Gmail and Yahoo Sender Requirements: 2026 Checklist

In February 2024, Gmail and Yahoo turned email authentication from best practice into an entry requirement. The rules haven’t loosened since. Google has tightened enforcement, and Microsoft followed with near-identical requirements for Outlook.com addresses in 2025.

This page is the checklist version: what each provider actually requires, verified against Google’s email sender guidelines and Yahoo’s sender best practices as of September 2026, and what each requirement means inside a Klaviyo account. For the technical background on authentication, read our companion guide to DMARC, SPF and DKIM.

---

Who the requirements apply to

Every sender to Gmail and Yahoo has to meet a baseline. Bulk senders, defined by Google as those sending close to 5,000 or more messages a day to personal Gmail accounts, must also have SPF and DKIM, a DMARC record, aligned From domains, one-click unsubscribe, and a spam rate under 0.3%.

Three details in Google’s definition catch ecommerce brands out:

• It’s counted per primary domain. Mail from yourbrand.com, send.yourbrand.com and mail.yourbrand.com adds up.
• It’s permanent. Google states that senders who meet the threshold at least once are permanently considered bulk senders. One big BFCM send is enough.
• It only counts personal Gmail accounts. Google Workspace business addresses aren’t in the count, but for a DTC brand most of your Gmail recipients are personal.

Yahoo doesn’t publish a numeric threshold. Its page simply lists requirements for “all senders” and for “bulk senders”. In practice, any brand running a Klaviyo account with a growing list should meet the bulk tier everywhere.

---

The requirements side by side

Requirement	Gmail (all senders)	Gmail (bulk)	Yahoo (bulk)	In Klaviyo
SPF or DKIM	Required	SPF and DKIM	SPF and DKIM	Automatic; branded sending domain makes them yours
DMARC record	Not required	Required, p=none minimum	Required, p=none minimum, must pass	You publish it on your root domain (Klaviyo can generate one)
From-domain alignment	n/a	Required (SPF or DKIM)	Required (SPF or DKIM)	Needs a branded sending domain
One-click unsubscribe (RFC 8058)	n/a	Required for marketing	Required	Added automatically to campaigns and flows
Visible unsubscribe link	n/a	Required	Required	Keep it in every template footer (Klaviyo’s default footer includes one)
Honour unsubscribes	n/a	Google recommends within 48 hours	Within 2 days	Unsubscribed profiles are suppressed automatically
Spam rate	Below 0.3%	Below 0.3%, target below 0.1%	Below 0.3%	Monitor per campaign and in Google Postmaster Tools
Valid forward and reverse DNS (PTR)	Required	Required	Required	Handled by Klaviyo’s sending infrastructure
TLS	Required	Required	n/a on page	Handled by Klaviyo
RFC 5322 formatting	Required	Required	RFC 5321 and 5322	Handled by Klaviyo

Sources: Google Gmail Help “Email sender guidelines” and “Email sender guidelines FAQ”; Yahoo Sender Hub “Best practices”. Checked September 2026.

---

What each requirement means for an ecommerce brand

Authentication: SPF, DKIM and DMARC

Klaviyo authenticates every message with SPF and DKIM, but on its shared sending domain it does so for Klaviyo’s domain, not yours. That passes the “all senders” test and fails bulk-sender alignment. The fix is a branded sending domain (for example send.yourbrand.com) plus a DMARC record at _dmarc.yourbrand.com. We walk through both, step by step, in the DMARC, SPF and DKIM guide.

p=none is enough to comply. It is not enough to stop someone spoofing your brand, and it won’t qualify you for BIMI logos. Treat it as step one.

One-click unsubscribe

“One-click” means the List-Unsubscribe and List-Unsubscribe-Post headers defined in RFC 8058, which let Gmail and Yahoo show their own Unsubscribe button next to your sender name. Klaviyo says it adds these to every email automatically, though whether the button shows is up to the inbox provider. Your job is not to fight them. Don’t hide the footer link, and don’t route unsubscribes through a preference centre that needs a login.

This is also the compliant choice legally. The CAN-SPAM Act and Australia’s Spam Act both prohibit unsubscribe processes that demand more than a simple action, and our guide to email marketing laws compares the deadlines country by country.

Spam rate below 0.3% (really 0.1%)

This is the requirement most likely to hurt you, because it’s behavioural. Google says to keep the rate in Postmaster Tools below 0.1% and never reach 0.3%. It also says senders above 0.3% aren’t eligible for mitigation, so Google won’t help you until you’re back under.

Complaint rates spike when you email people who don’t remember signing up: old imports, lapsed buyers, BFCM full-list blasts. The controls that work:

• Send campaigns to engaged segments, not the whole list. See how to avoid the spam folder in Klaviyo.
• Suppress long-term non-engagers with a sunset flow and list cleaning.
• Set up Google Postmaster Tools for your domain so you see Gmail’s number, not just Klaviyo’s.

Transactional email

Google excludes transactional messages from the one-click unsubscribe requirement. But the authentication rules apply to every message, so your Shopify notifications, helpdesk and reviews app need to authenticate on your domain too, or they’ll start failing once you tighten DMARC.

---

What changed after 2024

• February 2024: requirements took effect for Gmail and Yahoo.
• June 2024: Google’s deadline for one-click unsubscribe for senders that already had an unsubscribe link. Google also stopped offering mitigation to senders above a 0.3% spam rate.
• May 2025: Microsoft began enforcing SPF, DKIM and DMARC for domains sending over 5,000 emails a day to Outlook.com, Hotmail and Live addresses, with non-compliant mail rejected (error 550 5.7.515).
• November 2025: Google said it was ramping up enforcement on non-compliant traffic, with more temporary and permanent rejections.

The direction is one-way. Non-compliant mail used to land in spam. Now it increasingly doesn’t arrive at all.

---

A 20-minute compliance check

1. Run your domain through our deliverability checker. It checks SPF (including the 10-lookup limit), DMARC policy, DKIM on common selectors including Klaviyo’s, BIMI and MX.
2. In Klaviyo, check Settings, then Domains. Is a branded sending domain verified, or are you still on the shared domain?
3. Send yourself a campaign in Gmail and choose Show original. You want SPF, DKIM and DMARC all showing PASS with your domain.
4. Open Google Postmaster Tools and check the spam rate trend over the last 30 days.
5. List every app that sends as your domain (Shopify, helpdesk, reviews, subscriptions) and confirm each has domain authentication set up.

If any of those fail, fix them before your next high-volume send. It’s much cheaper to do this in September than in the week before BFCM.

---

Need a hand?

Most Klaviyo accounts we audit are compliant on paper and exposed in practice: shared sending domain, DMARC at p=none with nobody reading the reports, and a spam rate nobody’s watching in Postmaster Tools. If you’d like it done properly, our email deliverability service covers authentication, reputation monitoring and list strategy. Or request a free Klaviyo audit and we’ll show you where you stand.