Free diagnostic

Gmail and Yahoo sender requirements checker.

Audit your domain against the 2024 Gmail and Yahoo bulk-sender rules — SPF, DKIM, DMARC, PTR, and TLS — with honest not-verifiable flags where public data cannot answer.

Run compliance audit Bulk sender rules guide

requirements audited

2024

ruleset version

stored submissions

What the audit covers

Since February 2024, Gmail and Yahoo require bulk senders (5,000+ messages/day to personal accounts) to authenticate with SPF, DKIM, and DMARC, support one-click unsubscribe, keep complaint rates low, and send over TLS from IPs with valid reverse DNS. This audit checks every requirement that public evidence can answer, in one pass.

SPF: exactly one record published with a sane terminal policy.
DKIM: a valid, non-revoked signing key at common selectors.
DMARC: a published policy (p=none minimum) with aggregate reporting.
PTR / FCrDNS on your sending IP when you provide it, plus MTA-STS for TLS policy.

What it deliberately refuses to guess

One-click unsubscribe lives in message headers, and complaint rate lives in Google Postmaster Tools — neither is visible from public DNS. The audit marks both as not verifiable and tells you exactly how to check them, instead of inventing a score.

Background

What the 2024 Gmail and Yahoo sender rules actually require

In February 2024, Gmail and Yahoo turned a set of long-standing best practices into hard requirements for bulk senders — defined as 5,000 or more messages per day to personal Gmail accounts, with Yahoo applying similar rules. In practice, receivers enforce the spirit of the rules at much lower volumes, so treating them as the baseline for any sending domain is the safe move. The requirements break into five verifiable layers and two that only you can see. Verifiable: SPF published, DKIM signing, DMARC published, reverse DNS on sending IPs, and TLS-protected transport. Not publicly verifiable: one-click unsubscribe in the message headers, and your spam complaint rate. Microsoft joined with its own version of the authentication requirements for high-volume senders to Outlook.com in May 2025, so a domain that passes this audit is aligned with all three major providers. Failures escalate in order: first messages go to spam more often, then senders get throttled, then outright rejections. The full interpretation of every rule is in the Gmail and Yahoo bulk sender rules guide.

Reading the output

How to read your audit

Enter your sending domain and, optionally, the IP you send from. Each requirement returns pass, warning, fail, info, or not verifiable — and the overall status is the worst verifiable result.

pass: the requirement is met based on public evidence. Nothing to do.
warning: published but incomplete — the common cases are DMARC without a rua address (you meet the minimum but fly blind) and MTA-STS records that exist but whose policy file is unreachable.
fail: a hard requirement is missing — no SPF record, no DKIM key at any common selector, no DMARC record, or a sending IP without valid reverse DNS. Fix these before anything else.
info: recommended but not mandatory — currently used when MTA-STS is absent. Gmail requires TLS-encrypted delivery regardless; MTA-STS additionally prevents downgrade attacks.
not verifiable: honest by design. One-click unsubscribe lives in message headers (verify by sending a real email to the deliverability tester) and complaint rate lives in Google Postmaster Tools.

Fix order

Failed the audit? Fix in this order

Authentication failures compound: a missing SPF record plus a missing DKIM key means DMARC can never pass, so fixing DMARC first is wasted motion. Work bottom-up through identity.

1. SPF: publish exactly one TXT record covering every service that sends as your domain, ending in -all once the list is stable. See the SPF cheat sheet.
2. DKIM: publish a 2048-bit key for each sending service and confirm signatures on real mail. The DKIM checker finds your selectors.
3. DMARC: start at p=none with a rua address so reports flow, then move toward quarantine and reject with the rollout guide.
4. PTR: ask whoever owns your IP block (hosting provider or ESP) to set the PTR to a hostname that resolves back to the same IP. Background: PTR and reverse DNS guide.
5. Verify end-to-end: send a real message through the deliverability tester to confirm one-click unsubscribe and see the same evidence a receiver sees.

Providers

Per-provider enforcement notes

The three major mailbox providers now enforce overlapping versions of the same rules — passing one audit covers all of them, but the failure modes differ.

Gmail: rejects unauthenticated bulk mail with 550 5.7.26 errors and requires one-click unsubscribe for marketing mail. Complaint rate above 0.3% in Postmaster Tools effectively guarantees spam-folder placement.
Yahoo: enforces the same authentication trio and one-click unsubscribe; deferred mail commonly shows TSS04 codes. Yahoo leans heavily on DKIM historically, so a broken signature hurts more here.
Outlook / Microsoft 365: since May 2025, high-volume senders must pass SPF, DKIM, and DMARC; failures surface as 550 5.7.5xx rejections. Microsoft is also famously strict about missing PTR records.

Live diagnostic

Audit your sender compliance

Anonymous, rate limited, and nothing you submit is retained. Requirements that cannot be verified from public data are marked honestly instead of guessed.

DNS evidence only — no mailbox probing, account lookup, or tenant data.

Enter your sending domain to audit the Gmail and Yahoo bulk-sender requirements.

Gmail & Yahoo bulk sender rules

The complete 2024 compliance checklist, explained.

DKIM checker

Find and validate signing keys.

DMARC checker

Inspect policy and reporting publication.

Deliverability tester

Verify the full message, including one-click unsubscribe.

FAQ

I send under 5,000 emails a day. Does this audit still matter?

Yes. The 5,000/day threshold defines 'bulk sender' for the strictest enforcement, but receivers apply the same authentication and reputation logic at every volume — a missing DMARC record hurts a 500-email/day sender too. Treat the rules as the baseline for any domain that sends mail.

Why is one-click unsubscribe marked 'not verifiable'?

Because it lives in the message itself — the List-Unsubscribe and List-Unsubscribe-Post headers — not in DNS. No public lookup can see it. Send a real email to the deliverability tester and the header analysis checks both headers and the POST endpoint behavior.

My ESP handles SPF and DKIM. Why did the audit still fail?

ESP setup usually requires records in YOUR DNS: an include for SPF, and CNAME or TXT records for DKIM. If those were never added — or were removed during a migration — the ESP signs correctly but receivers cannot verify you. The audit reads your domain's public records, which is exactly what receivers see.

What complaint rate gets me in trouble?

Google's published threshold is 0.3% — at or above it, spam-folder placement follows. Healthy senders stay under 0.1%. The only place to see your real number is Google Postmaster Tools; no third-party tool can measure it for you.

Does passing every check guarantee inbox placement?

No. This audit verifies the published requirements — the table stakes. Placement also depends on complaint rates, engagement, content, and sending history, none of which are publicly visible. Passing means you are eligible to be trusted; it is not a delivery promise.

Do you store the domain or IP I audit?

No. The audit is anonymous, rate limited, and retains nothing. Every check resolves live against public DNS and the results are discarded after the response.