Gmail bulk sender requirements
Once you send above Google's bulk threshold to personal Gmail accounts, you must: authenticate with both SPF and DKIM, publish a DMARC record (p=none is accepted as the minimum), have at least one authenticated domain that aligns with your visible From:, keep valid forward and reverse DNS on your sending IPs, use TLS, keep the user-reported spam rate below Google's published threshold, and support one-click unsubscribe on marketing mail.
Authentication and alignment
| Control | What to verify |
|---|---|
| SPF | Every legitimate envelope sender is authorised, and the record stays inside the 10-lookup limit. |
| DKIM | Outbound mail is actually signed — not merely that a key is published — and the signing domain is yours. |
| DMARC | A record exists at _dmarc.<domain>. p=none is accepted. |
| Alignment | The visible From: domain aligns with a domain that passes SPF or DKIM. This is the one that fails. |
Infrastructure and message controls
- Valid forward and reverse DNS on every sending IP.
- TLS on SMTP transport, and RFC 5322-conformant message formatting.
- User-reported spam rate below Google's published threshold. Watch it in Postmaster Tools — it is the requirement you cannot fix with DNS.
- One-click unsubscribe (RFC 8058) plus a visible unsubscribe link, on marketing mail.
- No impersonation of Gmail
From:addresses.
Audit your domain
SPF, DKIM and DMARC, with the exact records to fix what's broken.
Verification workflow
- Inventory every platform that sends as your domain. All of them. The CRM too.
- Check public DNS.
- Send a test from each platform and read the
Authentication-Resultsheader on arrival. - Watch DMARC aggregate reports and Google Postmaster Tools.
- Recheck whenever a sender is added or removed.
Frequently asked
What DMARC policy does Gmail require for bulk senders?
A DMARC record must exist. p=none satisfies the requirement — Google does not mandate enforcement. That said, p=none provides no spoofing protection, so treat it as the compliance floor rather than the goal.
Do I need both SPF and DKIM for Gmail bulk sending?
Yes. Below the bulk threshold, SPF or DKIM is enough. Above it, Google requires both, plus DMARC, plus alignment. This is a genuine tightening and it catches senders who scaled up on an SPF-only setup that used to work.
What is one-click unsubscribe and is it required?
It is the List-Unsubscribe and List-Unsubscribe-Post header pair (RFC 8058) that lets a recipient unsubscribe without leaving their mail client. Google requires it on marketing and subscribed messages from bulk senders, alongside a visible unsubscribe link in the body. A public DNS check cannot verify it — it is a message header, so you must inspect a sent message.
Related
- Fixing Gmail 550 5.7.26 — Gmail rejects with 550 5.
- Yahoo sender requirements — Yahoo's bulk sender rules track Google's closely: SPF and DKIM, DMARC, alignment, low complaint rate, one-click unsubscribe.
- Setting up email authentication, in the right order — A working sequence for SPF, DKIM and DMARC that doesn't reject your own mail on the way.
- Outlook 550 5.7.515 and friends — Microsoft's 5.
Automate this → — free tier, public pricing, API key emailed in about thirty seconds. No call with anyone.