Gmail sender requirements: Google’s bulk sender rules

Google's bulk sender rules apply to any domain sending 5,000 or more messages per day to Gmail addresses. Those senders must authenticate with both SPF and DKIM, publish a DMARC policy (at least p=none) with alignment, maintain valid forward and reverse DNS (a PTR record for the sending IP), and — for bulk marketing mail — support one-click unsubscribe.

Google also expects senders to keep the spam complaint rate reported in Google Postmaster Tools low. These are not one-time setup tasks: they describe the ongoing state of your real mail flow, which is why publishing records is only the start.

Gmail expects mail to pass SPF and be signed with DKIM, and it expects a DMARC record on the sending domain. DMARC alignment is the piece teams most often miss: it is not enough for SPF or DKIM to pass in isolation — the authenticated domain has to align with the domain in the visible From address.

A minimum p=none policy satisfies the rule's requirement to publish DMARC, but p=none takes no action on failing mail. SpoofSentry uses your aggregate DMARC reports to show which real sending sources align and which do not, and guides the move toward enforcement without blocking legitimate senders.

For bulk marketing mail, Google requires one-click unsubscribe implemented per RFC 8058 — a header-based unsubscribe that lets recipients opt out without extra steps. This reduces the manual “report spam” behaviour that drives complaint rates up.

Google also asks senders to keep the reported spam complaint rate in Google Postmaster Tools below 0.3% and to avoid ever hitting higher spikes. That figure is measured against real recipient behaviour, so it can only be confirmed from your Postmaster data — not from a DNS lookup.

Enforcement of these rules has tightened over time. Non-compliant bulk mail is increasingly rejected outright rather than merely filtered — Gmail began issuing SMTP rejections of non-compliant bulk mail in November 2025. A domain that appeared to “work” when failures were only sent to spam can now see messages bounced at the SMTP layer.

Because rejection happens per message against Gmail's live evaluation of your traffic, the safest way to understand your exposure is to look at what your senders are actually doing in your DMARC reports, not to assume a published record is enough.

The public Provider Readiness checker inspects your public DNS and tells you where Google, Microsoft, and Yahoo readiness looks likely OK, needs a closer check, or is at risk. It can see your records — it cannot see your real senders. Whether every legitimate stream actually passes alignment, and whether your spam rate stays under Google's threshold, can only be confirmed from your DMARC aggregate reports and Postmaster Tools data.

SpoofSentry ingests those reports and maps the evidence against Google's published requirements — showing which sending sources align, which would fail, and what to fix. SpoofSentry maps evidence and operates the controls; it does not declare you “compliant” on Google's behalf.