What changed, and why it is different this time
Mailbox providers have published sender guidance for years, and for years the penalty for ignoring it was probabilistic — your mail was more likely to land in spam. You could ignore that for a long time without noticing.
Since November 2025, non-compliant bulk mail is rejected at SMTP time. Your provider gets a hard failure. The message is not delivered anywhere, including the spam folder.
Does this apply to you
The bulk threshold is 5,000 messages a day to Gmail or Yahoo personal inboxes. Crossing it once applies the rules permanently — there is no dropping back below and being exempt again.
Transactional senders routinely assume they are exempt and are wrong. Five thousand password resets and receipts a day is a mid-sized SaaS product, not a marketing operation.
The checklist
| Requirement | Detail |
|---|---|
| SPF and DKIM | Both, on the sending domain. Not one or the other |
| DMARC | At minimum p=none, published on the organisational domain |
| Alignment | The domain passing SPF or DKIM must match the visible From domain |
| One-click unsubscribe | List-Unsubscribe and List-Unsubscribe-Post headers (RFC 8058) on marketing mail |
| Honour unsubscribes | Within two days, without requiring a login |
| Spam complaint rate | Keep below 0.10%. Never reach 0.30% |
| Valid forward and reverse DNS | On the sending IP |
| TLS | For inbound connections |
| Format | Conform to RFC 5322. No forged From headers |
The complaint rate is the one you cannot fix quickly
Records are an afternoon. A complaint rate above 0.30% is a list quality problem, and lists take months to fix. It is also the number almost no sender monitors, because most providers do not surface it prominently.
Two numbers matter: 0.10% is where you should already be acting, and 0.30% is where Gmail and Yahoo stop accepting your mail. If you cannot see your current rate on a dashboard right now, that is the first thing to fix.
One-click unsubscribe is not an unsubscribe link
RFC 8058 requires two headers, not a link in your footer. The receiving client renders its own unsubscribe control, posts to your endpoint, and expects you to honour it within two days without the recipient logging in or confirming.
List-Unsubscribe: <https://example.com/u/9f2a1c>, <mailto:unsub@example.com>
List-Unsubscribe-Post: List-Unsubscribe=One-ClickWhere this should live
Every requirement above is machine-checkable, which makes it a strange thing to leave in a help article. Your provider knows whether your DNS is aligned, whether the headers are present, and what your complaint rate is.
We refuse sends from unverified domains, inject the RFC 8058 headers automatically on marketing mail, and throttle an account before its complaint rate reaches the level mailbox providers act on. The goal is that you cannot send mail Gmail will reject, rather than that we told you not to.