What began in February 2024 as a Gmail and Yahoo policy is now the shared baseline of every major mailbox provider. Microsoft adopted the same rules in April 2025, Apple requires one-click unsubscribe, and in November 2025 Google stopped being gentle about it: non-compliant mail that used to be delayed is now rejected outright.

This is the practical version. What the rules are, what the numbers mean, and what you actually have to configure.

Who this applies to

The threshold is 5,000 messages a day to a single provider, counted per sending domain. Cross it once and you are a bulk sender from then on.

But two of the rules apply to everyone, at any volume: authentication, and the complaint rate. A service sending four hundred password resets a day is not exempt from either. The 5,000 threshold only gates the unsubscribe requirements.

1. Authenticate, and align

SPF and DKIM are table stakes. The part people miss is alignment: the domain in your visible From: header must match either the domain SPF authorised or the domain that signed with DKIM. Passing both checks against the wrong domain still fails DMARC.

This is the single most common cause of mail that "passes SPF and DKIM" and still lands in spam. A shared-pool sender authenticates as the provider's domain, not yours, and alignment quietly fails.

Publish DMARC at p=none to start. It enforces nothing, but it turns on the reports, and the reports are how you find out which of your systems are sending mail you forgot about.

2. Keep the complaint rate under 0.3%

Measured by Google Postmaster Tools as user-reported spam. The stated ceiling is 0.3%. Treat 0.1% as the real target, because the number is a trailing average and by the time it reads 0.3% you have already been filtered for days.

At 0.3%, three complaints in a thousand is enough. On a 500-a-day stream that is one and a half complaints. The margin is thinner than it sounds.

3. One-click unsubscribe that actually works

Required by Google, Yahoo and Apple, recommended by Microsoft. It means RFC 8058 specifically: both the List-Unsubscribe and List-Unsubscribe-Post headers, honoured within two days, and working without a login.

A link to a preference centre that asks the recipient to sign in does not satisfy this. Neither does a mailto-only header on its own.

4. Valid reverse DNS

Every sending IP needs a PTR record, and that hostname must resolve forward to the same IP. Receivers check both directions; this is forward-confirmed reverse DNS, and a mismatch is treated as a strong negative signal.

Your HELO name has to be that same hostname. A server announcing one name while its PTR says another looks exactly like a compromised host, because usually it is.

What failure looks like now

This is the part that changed. Through 2024 and most of 2025 non-compliant mail was temp-failed — a 4xx, a delay, a retry, and eventually delivery. Since November 2025 Google issues permanent rejections.

A 5xx is not a filter. The message does not reach spam; it does not reach the recipient at all, and your sending system sees a hard bounce. If your bounce handling is strict, a wave of these will suppress addresses that were never actually bad.

The checklist

SPF published, under the 10-lookup limit, no nested includes
DKIM signing with a 2048-bit key — 1024 is being refused
DMARC at p=none minimum, with rua= set
Alignment verified: From domain matches SPF or DKIM domain
PTR on every sending IP, forward-confirming
List-Unsubscribe + List-Unsubscribe-Post, no login, honoured in two days
Complaint rate watched in Postmaster Tools, target 0.1%
Suppression checked before every send, complaints permanent

Run your domain through the SPF, DKIM and DMARC checkers to see where you stand. They are free and need no account.

Why alignment is the one to get right

Of everything above, alignment is the rule that breaks silently. The others fail loudly — a missing PTR gets you rejected, a bad SPF record shows up in any checker. But alignment can be wrong while every individual check reports a pass, and the only symptom is that your mail quietly performs worse than it should.

If you send through a provider that signs with its own domain, your From: domain is not the signing domain, and DMARC does not align. Signing with a key published under your own domain is what fixes it — which is the reason this platform generates a DKIM key per customer domain rather than signing everything with one shared key.

Gmail, Yahoo and Microsoft sender rules: the 2026 state of play