Bulk-sender requirements (Apple / Google / Yahoo)

What it is

A coordinated set of inbox-provider requirements rolled out by Gmail and Yahoo in February 2024 (Apple and Microsoft followed in spirit). Three pillars: (1) full sender authentication — SPF + DKIM, with an aligned DMARC policy of at least `p=none`; (2) RFC 8058 List-Unsubscribe one-click headers on marketing mail; (3) a spam-complaint rate kept under 0.30%, ideally below 0.10%.

Why it matters

Gmail and Yahoo together gate the majority of consumer inboxes. Non-compliant bulk mail (>5K/day) gets quietly delivered to spam or rejected; the bar isn't optional. Most ESPs (Mailchimp, SendGrid, Klaviyo) handle the auth setup, but the complaint-rate ceiling is the senders responsibility.

Who it applies to

Anyone sending more than 5,000 messages/day to Gmail or Yahoo addresses — most marketing senders.

How WQI scores it

Web Quality Index considers this standard satisfied when all of the 6 supporting factors pass.

Related standards

Requires

DMARC , SPF , DKIM

See also

Feedback loops , SPF lookups , DKIM rotation

Standards that share factors with this one

Auto-computed from overlapping factor tickets in satisfiedBy, excluding standards already listed under "See also" above. Strong overlap suggests these standards rise and fall together when sites are scored.

• DMARC 2 shared factors Email health Without DMARC enforcement, anyone can send mail that looks like it's from your domain. Apple, Google, Microsoft, and Yahoo now require it for bulk senders.
• Authenticated Received Chain (ARC) 1 shared factor Email health Preserves DKIM/SPF authentication results when mail is forwarded through mailing lists or alias services. The fix for `forwarder breakage`.
• DKIM 1 shared factor Email health Cryptographically signs outbound mail so receivers can verify the sender wasn't spoofed mid-flight. The other half of DMARC.
• DMARC Failure Reports (RUF) 1 shared factor Email health Per-message forensic reports for DMARC failures — distinct from the daily aggregate (rua=) feed. Useful for live debugging; rare in practice because of privacy concerns.
• SPF 1 shared factor Email health Lists which servers are allowed to send mail as your domain. Half of DMARC; you need it.

Other references

• guidance Google announcement (Oct 2023) — `Strengthening our commitments to a safer, less spammy inbox`
• guidance Yahoo sender best practices
• rfc RFC 8058 — One-click unsubscribe