In February 2024, Google and Yahoo began enforcing stricter email authentication requirements for bulk senders — anyone sending more than 5,000 emails per day to Gmail addresses. The requirements have significant implications for email marketing programmes that haven't kept up with authentication standards. If you're seeing deliverability issues, or if you've received warnings in your email service provider's dashboard, this is likely the cause.
What changed and why
Email authentication has existed for years: SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) were already widely adopted. What's new is the enforcement of DMARC — Domain-based Message Authentication, Reporting, and Conformance — specifically at a policy level that actually rejects unauthenticated mail.
DMARC had been deployable since 2012, but many organisations set it to p=none (monitoring mode) and never advanced to actual enforcement. Google and Yahoo's requirement is that bulk senders have DMARC configured at a minimum of p=none, with SPF and DKIM passing, and a working postmaster address. More significantly, they're making clear that p=quarantine or p=reject policies will become expected as standards evolve.
The full compliance checklist
1. Verify your SPF record
Your domain's SPF record tells receiving mail servers which IP addresses are authorised to send email on behalf of your domain. Check that your SPF record includes all services that send email in your name — your ESP (Mailchimp, Klaviyo, HubSpot, etc.), your transactional email service (SendGrid, Postmark, etc.), and any other sending infrastructure.
Common mistake: organisations accumulate SPF includes from old services they no longer use, and the record exceeds the 10 DNS lookup limit, causing SPF failures. Audit your SPF record with a tool like MXToolbox and remove obsolete includes.
2. Verify DKIM is configured for all sending domains
DKIM adds a cryptographic signature to your outgoing email that proves the message hasn't been tampered with in transit. Your ESP almost certainly supports DKIM — check that you've added their DKIM DNS records to your domain.
If you send from multiple subdomains (newsletters from [email protected], transactional from [email protected]), DKIM must be configured for each. Check each sending address.
3. Configure DMARC
Add a DMARC TXT record to your DNS at _dmarc.yourdomain.com. At minimum:
v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected];The p=none policy means "report but don't reject." This is the starting point. Set up the reporting mailbox and begin reviewing the aggregate reports (daily) to understand what's passing and failing before moving to a stricter policy.
4. Set up a postmaster/abuse address
Google requires that your domain has a functioning postmaster address ([email protected]) and abuse address ([email protected]). These don't need to be actively monitored in detail, but they must exist and accept email. Add these as aliases to a monitored inbox.
5. Enable easy unsubscribe
Google's requirements include support for one-click unsubscribe (RFC 8058). Major ESPs have added List-Unsubscribe headers automatically — verify this in your ESP settings. For custom sending infrastructure, add the List-Unsubscribe and List-Unsubscribe-Post headers to all bulk email.
6. Review your complaint rate
Google's Postmaster Tools (free, available at postmaster.google.com) shows your spam complaint rate for mail sent to Gmail. The target is below 0.1%. Above 0.3% triggers deliverability impacts. Review this monthly — a sudden spike in complaints is the early warning signal for a deliverability problem before it reaches inbox-level impact.
The path to p=quarantine and p=reject
The long-term standard is moving toward p=reject — email that fails DMARC authentication is rejected outright by receiving servers, not just sorted to spam. This is the right destination. The path there:
- Deploy
p=noneand collect 30-60 days of DMARC aggregate reports - Identify all legitimate sending sources and ensure they pass SPF and DKIM
- Move to
p=quarantinewith a subdomain policy first (sp=quarantine) - Monitor for 30 days, address any failures
- Move to
p=reject
If you need help auditing your email authentication setup or diagnosing deliverability issues, get in touch. This is a common engagement for us right now.
