InboxRatio
Check your domain

Gmail sender requirements: what Google enforces for bulk email

Last reviewed:

Gmail publishes its sender rules in one document — the Email sender guidelines — and enforces them with rate limits, spam foldering and outright rejection. Since February 2024 the rules have had teeth, and per Google's own FAQ, enforcement on non-compliant traffic ramped up again starting November 2025. This page tracks what the guidelines require right now. Every threshold below comes from Google's published documentation, re-checked on the date shown at the top of this page.

Two details make Gmail's regime different from the other providers'. First, the bulk-sender threshold is a hard number: 5,000 messages per day to Gmail accounts. Second, Google gives senders a free instrument panel — Postmaster Tools — and then writes its spam-rate requirement against the numbers that panel reports. If you send to Gmail at any volume and have not claimed your domain in Postmaster Tools, you are flying without the gauge Google grades you on.

Current sender requirements

Google splits its requirements into two tiers: rules for everyone who sends to personal Gmail accounts, and stricter rules for bulk senders.

All senders must:

  • Authenticate mail with SPF or DKIM — at least one of the two.
  • Send over a TLS connection.
  • Keep valid forward and reverse DNS (PTR records) for sending IPs.
  • Format messages per RFC 5322, the Internet Message Format standard.
  • Keep user-reported spam rates in Postmaster Tools below 0.3% — with 0.1% as the level Google tells senders to stay under.
  • Not impersonate Gmail From: headers.

Bulk senders — 5,000 or more messages per day to Gmail accounts — must additionally:

  • Authenticate with both SPF and DKIM.
  • Publish a DMARC record for the sending domain. A policy of p=none satisfies the requirement.
  • Align the From: header domain with either the SPF domain or the DKIM domain (DMARC alignment).
  • Support one-click unsubscribe in marketing and subscribed messages, per RFC 8058.

How the 5,000 threshold is counted matters. Per Google's sender guidelines FAQ, messages sent from the same primary domain count toward the limit — so mail from news.example.com and billing.example.com adds up under example.com. And the status is sticky: senders who cross the line even once are permanently considered bulk senders. There is no expiration date and no way to demote yourself back to the lighter tier by sending less.

In practice the two-tier distinction matters less than it looks. DMARC with alignment and one-click unsubscribe are cheap to implement, and every other major provider now expects them from bulk senders too. Treating the bulk-sender column as the baseline is the safer default.

Authentication requirements

Gmail checks three protocols, and for bulk senders all three are mandatory.

SPF. Publish an SPF record that lists every server and service authorized to send for your domain. A missing or failing record gets unauthenticated mail rate-limited (error 421 4.7.26) or rejected. Gmail also rejects mail outright when an SPF record contains entries it considers suspicious (550 5.7.24). You can inspect any domain's record with our SPF checker.

DKIM. Sign with a key of at least 1024 bits — Gmail states it does not accept keys shorter than that, and 2048-bit keys are the recommended length. Signing with a weak or broken key is treated the same as not signing.

DMARC. Bulk senders must publish a DMARC record. Google explicitly allows p=none as the enforcement policy, so publishing DMARC for Gmail compliance does not force you to quarantine or reject your own mail. What is not optional is alignment: the organizational domain in the From: header must match either the SPF organizational domain or the DKIM organizational domain. A third-party sending service that signs with its own domain and passes SPF on its own return path will authenticate — and still fail Gmail's alignment requirement. Check your record and its alignment posture with our DMARC checker; if you have no record yet, our DMARC setup walkthrough goes from nothing to published in one DNS entry.

Two smaller header rules from the same document: From: headers should contain exactly one email address, and sending direct-to-MX from an IP without matching forward and reverse DNS earns rejection (550 5.7.25 covers missing PTR records).

Reputation factors

Gmail's filtering is reputation-driven, and the one reputation number Google turns into a hard requirement is the user-reported spam rate as measured in Postmaster Tools. The guideline has two levels:

  • 0.1% — the rate Google tells senders to stay below.
  • 0.3% — the ceiling. Avoid ever reaching it.

The gap between the two is not decoration. Per Google's FAQ, bulk senders whose spam rate reaches 0.3% or higher become ineligible for mitigation — meaning delivery problems cannot be escalated for relief until the rate is repaired. Recovery requires holding the rate below 0.3% for 7 consecutive days, and even then, Google notes that a history of high complaint rates keeps affecting delivery for a while. A sender who lives at 0.25% is compliant on paper and one bad campaign away from losing the safety net.

Beyond the spam-rate number, Postmaster Tools reports domain and IP reputation, authentication success rates, and delivery errors — Google's own view of your sending, free with a verified domain. Alongside those provider dashboards, our deliverability score gives a quick outside-in read of a domain's technical posture.

Gmail also applies protective rate limiting when it sees unusual traffic from an IP, domain or URL (421 4.7.28). Its guidance after hitting a sending-quota error is specific: stop sending for at least 10 minutes before retrying, because immediate retries extend the penalty.

Unsubscribe requirements

For bulk senders, marketing and subscribed messages must support one-click unsubscribe. Concretely that means two headers:

List-Unsubscribe: <https://example.com/unsubscribe/opaque-token>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

The mechanism is defined by RFC 8058 (the one-click POST) building on RFC 2369 (the List-Unsubscribe header itself). When a recipient uses Gmail's unsubscribe control, your endpoint receives a POST request — no landing page, no confirmation step, no login wall. Google's FAQ sets the processing window: fulfill unsubscribe requests within 48 hours.

