What does Gmail’s “bulk sender guidelines” mean for 2024+?

In February 2024, Gmail started enforcing a set of rules that had been quietly optional for years. If you send 5,000 or more emails per day to Gmail addresses, you're a "bulk sender" in their eyes, and the rules now apply to you whether you've heard of them or not.

Here's what Gmail actually requires from bulk senders.

Authentication: SPF, DKIM, and DMARC

Your sending domain needs all three set up. SPF and DKIM tell Gmail that your server is allowed to send for your domain and that the message hasn't been tampered with. DMARC tells Gmail what to do if those checks fail. "Alignment" (the word that trips most people up) just means the domain in your From address needs to match the domain your SPF or DKIM is set up for. So if you send from hello@harborpost.net, your SPF or DKIM record needs to cover harborpost.net, not a third-party sending domain. You can check your SPF and DKIM for free if you want a quick read on where you stand.

Spam complaint rate: stay under 0.3%

This sounds forgiving until you do the math. If you send 10,000 emails, 0.3% is 30 spam reports. That's the ceiling, not the target. Gmail's complaint thresholds actually get tighter the closer you push to that number. Aim to stay below 0.1% as a working target. Anything above 0.08% and Gmail starts watching you more closely.

One-click unsubscribe

Gmail requires that marketing and subscribed emails include a List-Unsubscribe header that lets someone unsub in one click, directly from Gmail's interface (that small link that appears under the sender name). Your ESP almost certainly adds this automatically, but it's worth confirming. If you've built a custom sending setup, you may need to add it manually to your headers. The one-click requirement applies to marketing mail, not transactional emails like receipts or password resets.

Valid forward and reverse DNS

Every IP address you send from needs a valid hostname (forward DNS) and that hostname needs to resolve back to the IP (reverse DNS). This is usually handled by your ESP or your mail server host. If you manage your own sending infrastructure, double-check this with whoever controls your IP space.

TLS encryption

Your outbound connection to Gmail's servers needs to use TLS. Again, any reputable ESP handles this automatically. If you're sending through your own server, make sure TLS is configured and not accidentally disabled.

What happens if you don't comply?

Gmail doesn't immediately block you. The first response is usually rate limiting (your emails arrive slowly or get deferred). Then more of your mail starts landing in spam. Persistent non-compliance can lead to outright rejection. Gmail rolled out enforcement gradually through early 2024, giving senders time to catch up. That grace period is over.

If you're not sure where you stand, start with authentication. That's the piece most senders are missing, and it's the one Gmail cares about most. If your mail isn't authenticated, the other requirements don't really matter yet.

Still unsure where the gaps are? Our SOS hotline is free and we'll walk you through it without a pitch.