailchimp — doesn't it handle all this? It handles its own sending infrastructure, and it will ask you to authenticate your domain for it. What it can't do is cover the other five systems that also send as you, or notice that your SPF record has drifted past ten lookups because of them. ### What happens if I ignore all this? Not a bounce message you'd notice — that's the difficulty. Mail is filtered to junk quietly, and the sender is the last to know. Microsoft has gone further and rejects non-compliant high-volume mail outright. ## Related - https://notthejunkfolder.com/guides/outlook-sender-requirements - https://notthejunkfolder.com/guides/spf-dkim-dmarc-explained - https://notthejunkfolder.com/guides/google-workspace-email-setup --- Not the Junk Folder reviews small business email configuration — SPF, DKIM, DMARC and MX — and fixes what's broken. Free domain checker at https://notthejunkfolder.com/#check. Contact: hello@notthejunkfolder.com.