Gmail and Yahoo's New Sender Requirements — Your Four-Month Prep Checklist

Last week, Google and Yahoo did something rare: they announced deliverability rules in the same breath, with a deadline. Starting February 2024, anyone sending significant volume to Gmail and Yahoo inboxes must meet a concrete list of authentication and hygiene requirements. Mail that doesn't measure up can expect to be rejected or sent to spam, not just quietly down-ranked.

If your product sends email (alerts, receipts, password resets, a newsletter), this applies to you or soon will. Deliverability people have recommended all of this for years; what's new is the enforcement date. You have roughly four months, and the checklist below fits in that window if you start now.

What's changing

Google's announcement (echoed closely by Yahoo's) splits senders into two groups.

Everyone sending to Gmail must have some authentication (SPF or DKIM), valid forward and reverse DNS, and low spam rates. Most competently configured mail already clears this bar.

Bulk senders (roughly 5,000+ messages a day to Gmail addresses) face the real list:

• Both SPF and DKIM, not either/or.
• A DMARC policy on the sending domain. p=none is the accepted minimum.
• From-domain alignment. The domain in your visible From: header must align with SPF or DKIM. No more sending "from" your domain while only your ESP's domain authenticates.
• One-click unsubscribe: the List-Unsubscribe / List-Unsubscribe-Post headers (RFC 8058) on marketing mail, with opt-outs honored within two days.
• Spam complaint rate under 0.3%, as measured in Google Postmaster Tools, with staying under 0.1% the recommended target.

Two notes before you relax because "we don't send 5,000 a day." First, the threshold reportedly considers your domain's overall volume, and growing products cross it sooner than they expect. Second, this is where email is heading anyway, and Yahoo moving in lockstep with Google makes that explicit. Build to the bulk-sender standard now and February becomes a non-event.

Month 1 (October): audit what you actually send

You can't fix what you haven't inventoried:

• List every system that sends as your domain. The app's transactional mail, the marketing platform, the support desk, billing, CI notifications, that CRM someone connected in 2021. Every one needs to authenticate; a single forgotten sender is a future DMARC failure.
• Check current SPF and DKIM state. Send yourself a message from each system and read the headers. Gmail's "Show original" view displays SPF, DKIM and DMARC results per message.
• Set up Google Postmaster Tools today. It's free, and it's the scoreboard Google will judge you on. You want months of spam-rate baseline before February, not a blind sprint.

Month 2 (November): authentication

The DNS work. SPF is one record listing every legitimate sending service (mind the 10-DNS-lookup limit; sprawling include: chains silently break):

example.com.   TXT  "v=spf1 include:_spf.google.com include:sendprovider.net ~all"

DKIM: enable signing in each sending service, publish the keys they give you, and sign with your own domain, not the provider's default, since alignment is now mandatory:

selector1._domainkey.example.com.   CNAME  selector1.dkim.sendprovider.net.

DMARC: start in monitoring mode, with aggregate reports so you can see who's sending as you:

_dmarc.example.com.   TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

p=none satisfies the letter of the requirement while changing nothing about delivery; it only observes. Let the reports accumulate for several weeks; expect surprises. Nearly every team that turns on DMARC reporting discovers a legitimate sender they forgot about.

Month 3 (December): unsubscribe mechanics and list hygiene

• Implement RFC 8058 one-click unsubscribe on marketing and newsletter mail: the header pair that lets Gmail render its own unsubscribe button and POST the opt-out without loading your page. Most established email platforms support it or have said they will before February; verify yours does, and confirm opt-outs process within the required two days.
• Prune your lists. The spam-rate threshold makes stale lists a liability: recipients who forgot they subscribed are exactly the ones who click "report spam" instead of "unsubscribe." Cutting long-unengaged addresses lowers complaint rates at the cost of vanity metrics. Take that trade.
• Separate transactional from marketing where you can (subdomains or dedicated streams), so a newsletter complaint spike can't drag down password-reset deliverability.

Month 4 (January): verify, watch, tighten

• Watch Postmaster Tools weekly. Spam rate under 0.3% is the hard ceiling; treat 0.1% as your alarm line, because you want margin.
• Read your DMARC aggregate reports and chase every failing legitimate source until alignment is clean.
• Only then consider p=quarantine. It's not required in February, but a fully aligned domain loses nothing by moving and gains real spoofing protection. No rush; get clean first.
• Re-test everything end-to-end: one message from each sending system, headers checked for spf=pass, dkim=pass, dmarc=pass, unsubscribe button rendering in Gmail.

The part nobody plans for: this configuration rots silently

SPF, DKIM and DMARC live in DNS, and DNS changes with no deploy pipeline, no code review, and often no audit trail. A migration overwrites a TXT record, an expired trial ESP leaves a dangling include:, someone "cleans up" records they don't recognize, and your mail starts soft-failing while the app hums along looking perfectly healthy. After February, that kind of silent drift doesn't just dent deliverability; it gets mail rejected outright.

So February's real requirement is not "set this up once" but "notice within hours if it changes."

CompleteStatus watches that layer: its email authentication monitor alerts you if your SPF or DMARC record disappears and flags weak or broken settings, and a DNS monitor on your domain's TXT records alerts on any edit to SPF, alongside uptime, SSL and heartbeat checks on the systems doing the sending, all in one dashboard. Create a free account, add an email security monitor for your domain, and you'll know if the records you fix this autumn quietly break later.