DEV Community

cendyandreoli
cendyandreoli

Posted on Originally published at pidgely.com

Gmail and Yahoo bulk sender requirements: a developer checklist

#email #devops #webdev #backend

Since February 2024, Gmail and Yahoo reject or spam-folder mail that skips a short list of rules. Google defines a bulk sender as roughly 5,000 or more messages a day to personal Gmail accounts, counted across all subdomains of your primary domain, and you keep the status once you qualify. Some rules apply to everyone, whatever the volume.

Rules for every sender

  • SPF or DKIM must pass. Set up both.
  • Forward-confirmed reverse DNS: the sending IP needs a PTR record whose hostname resolves back to the same IP.
  • TLS on the SMTP connection.
  • RFC 5322 messages: one From, a valid Date, a Message-ID.
  • Never use @gmail.com in From on your own infrastructure. Gmail publishes p=quarantine, so it fails.

Extra rules for bulk senders

  • SPF and DKIM both, not one or the other.
  • DMARC with at least p=none, and a From domain aligned with the SPF (Return-Path) domain or the DKIM d= domain: 
_dmarc.example.com.  IN TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com"
Enter fullscreen mode Exit fullscreen mode

A message signed only with d=vendor.example.net but sent From: you@example.com fails alignment even when DKIM passes.

  • One-click unsubscribe (RFC 8058) on marketing mail, with the header covered by the DKIM signature: 
List-Unsubscribe: <https://example.com/u/7Qk2...>, <mailto:unsub-7Qk2@example.com>
List-Unsubscribe-Post: List-Unsubscribe=One-Click
Enter fullscreen mode Exit fullscreen mode

The HTTPS endpoint must accept POST with List-Unsubscribe=One-Click and unsubscribe without a login page.

  • Honor unsubscribes within two days. A weekly ESP-to-CRM sync breaks this.
  • Spam rate below 0.1% in Google Postmaster Tools, never 0.3% or more. The rate is computed over mail delivered to the inbox, so spam-foldered mail makes it look better than it is.

What failure looks like

Not always a hard bounce. Typical replies:

421 4.7.27 ... rate limited because SPF authentication didn't pass
550 5.7.26 ... Unauthenticated email is not accepted due to domain's DMARC policy
Enter fullscreen mode Exit fullscreen mode

Treat any 5.7.x as a policy signal to investigate, not a bad address to suppress.

Check it yourself 

dig +short TXT _dmarc.example.com
dig +short -x 203.0.113.10
Enter fullscreen mode Exit fullscreen mode

Official source: Google's email sender guidelines. The full version of this checklist, with the common mistakes and an FAQ, is on the Pidgely blog. Pidgely is the email API I work on.

Top comments (1)

Collapse
 
alexshev profile image
Alex Shev •

The checklist is strongest where it separates transport authentication from alignment. In production I would also retain a sample of Authentication-Results headers and the unsubscribe request outcome with the campaign ID; that gives an incident investigation evidence of which domain failed alignment and whether the one-click endpoint actually completed. The two-day unsubscribe limit is easy to state but needs an idempotent event path to be dependable.