Gmail and Yahoo's New Sender Requirements — Your Four-Month Prep Checklist

Last week, Google and Yahoo did something rare: they announced deliverability rules in the same breath, with a deadline. Starting February 2024, anyone sending significant volume to Gmail and Yahoo inboxes must meet a concrete list of authentication and hygiene requirements — and mail that doesn't measure up will be rejected or spam-foldered, not just quietly down-ranked.

If your product sends email — alerts, receipts, password resets, a newsletter — this applies to you or soon will. The requirements themselves are things deliverability folks have preached for years; what's new is the enforcement date. You have roughly four months. Here's what's actually required, and a checklist that fits comfortably in that window if you start now.

What's actually changing

Google's announcement (echoed closely by Yahoo's) splits senders into two groups.

Everyone sending to Gmail must have some authentication — SPF or DKIM — valid forward and reverse DNS, and low spam rates. Most competently configured mail already clears this bar.

Bulk senders — 5,000+ messages/day to Gmail addresses — face the real list:

• Both SPF and DKIM, not either/or.
• A DMARC policy on the sending domain — p=none is the accepted minimum.
• From-domain alignment — the domain in your visible From: header must align with SPF or DKIM. No more sending "from" your domain while only your ESP's domain authenticates.
• One-click unsubscribe — the List-Unsubscribe / List-Unsubscribe-Post headers (RFC 8058) on marketing mail, with opt-outs honored within two days.
• Spam complaint rate under 0.3% — as measured in Google Postmaster Tools, with staying under 0.1% the recommended target.

Two notes before you relax because "we don't send 5,000 a day." First, the threshold reportedly considers your domain's overall volume, and growing products cross it sooner than they expect. Second, these requirements are simply where email is heading — Yahoo moving in lockstep with Google makes that explicit. Build to the bulk-sender standard now and February becomes a non-event.

Month 1 (October): audit what you actually send

You can't fix what you haven't inventoried:

• List every system that sends as your domain. The app's transactional mail, the marketing platform, the support desk, billing, CI notifications, that CRM someone connected in 2021. Every one needs to authenticate — a single forgotten sender is a future DMARC failure.
• Check current SPF and DKIM state. Send yourself a message from each system and read the headers — Gmail's "Show original" view displays SPF, DKIM and DMARC results per message.
• Set up Google Postmaster Tools today. It's free, and it's the scoreboard Google will judge you on. You want months of spam-rate baseline before February, not a blind sprint.

Month 2 (November): authentication

The DNS work. SPF — one record listing every legitimate sending service (note the 10-DNS-lookup limit; sprawling include: chains silently break):

example.com.   TXT  "v=spf1 include:_spf.google.com include:sendprovider.net ~all"

DKIM — enable signing in each sending service, publish the keys they give you, and crucially sign with your own domain, not the provider's default, since alignment is now mandatory:

selector1._domainkey.example.com.   CNAME  selector1.dkim.sendprovider.net.

DMARC — start in monitoring mode, with aggregate reports so you can see who's sending as you:

_dmarc.example.com.   TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

p=none satisfies the letter of the requirement while changing nothing about delivery — it's pure observation. Let the reports accumulate for several weeks; expect surprises. Nearly every team that turns on DMARC reporting discovers a legitimate sender they forgot about.

Month 3 (December): unsubscribe mechanics and list hygiene

• Implement RFC 8058 one-click unsubscribe on marketing and newsletter mail — the header pair that lets Gmail render its own unsubscribe button and POST the opt-out without loading your page. Most reputable email platforms either support it or are racing to before February; verify yours does, and confirm opt-outs process within the required two days.
• Prune your lists. The spam-rate threshold makes stale lists a liability: recipients who forgot they subscribed are exactly the ones who click "report spam" instead of "unsubscribe." Cutting long-unengaged addresses lowers complaint rates at the cost of vanity metrics — take that trade.
• Separate transactional from marketing where you can (subdomains or dedicated streams), so a newsletter complaint spike can't drag down password-reset deliverability.

Month 4 (January): verify, watch, tighten

• Watch Postmaster Tools weekly. Spam rate under 0.3% is the hard ceiling — treat 0.1% as your alarm line, because you want margin, not compliance-by-a-hair.
• Read your DMARC aggregate reports and chase every failing legitimate source until alignment is clean.
• Only then consider p=quarantine. It's not required in February, but a domain that's fully aligned loses nothing — and gains real spoofing protection. No rush; get clean first.
• Re-test everything end-to-end: one message from each sending system, headers checked for spf=pass, dkim=pass, dmarc=pass, unsubscribe button rendering in Gmail.

The part nobody plans for: this configuration can silently rot

Here's the operational trap. SPF, DKIM and DMARC live in DNS — and DNS changes with no deploy pipeline, no code review, and often no audit trail. A migration overwrites a TXT record, an expired trial ESP leaves a dangling include:, someone "cleans up" records they don't recognize — and your mail starts soft-failing while the app hums along looking perfectly healthy. After February, that kind of silent drift doesn't just dent deliverability; it gets mail rejected outright.

Which makes February's real requirement not "set this up once" but "notice within hours if it changes."

CompleteStatus watches that layer for you — DNS monitoring alerts you when your SPF, DKIM or DMARC TXT records change or disappear, alongside uptime, SSL and heartbeat checks on the systems doing the sending, all in one dashboard. Create a free account, point a monitor at _dmarc.yourdomain.com, and turn the four-month checklist into a config you'll actually still have in February — and in February 2025.