A complete checklist for the 2024 Google & Yahoo sender rules. Understand SPF, DKIM, and DMARC requirements, including one-click unsubscribe and spam rate.

As of February 2024, Google and Yahoo require bulk senders, those sending over 5,000 messages per day, to implement SPF, DKIM, and a DMARC policy. According to Google's official sender guidelines, these senders must also maintain a spam complaint rate below 0.3% and provide a one-click unsubscribe link for marketing messages. These rules were introduced to reduce spam and phishing by ensuring senders are properly authenticated.

TL;DR

Google and Yahoo require a DMARC policy with at least p=none for anyone sending over 5,000 emails per day to their users.
Senders must keep spam complaint rates below 0.3%, and ideally below 0.1%, as measured by tools like Google Postmaster Tools.
A one-click unsubscribe header (RFC 8058) is mandatory for all marketing and promotional messages sent by bulk senders.
SPF records must not exceed the 10 DNS lookup limit specified in RFC 7208 to avoid a 'PermError' which causes authentication to fail.
DMARC monitoring tools like Dmarcian, EasyDMARC, and Valimail are essential for analyzing RUA reports and achieving compliance.

Who Is a 'Bulk Sender' Under the 2024 Google & Yahoo Rules?

Google explicitly defines a 'bulk sender' as any domain sending approximately 5,000 or more messages to personal Gmail accounts within a single 24-hour period. This threshold is not a rolling average but a daily calculation that includes all messages sent from the same primary domain, meaning sends from 'marketing.domain.com' and 'support.domain.com' are aggregated. The rules specifically target messages sent to personal accounts, which are those ending in @gmail.com or @googlemail.com, and do not apply to Google Workspace business accounts. This distinction is critical for B2B marketers who may send high volumes but primarily to corporate inboxes. However, the total number of global email users reached 4.48 billion in 2024, with daily email volume projected at 361.6 billion, making interactions with personal Gmail accounts nearly unavoidable for most large-scale senders. According to the "GDMA International Email Benchmark 2024," which analyzed 203 billion emails across 42,000 organizations, the increasing professionalization of email marketing has led to higher deliverability standards across the board, pushing all senders to adopt better practices regardless of their official classification.

Yahoo’s definition of a bulk sender is less numerically specific than Google's, applying its stricter rules to any domain sending a 'significant volume of mail' to its users. Despite this ambiguity, the industry has largely adopted Google’s 5,000-message threshold as the de facto standard for compliance across both platforms. Both providers began enforcing these new standards in February 2024, requiring bulk senders to implement both SPF and DKIM authentication, publish a DMARC policy, and maintain a low spam complaint rate. The alignment between the two email giants was a deliberate effort to create a unified industry standard for sender hygiene. Marcel Becker, Sr. Director of Product at Yahoo, stated that Yahoo was eager to collaborate with Google to establish these pragmatic changes as the new benchmark for the entire email community. This collaborative approach simplifies compliance for marketers, who can follow a single set of advanced requirements to satisfy the gatekeepers of a vast percentage of global inboxes. The focus for both is identical: authenticating sender identity to protect users from phishing and spam, thereby increasing trust in the email channel.

A critical and often misunderstood aspect of Google's policy is its permanence; once a sending domain crosses the 5,000-message threshold even a single time, it is permanently classified as a bulk sender. This classification does not expire and cannot be reversed by subsequently lowering send volume, meaning a one-day marketing blast or a spike in transactional emails is enough to subject a domain to the strictest requirements indefinitely. This makes flirting with the threshold a risky strategy. Furthermore, all senders, irrespective of their daily volume, must now adhere to a baseline set of rules to ensure deliverability. Since February 2024, every sender to Gmail and Yahoo must have at least one authentication method, either SPF or DKIM, properly configured. Additionally, all senders are required to keep their user-reported spam rates below 0.3%, though experts strongly recommend aiming for a much lower rate of 0.1% to maintain a healthy sender reputation. The "Validity 2024 Email Marketing Insights" report, which harnesses data from 2.5 billion mailboxes, noted that the average spam complaint rate doubled to 0.07% in 2023, signaling that mailbox providers are applying greater scrutiny even to senders well below the official 0.3% maximum.

