Google & Yahoo sender requirements: what cold emailers must do

Since February 2024, Google and Yahoo enforce a shared set of sender requirements that decide whether your mail reaches Gmail and Yahoo inboxes at all — and for cold emailers, meeting them is non-negotiable. The Google and Yahoo sender requirements come down to three things: authenticate everything, keep complaints under 0.3%, and make unsubscribing easy. Here's what each means in practice and exactly how a cold sender complies.

These rules were aimed at spammers, but they apply to you the moment you email a Gmail or Yahoo address — which every cold campaign does, constantly. Treat them as the baseline, not the goal.

Requirement 1: Authenticate with SPF, DKIM, and DMARC

All three, aligned to your From domain. This is the headline change from 2024, and it's now strictly enforced for bulk senders (roughly 5,000+ messages/day to Gmail), with partial enforcement for everyone else.

• SPF and DKIM must be set up and passing.
• DMARC must exist — p=none is enough to comply, though stricter is better for spoofing protection.
• Alignment matters: the authenticated domain must match your visible From address.

If you haven't done this yet, follow the 15-minute SPF, DKIM & DMARC setup first — nothing else on this page matters until authentication passes. Once you're in monitor mode at p=none, DMARC policy: none vs quarantine covers the specific checks to run before tightening the policy.

Requirement 2: Keep spam complaints under 0.3%

This is the one that quietly kills cold campaigns. Google wants your spam complaint rate below 0.3%, ideally under 0.1%. That means fewer than 3 complaints per 1,000 delivered emails — and complaints accumulate against your domain's reputation.

For cold email, complaints come from one root cause: emailing people who don't want to hear from you. Every lever that lowers complaints is a targeting or relevance lever:

• Tight, relevant lists — no scraped or purchased contacts.
• A clear, honest opening that isn't a bait-and-switch.
• Stop-on-reply, and stop on opt-out immediately.
• Verify lists to cut bounces and spam traps (which also protect reputation).

You can only manage what you can see: set up Google Postmaster Tools for each sending domain to watch your actual spam rate and reputation.

Requirement 3: Easy unsubscribe, honored fast

Bulk senders must support one-click unsubscribe (RFC 8058) via list headers, and honor any opt-out within two days.

Cold email is a slightly different shape — you're not running a newsletter — but the compliant, deliverability-smart move is the same: make opting out effortless and honor it instantly. A visible, easy opt-out in every message does two jobs at once: it satisfies the requirement and it diverts would-be complainers to a harmless unsubscribe instead of the spam button. An unsubscribe costs you nothing; a spam complaint costs you reputation.

Requirement 4: Send wanted mail, at a sane rate

Underneath the specific rules is one principle Google states plainly: send mail people want. The enforcement mechanisms for cold senders:

• Valid, low bounce rate — clean lists, verified before sending.
• Consistent volume — no spikes; ramp gradually across more mailboxes and domains rather than cranking one inbox. (See why cold emails go to spam.)
• Warmed domains — a cold domain has no reputation to trade on.

The compliance checklist

Per sending domain:

1. SPF, DKIM, DMARC all passing and aligned. (Verify free.)
2. Google Postmaster Tools connected; spam rate watched, kept under 0.3%.
3. Easy opt-out in every message, honored immediately.
4. Lists verified, zero purchased contacts, bounce rate under 2%.
5. Volume ramped and spread; every mailbox warmed.

Why this is harder at agency scale

Meeting these requirements for one domain is a checklist. Meeting them across a dozen sending domains and several client workspaces — while catching the day a complaint rate creeps past 0.3% or an SPF record breaks — is a monitoring problem. And Postmaster Tools shows you each domain in isolation, one login at a time.

ColdOps watches authentication, bounce, and complaint signals across every sending domain in your Instantly, Smartlead, and EmailBison workspaces and alerts you before a threshold breach turns into a spam-foldered campaign. The requirements don't change; catching a violation early is the whole game.

Start by confirming authentication on every domain with the free deliverability checker — it's the requirement everything else is built on.