A visible unsubscribe link in the message body remains expected alongside the header mechanism — the header does not replace it. You can verify the headers are actually present in what you send by running a delivered message through our header analyzer.

Known error codes

Gmail documents its SMTP responses in the Gmail SMTP errors and codes reference. Every Gmail-issued error ends with the string gsmtp, which is how you distinguish a Gmail rejection from one issued by an intermediate relay. The codes most relevant to sender-guideline compliance:

| Code | Meaning per Google's documentation | |---|---| | 421 4.7.26 | Mail rate-limited because it is unauthenticated — Gmail requires SPF or DKIM from all senders | | 421 4.7.27 | SPF failure; rate limiting applied to bulk-sender traffic | | 421 4.7.28 | Unusual email rates detected; protective rate limiting by IP, domain or URL reputation | | 421 4.7.29 | Rate-limited for not using a TLS connection | | 421 4.7.30 | DKIM failure; rate limiting applied | | 421 4.7.40 | Missing or inadequate DMARC record for a bulk sender | | 550 5.7.1 | Policy rejection — low sender reputation, RFC 5322 non-compliance or missing authentication | | 550 5.7.24 | SPF record contains suspicious entries | | 550 5.7.25 | Missing or invalid PTR record for the sending IP | | 550 5.7.26 | Unauthenticated mail, or rejection under the domain's DMARC policy | | 550 5.7.27 | SPF authentication failure (permanent form) | | 550 5.7.28 | Unusual rates of unsolicited mail | | 550 5.7.29 | Bulk senders must use TLS/SSL for SMTP connections | | 550 5.7.30 | DKIM authentication failure (permanent form) | | 550 5.7.40 | Missing DMARC record or policy (permanent form) |

The pattern worth internalizing: the 421 4.7.x series is Gmail slowing you down while the problem is fixable; the matching 550 5.7.x codes are the same failures after Gmail has stopped extending credit. A sender seeing 421 4.7.26 today and doing nothing is on the road to 550 5.7.26.

Codes outside the guidelines cluster — 550 5.1.1 (account does not exist), 553 5.1.2 (recipient domain not found), 552 5.3.4 (message size exceeded) — are ordinary delivery errors, but a rising share of 5.1.1 responses is its own reputation signal: it tells Gmail your list hygiene has lapsed.

Recommended practices

Beyond the hard requirements, Google's guidelines carry recommendations that read as strong hints about how the filter weighs behavior:

  • Claim Postmaster Tools before you need it. Spam-rate history starts when you verify the domain. If you first look at the dashboard mid-incident, you have no baseline.
  • Sign DKIM at 2048 bits. 1024 is the floor, not the target.
  • Keep transactional and marketing streams apart — separate subdomains let reputation accrue (and fail) independently, and keep one stream's complaint spike from dragging down the other.
  • Ramp volume gradually. Sudden spikes from a domain or IP with no history look like the traffic 421 4.7.28 exists for.
  • Remove addresses that never engage. Google's own guidance is to send only to people who want the mail; recipients who never open it are the pool spam reports come from.
  • Honor the 10-minute backoff after quota errors instead of hammering retries.

None of these carry an error code of their own. All of them move the reputation inputs the error codes fire on.

Frequently asked questions

What is the Gmail bulk sender threshold?

5,000 or more messages per day sent to personal Gmail accounts. Messages from the same primary domain are counted together, so subdomains share one total. Crossing the threshold once makes the domain a bulk sender permanently — Google's FAQ states the status has no expiration date.

Does Gmail require DMARC with an enforcement policy?

No. Bulk senders must publish a DMARC record, but Google explicitly accepts p=none. What trips senders up is the separate alignment requirement: the From: domain must align with the SPF or DKIM domain, which p=none does not excuse.

What spam rate does Gmail allow?

Keep the user-reported spam rate in Postmaster Tools below 0.3% at all times, and aim to stay under 0.1%. At 0.3% or above, bulk senders lose eligibility for mitigation until the rate has stayed below 0.3% for 7 consecutive days.

How fast do I have to process a one-click unsubscribe?

Google's sender guidelines FAQ says unsubscribe requests should be fulfilled within 48 hours. The one-click mechanism itself (RFC 8058) must work without a landing page or login.

Why is my authenticated mail still going to spam at Gmail?

Passing SPF, DKIM and DMARC is the entry ticket, not the verdict. Content, engagement and sender reputation decide placement after authentication. Check the spam-rate graph in Postmaster Tools first — and see our breakdown of why emails go to spam for the usual non-authentication causes.

Do the requirements apply to Google Workspace recipients?

Google's guidelines are written for mail sent to personal Gmail accounts. Workspace domains sit behind their administrators' policies. In practice, meeting the personal-Gmail bar is the sensible baseline for both, since the authentication checks are the same machinery.

Sources

All requirements above were verified against these Google documents on the review date shown at the top of this page:

  • Email sender guidelines — Google Help. The canonical requirements document: authentication, TLS, spam-rate thresholds, one-click unsubscribe.
  • Email sender guidelines FAQ — Google Help. Threshold counting, permanent bulk-sender status, mitigation eligibility, the 48-hour unsubscribe window, the November 2025 enforcement ramp.
  • Gmail SMTP errors and codes — Google Workspace Knowledge Center. The error-code table above.

Where Google's documentation changes, this page changes — that is what the last-reviewed date is for. If you send to Gmail at volume, start with the two records the guidelines hinge on: run your domain through the SPF checker and DMARC checker and fix what fails before Google's error codes tell you about it.