SPF Explained: How to Pass the Sender Policy Framework Check

A Sender Policy Framework (SPF) record is a critical email authentication component published as a DNS TXT entry that explicitly lists all servers and IP addresses authorized to send email on behalf of your domain. This record acts as a public whitelist, allowing receiving mail servers at providers like Google and Yahoo to verify that an incoming message originates from a legitimate source. The core function of SPF is to prevent domain spoofing, a common tactic in phishing attacks where malicious actors forge the 'From' address of an email. According to a 2026 analysis of millions of domains by UseTransactional, approximately 73% of domains have adopted some form of SPF record, highlighting its role as a foundational element of modern email security. However, a 2024 study of the top one million domains by DMARCChecker.app found that 39% still lacked an SPF record entirely, leaving them vulnerable to impersonation. Without a valid SPF record, receiving servers have no standardized way to confirm a sender's authenticity, increasing the likelihood that fraudulent emails will reach their destination and legitimate emails will be flagged as suspicious.

The SPF specification, formally defined in RFC 7208, imposes a strict, non-negotiable limit of 10 DNS lookups for each SPF validation check. This ceiling was established to prevent denial-of-service (DoS) attacks, where a maliciously crafted SPF record with excessive lookups could overwhelm a receiving mail server's DNS resources. The initial query to retrieve the domain's SPF record does not count toward this limit, but subsequent evaluations of specific mechanisms do. As organizations integrate more third-party services for marketing, transactional emails, and customer support, their SPF records grow in complexity, often pushing them dangerously close to this limit. A 2026 study by DMARCguard, which scanned 5.5 million domains, found that 4.8% of domains with SPF records were at risk of exceeding the lookup limit, a configuration error that silently undermines deliverability. This issue is compounded by nested include statements, where a single entry for a vendor like Salesforce or Mailgun can conceal multiple downstream lookups, quickly consuming the available budget.

Exceeding the 10-lookup limit triggers a permanent error, known as a 'PermError', which has severe consequences for email deliverability. When a receiving server encounters a PermError, it cannot complete the SPF evaluation, and the check fails. For DMARC, an SPF PermError is interpreted as a 'fail', meaning the message cannot achieve DMARC alignment through SPF. This forces complete reliance on DKIM for authentication, and if DKIM also fails or is misaligned, the message's chances of reaching the inbox plummet. According to a 2026 analysis by MailTester, a single domain mismatch or configuration error in an SPF record can lead to a delivery failure rate of 30% to 70%, depending on the provider's specific enforcement policies. This failure is often invisible to the sender; emails are not necessarily bounced with an error message but are instead silently filtered into spam folders or dropped entirely, leading to a gradual erosion of sender reputation that is difficult to diagnose and repair.

SPF Mechanism	DNS Lookup Cost	Description	Primary Use Case	Performance Consideration
`include:`	1 per evaluation	Delegates SPF check to another domain's policy.	Authorizing third-party senders like Google Workspace or SendGrid.	The primary cause of exceeding the 10-lookup limit due to nested includes.
`a`	1 per evaluation	Matches if the sending IP is one of the domain's A or AAAA records.	Authorizing a website's own server to send email.	Consumes a lookup to resolve the domain's IP address.
`mx`	1 per evaluation	Matches if the sending IP is one of the domain's designated mail exchangers.	Authorizing a domain's own inbound mail servers to also send mail.	Can trigger multiple subsequent DNS queries to resolve MX hosts to IPs.
`ip4:` / `ip6:`	0	Matches a specific IPv4 or IPv6 address or CIDR range.	Directly authorizing specific, known sending IP addresses.	The most efficient mechanism as it requires no DNS query.
`exists:`	1 per evaluation	Performs a DNS query for an A record on a given domain; matches if any result is found.	Advanced, dynamic authorization using SPF macros.	Can be used to bypass the 10-lookup limit for large IP fleets.
`all`	0	Matches all senders; always placed at the end of the record.	Defining the policy for senders not matched by other mechanisms (`-all`, `~all`).	Does not consume a lookup; it is a qualifier that dictates the final result.

DKIM Signatures: Proving Message Integrity with Cryptography

DKIM, or DomainKeys Identified Mail, establishes email authenticity by adding a cryptographic signature to the message header, a process invisible to the end user but critical for mail server validation. This digital signature is created using a private key kept secret on the sending server, which corresponds to a public key published in the domain's DNS records. When a receiving mail server gets the message, it fetches this public key from the DNS to verify the signature. This intricate process confirms two essential facts: that the email was authorized by the owner of the domain and that key parts of the message, like the 'From' header and body content, were not altered in transit. According to Valimail's "2026 DMARC Report," the failure to enforce such foundational security measures leaves a significant vulnerability; their analysis revealed a 36-point gap between DMARC adoption and actual enforcement, leaving 58% of analyzed domains exposed to spoofing. This gap underscores the importance of not just implementing DKIM but ensuring it is part of a fully enforced authentication strategy.

