Gmail bulk sender requirements: what cold emailers must do

Since February 2024, Google has set firm rules for anyone sending email to Gmail accounts, and some apply to you even at a low volume. Here's what they ask for, in plain English, and how I'd apply them to cold email. Google updates its rules, so check its sender guidelines for the latest wording.

Rules for every sender

• SPF or DKIM on your sending domain.
• Valid DNS: forward and reverse records for your sending servers. Google Workspace handles this for you.
• TLS for sending. Google Workspace handles this too.
• A spam rate below 0.3%, and Google recommends staying below 0.1%.
• A correctly formatted message that doesn't pretend to come from someone else.

Extra rules for bulk senders

Google defines a bulk sender as one sending about 5,000 or more messages a day to Gmail accounts. Those senders also need:

• SPF, DKIM and DMARC, all three. The DMARC policy can be set to none.
• Alignment: the From domain has to match the SPF or DKIM domain.
• One-click unsubscribe on marketing and subscribed messages, plus a visible unsubscribe link in the body.

Does this apply to cold email?

If you send 30 a day from a few mailboxes, you're probably under the 5,000 line. I'd follow the bulk rules anyway, for three reasons:

• They cost nothing to meet. SPF, DKIM and DMARC take minutes on a domain.
• Filters reward them whether or not you're over the line.
• Easy opt-outs reduce complaints, and complaints are what hurt you most.

The 0.3% line is the one to fear

Of all these, the spam rate is the hardest to meet and the most damaging to miss. It means fewer than 3 reports per 1,000 emails, and Google's measurement doesn't reach everything you send. So treat any complaints you can see as a warning, and keep your targeting tight.

Google offers Postmaster Tools for reading this figure, but only once a domain sends a fair volume to personal Gmail accounts, so low-volume cold senders often see nothing there. That's normal. Watch your replies and "remove me" messages, and run placement tests instead.

Microsoft and Yahoo ask for much the same

• Microsoft: domains sending 5,000 or more emails to Outlook.com, Hotmail and Live addresses need SPF and DKIM passing and a DMARC record that passes. Mail that doesn't can be rejected.
• Yahoo: similar authentication, a spam rate below 0.3%, one-click unsubscribe, and unsubscribes honoured within 2 days. It doesn't publish a volume threshold.

Meet Google's bulk rules and you've done most of what the others ask.

Your checklist

1. Check SPF, DKIM and DMARC with the domain health checker. The SPF and DMARC generators write the records for you.
2. Add one-click unsubscribe and a plain way to opt out in the email. The unsubscribe generator gives you wording.
3. Verify lists right before sending and keep bounces under 2%.
4. Honour every opt-out straight away, and across every mailbox.

On mailzy, the one-click unsubscribe header is on by default for campaigns, and a "remove me" reply stops everything for that lead. The domains and mailboxes you buy from us come with these records set up. See deliverability.