In February 2024 Gmail and Yahoo started enforcing a set of requirements on anyone sending them mail in volume. Most store owners heard about it through a panicked email from a tool vendor and have never been told plainly what it asked for.
It is short, and most of it is already done for you.
Who it applies to
Senders pushing roughly 5,000 or more messages a day to Gmail addresses. Yahoo published matching rules without naming a threshold.
If you have a list in the tens of thousands you are over the line on any real campaign. If you are much smaller you are technically outside it, and you should still do all of this, because the same signals decide where your mail lands whether or not a rule names you.
What it asks for
Authenticate the mail. SPF and DKIM on the domain you send from, and a DMARC record published on that domain. DMARC at p=none satisfies the requirement. It monitors rather than enforces, which is the right place to start.
Line the domains up. The address recipients see has to match the domain that passed SPF or DKIM. Sending as your own brand through a platform, with a properly set up sending domain, does this. Sending as a Gmail or Yahoo address from a marketing tool does not, and that is the version that broke overnight in 2024.
One-click unsubscribe. A working unsubscribe in the message header, not only a link in the footer, and the request honoured within two days.
Encryption and reverse DNS. TLS in transit, and the sending IP resolving properly in both directions.
Keep spam complaints under 0.3%. Google names 0.1% as the level to sit at, and 0.3% as the point where things go wrong.
Which parts you actually have to do
TLS, reverse DNS and the one-click unsubscribe header are the platform's job. Klaviyo and every comparable tool ship these. You do not have to think about them.
Two things are yours.
The DNS. A dedicated sending domain with SPF and DKIM published, and DMARC on the root. Half a morning once, then never again. If you have never done it, your mail is going out on a shared domain and you are borrowing a reputation built by strangers.
The complaint rate. This is the one nobody can do for you, and it is the only number on the list that moves daily.
The complaint rate is a content problem
0.3% sounds generous until you convert it. On a 20,000 send it is sixty people clicking spam. That is not a large or unusual number of annoyed customers.
It also does not arrive gradually. Complaint rates spike on a specific send, and it is nearly always the same send: the one that went to everyone because the calendar said Tuesday, to a list that includes people who have not opened anything since last year.
Which is why the fix is not a deliverability tool. It is sending less mail to people who stopped listening, and the segment that does it is the boring one you already know about. Every other item on this list is configuration you do once. This one is a decision you make every week.
Does this apply if I only send a few thousand emails?
The thresholds do not reach you, and the requirements are worth meeting anyway. Authentication and complaint rate are what mailbox providers judge everyone by. The 2024 announcement did not invent the criteria, it published them and attached enforcement to the top of the range.
Is DMARC at p=none enough?
For the requirement, yes. It also does nothing to stop anyone spoofing your domain, which is the actual reason to have DMARC. Start at p=none, read the reports for a month or two, then move to quarantine once you know everything sending as you is meant to be.