For bulk senders, defined by Google as those sending nearly 5,000 messages daily to Gmail accounts, the 2024 requirements from Google and Yahoo mandate that the domain in the From: header aligns with either the SPF domain or the DKIM signing domain. This alignment is a core component of DMARC, which uses SPF and DKIM to validate that the sender is who they claim to be. While DMARC adoption has increased, particularly after the new rules took effect, many organizations have not achieved full protection. For instance, Sendmarc's "2024 Cyberthreat Report" noted that among Fortune 500 companies with DMARC, 68.2% (of n=unknown, but a subset of the Fortune 500) were using a non-blocking p=none policy, which only monitors for fraud instead of preventing it. This highlights a common scenario where organizations meet the minimum compliance checkbox, as seen in a dmarcian study of top U.S. retailers in 2025 where 28% (of n=unknown) remained at p=none, but fail to leverage DKIM alignment for robust security. True compliance requires that the domain used for the DKIM signature (d=) matches the visible From: domain, proving the message's origin is legitimate.

Google's sender guidelines specify a technical requirement for DKIM keys to be at least 1024 bits long, though a 2048-bit key is strongly recommended for enhanced security. This recommendation aligns with broader industry standards, such as RFC 8301, which also advises using 2048-bit keys for signing. While a 1024-bit key meets the minimum threshold for compliance with the 2024 rules, it is considered a weaker option that is being phased out by security-conscious organizations. The primary reason for the stronger recommendation is the increased cryptographic strength; a 2048-bit key is significantly harder for attackers to compromise through brute-force methods. A 2024 analysis of the top one million domains by DMARCChecker.app found that while 96.6% of discovered DKIM records were valid, 1,726 keys were still below the 1024-bit minimum, indicating that some senders have yet to meet even the baseline standard. For organizations setting up new infrastructure, adopting a 2048-bit key is the clear best practice for future-proofing their email security posture.

Unlike SPF, a DKIM signature is uniquely resilient to email forwarding, making it a more dependable authentication signal. SPF authentication frequently fails when an email is forwarded because the forwarding server's IP address is not listed in the original sender's SPF record, causing a mismatch. However, the DKIM signature is embedded within the email's headers and travels with the message itself. As long as the signed parts of the email are not modified by the forwarding server, the signature remains valid and can be verified by the final recipient's mail server. This resilience is crucial for DMARC compliance, which allows a message to pass if either SPF or DKIM aligns and passes. Because SPF alignment is so often broken by legitimate mail flows like mailing lists and forwarding rules, DKIM alignment frequently becomes the sole mechanism that ensures a forwarded message is authenticated correctly and delivered successfully. This makes a properly configured DKIM signature essential for maintaining deliverability and security across complex email delivery paths.

DMARC Policies: How to Instruct Servers to Handle Failures

DMARC unifies SPF and DKIM authentication checks, providing a crucial layer of instruction for receiving mail servers on how to handle messages that fail these checks. As of the February 2024 Google and Yahoo sender updates, even a basic DMARC record is mandatory for all senders, with bulk senders facing stricter alignment rules. The initial policy required for compliance is p=none, which functions as a monitoring-only mode. This policy instructs receivers to deliver emails regardless of authentication results but to send detailed aggregate reports (RUA) back to the domain owner. This reporting is the policy's primary function, offering visibility into all services sending email on behalf of a domain, including legitimate third-party platforms and unauthorized or fraudulent sources. Although this policy satisfies the baseline compliance requirement, it offers no actual protection against spoofing. A DMARCguard analysis in early 2026 of 5.5 million domains found that while DMARC adoption had reached 30.4%, a staggering 57.9% of those domains remained at the non-protective p=none level. This highlights a common scenario where organizations meet the minimum requirement but fail to progress toward actual enforcement, leaving their domains vulnerable.

The p=quarantine policy represents a significant step up in enforcement, instructing recipient servers to treat unauthenticated emails with suspicion by placing them in the spam or junk folder. This policy acts as a middle ground, reducing the risk of phishing emails reaching the primary inbox while providing a safety net for legitimate messages that might fail authentication due to complex configurations or forwarding issues. Transitioning from p=none to p=quarantine should only occur after a thorough analysis of DMARC reports confirms that all known, legitimate email streams are passing authentication. To mitigate risks during this transition, administrators can use the pct tag to apply the policy to a small percentage of messages, such as pct=10, and gradually increase it as confidence grows. However, a 2024 survey by the Email Security Institute noted that companies saw up to a 20% decrease in user-reported phishing attempts after implementing a quarantine policy, demonstrating its value even as an intermediate step. It serves as a crucial testing phase before full rejection, allowing teams to identify and fix alignment issues without causing widespread delivery failures of valid mail.

The p=reject policy provides the strongest level of email protection by instructing receiving servers to completely block and refuse delivery of any email that fails DMARC authentication. This is the ultimate goal of a DMARC implementation, as it is the only policy that actively prevents exact-domain spoofing and phishing attacks from reaching a recipient's mailbox or even their spam folder. When a message is rejected, the receiving server issues a 550 bounce response, and the email is never delivered. The move to p=reject is a critical final step, but it carries significant risk if executed prematurely. Blocking legitimate, business-critical emails from misconfigured third-party senders or legacy systems is a common consequence of insufficient monitoring. For this reason, experts recommend a sustained period at p=quarantine with a 100% application rate for at least 90 days to ensure no legitimate mail is being incorrectly flagged before moving to p=reject. Despite the implementation challenges, achieving p=reject is the only way to fully lock down a domain against impersonation. Yet, according to a 2024 report from Valimail referenced by DMARCReport, only 28.5% of domains with a DMARC record have successfully reached this full enforcement level.

Policy Tag	Enforcement Level	Impact on Failing Email	Recommended Use Case	Typical Implementation Phase
`p=none`	None (Monitoring Only)	Delivered to recipient as normal; reports are generated.	Initial setup to inventory all sending sources and analyze authentication status without impacting mail flow.	Phase 1: Mandatory starting point for all domains, especially for Google/Yahoo compliance.
`p=quarantine` with `pct=10`	Low (Gradual Rollout)	10% of failing emails are sent to spam/junk; 90% are delivered normally.	Safely testing the impact of an enforcement policy on a small subset of email traffic.	Phase 2a: First step into enforcement after `p=none` reports show clean data for major senders.
`p=quarantine` with `pct=100`	Medium (Full Quarantine)	All failing emails are sent to the spam/junk folder.	Protecting the inbox from most spoofing while retaining a safety net for misconfigured legitimate mail.	Phase 2b: A multi-month period to ensure no legitimate mail is quarantined before moving to `p=reject`.
`p=reject` with `pct=10`	High (Limited Rejection)	10% of failing emails are blocked entirely; 90% are sent to spam/junk (based on quarantine policy).	Final testing phase to confirm that blocking unauthorized mail does not impact critical systems.	Phase 3a: Cautious transition to the strongest policy after a stable quarantine period.
`p=reject` with `pct=100`	Maximum (Full Rejection)	All failing emails are blocked and not delivered.	Complete protection against exact-domain spoofing and phishing attacks.	Phase 3b: The final goal of DMARC implementation for full domain security.

The 2024 Compliance Checklist: One-Click Unsubscribe and Spam Rates

Bulk senders must diligently monitor and control their spam complaint rates to comply with the February 2024 mandates from Google and Yahoo. Senders directing more than 5,000 emails per day to either provider are required to maintain a spam complaint rate below 0.3%, which translates to no more than three complaints for every 1,000 messages sent. However, both Google and Yahoo explicitly advise senders to aim for a much lower rate, ideally under 0.1%, to avoid deliverability issues. This stricter target reflects a broader industry trend toward prioritizing wanted email; the Validity "The State of Email in 2024" report, which analyzes data from 2.5 billion mailboxes, revealed that the average spam complaint rate doubled to 0.07% in 2023. Another analysis, the "GDMA International Email Benchmark 2024," which used 2023 data from 13 email service providers across 125 countries, found a global average spam complaint rate of just 0.014%, underscoring how low the baseline for high-quality sending has become. Exceeding the 0.3% threshold can result in temporary errors and, as of April 2024, outright rejection of non-compliant email traffic.

A cornerstone of the 2024 sender requirements is the mandatory implementation of a true one-click unsubscribe mechanism for all marketing and promotional messages. This rule requires more than just a standard unsubscribe link in the email footer; senders must include two specific email headers: List-Unsubscribe and List-Unsubscribe-Post. Together, these headers signal to mailbox providers like Gmail and Yahoo that the sender supports the one-click functionality defined in the technical standard RFC 8058. When these headers are present and correctly configured, the email client can display its own native unsubscribe button, often at the top of the message, allowing a user to opt out instantly without being redirected to a landing page or required to log in. This process is designed to be seamless for the user and to prevent accidental unsubscribes that could previously be triggered by anti-spam software automatically checking links. The List-Unsubscribe header contains the URL for the unsubscribe action, while the List-Unsubscribe-Post header explicitly declares List-Unsubscribe=One-Click, confirming support for the immediate, no-interaction-needed POST request.

Beyond providing a one-click unsubscribe option, senders are also held to a strict timeline for processing these requests. Both Google and Yahoo mandate that all unsubscribe requests must be honored within two days, or 48 hours. This provider-enforced deadline is significantly tighter than the 10 business days permitted under U.S. law via the CAN-SPAM Act, making the two-day window the effective standard for all bulk senders. Failing to process an opt-out within this 48-hour period violates the sender guidelines and can directly harm deliverability, as mailbox providers may start penalizing the sender's reputation long before any legal deadline is crossed. This rapid processing requirement applies to all forms of unsubscribe requests, including those made via the one-click header mechanism and traditional links in the email body. The swift removal of opted-out subscribers is not just a compliance task; it is a critical component of list hygiene that helps keep engagement rates high and spam complaint rates low, directly impacting a sender's ability to consistently reach the inbox.

A final, more technical requirement for all senders is the maintenance of valid forward and reverse DNS records, a configuration known as Forward-Confirmed Reverse DNS (FCrDNS). This acts as a fundamental trust check for mailbox providers. It involves a two-step verification: first, a reverse DNS lookup is performed on the sending IP address to find its associated domain name (via a PTR record). Second, a forward DNS lookup is performed on that domain name to see if it resolves back to the original sending IP address (via an A or AAAA record). When these two lookups match, it confirms the sender's server is not a generic or temporary machine often associated with spam. While many third-party email service providers handle PTR record configuration automatically, senders operating their own mail servers on a VPS or dedicated IP must ensure this is set up correctly. Google and Yahoo explicitly require FCrDNS for email authentication, and failure to comply can lead to messages being rate-limited, rejected, or marked as spam.

Essential Tools for Monitoring and Managing Email Authentication

Google Postmaster Tools is a free service that provides senders with critical data on how their emails perform within the Gmail ecosystem, directly addressing the new sender requirements. The platform offers several dashboards that track key metrics, including IP and domain reputation, delivery errors, and user-reported spam rates. The Authentication dashboard is particularly useful for compliance, showing the percentage of mail that successfully passes SPF, DKIM, and DMARC checks. Senders can use this data to diagnose authentication issues, such as a misconfigured DKIM signature or an SPF record that does not include all legitimate sending IPs. According to Google's documentation, the service also features a Compliance Status dashboard that explicitly checks for adherence to its published sender guidelines. For bulk senders, who must maintain a spam complaint rate below 0.3%, the Spam Rate dashboard provides direct insight into how many recipients are marking their messages as spam. It is important to note that Google requires a sustained daily email volume of a few hundred messages to Gmail addresses before data will populate in the dashboards, a measure intended to protect recipient privacy.

DMARC monitoring services like Dmarcian, Valimail, and EasyDMARC are essential for managing the complexities of email authentication at scale. These platforms parse the raw XML aggregate reports sent by receiving mail servers into human-readable dashboards, helping teams identify authentication issues without needing to manually sift through thousands of individual reports. For example, a 2026 comparison of DMARC services highlights that platforms like Valimail Monitor offer free tiers for visibility, while EasyDMARC provides a suite of free tools for record checking and generation. These services are crucial for diagnosing the source of authentication failures, showing which IP addresses are sending mail on behalf of a domain and whether those emails are passing or failing SPF and DKIM checks. This visibility allows administrators to safely transition their DMARC policy from monitoring (p=none) to quarantine or reject (p=quarantine or p=reject), which is the ultimate goal for preventing spoofing. For organizations without dedicated security analysts, the actionable insights and automated reporting from these tools are critical for protecting brand reputation and ensuring compliance.

Free online checkers from providers like MXToolbox offer immediate, on-demand validation of live SPF, DKIM, and DMARC records, serving as a first line of defense against configuration errors. The MXToolbox SPF Record Check is a diagnostic tool that validates record syntax, checks for the presence of multiple records, and, most importantly, verifies that the record does not exceed the 10 DNS lookup limit imposed by RFC 7208. Exceeding this lookup limit results in a permanent error, or "permerror," causing authentication to fail and potentially leading to deliverability problems. These free tools are excellent for quick troubleshooting and are best suited for IT administrators managing a single domain or performing ad-hoc diagnostics. However, for organizations with complex email ecosystems that use numerous third-party services, each requiring an "include" in the SPF record, simply checking the record is not enough. The accumulation of these services often pushes the record beyond the 10-lookup limit, creating a significant compliance challenge.

SPF flattening services address the common problem of exceeding the 10-lookup limit, but they introduce a critical maintenance trade-off. These services work by replacing the various include mechanisms in an SPF record with a single, pre-computed list of all authorized IP addresses, thereby reducing the DNS query load during validation. For example, a service like the MxToolbox SPF Flattening tool, part of its Delivery Center Plus plan, automates this process to keep the record compliant. The primary risk of this approach is that the flattened record can become stale. Cloud services and third-party email providers frequently change their sending IP addresses; if the flattening service does not update its IP list in real-time, legitimate emails can suddenly start failing authentication because the new sending IPs are not in the published record. This creates a dependency on the flattening provider to maintain accurate, up-to-date IP lists. While automated flattening is lower maintenance than manual efforts, it requires careful initial vendor selection and ongoing monitoring to ensure the cure does not become worse than the disease.

Frequently Asked Questions

What happens if I don't comply with the 2024 Google and Yahoo sender rules?

Failure to comply with the 2024 Google and Yahoo sender rules results in negative consequences for your email deliverability. Initially, non-compliant emails may be delayed or sent directly to recipients' spam folders. As enforcement has become stricter since February 2024, messages from non-compliant bulk senders are now subject to temporary rate limiting or permanent rejection, meaning they will not be delivered at all. These measures are designed to protect users from unauthenticated mail, making compliance an essential ticket for entry into Gmail and Yahoo inboxes.

How do I check if my SPF and DKIM records are set up correctly?

You can check if your SPF and DKIM records are set up correctly using various free online tools. Many specialized services offer record checkers that analyze your domain's DNS and report on the validity and syntax of your published records. Some tools, like those from dkimvalidator.com, provide a unique email address for you to send a message to, which then generates a comprehensive report on your SPF, DKIM, and overall sender configuration. These validators are crucial for diagnosing issues, as a single misconfigured DNS record can cause your emails to fail authentication.

What is the difference between p=none, p=quarantine, and p=reject in DMARC?

The DMARC policy tag (p=) instructs receiving servers how to handle emails that fail authentication. The p=none policy is for monitoring only; it allows unauthenticated mail to be delivered normally while sending you reports about failures, providing visibility without protection. A p=quarantine policy is a transitional step that directs failing emails to the recipient's spam folder, reducing inbox phishing but not eliminating the risk entirely. The strictest policy, p=reject, instructs servers to block and bounce unauthenticated emails, which is the ultimate goal for fully preventing domain spoofing.

Do the new sender rules apply if I use an email service provider like Mailchimp?

Yes, the new Google and Yahoo sender rules apply even if you use an email service provider (ESP). These requirements impact all email senders and providers, not just a specific platform. While your ESP may handle some technical aspects, you are still responsible for configuring your domain's authentication records, such as DKIM and DMARC, to prove you have authorized the ESP to send emails on your behalf. Using a custom domain with proper authentication is critical, as sending from a freemail address like @gmail.com via a third-party platform will cause your emails to be rejected.

What is one-click unsubscribe and is it required for all emails?

One-click unsubscribe allows a recipient to opt out from a mailing list directly from the email header with a single click, as defined by the technical standard RFC 8058. This feature is mandatory for bulk senders (those sending over 5,000 messages per day) for all marketing and promotional messages, with enforcement having begun in June 2024. However, the requirement does not apply to transactional emails, such as password resets, shipping confirmations, or security alerts. Senders must process these unsubscribe requests within two days to remain compliant.

Last updated: November 2026

SPF, DKIM, DMARC: 2024 Google & Yahoo Compliance Guide