Understanding the Gmail and Yahoo sender requirements: Takeaways from our fireside chat with Gmail and Yahoo

What’s changing and why?

Google and Yahoo are both cracking down on enforcing requirements for bulk senders around authentication standards, spam rate thresholds, and one-click unsubscribe policies. We covered the requirements in depth when they were first announced in October 2023, and got some further insights from Yahoo featured in our Email’s Not Dead podcast. If we’ve learned anything from industry changes, it’s that sometimes there is never enough information straight from the source. That’s why we hosted a webinar and put both of these mailbox giants in the same room to set the record straight.

The requirements in a nutshell

Here’s a quick recap. Bulk senders will be held to three primary requirements designed to enforce a healthy and happy inbox experience. These requirements revolve primarily around preventing spammy behaviors by strengthening authentication, creating a uniform unsubscribe process, and managing overall spam rates.

• Authentication: Bulk senders must implement SPF, DKIM, and DMARC authentication protocols.

• One-click unsubscribe: One-click unsubscribe headers must be used in accordance with the RFC 8058 standard.

• Spam rate 0.3%: Senders will need to maintain a spam complaint rate of 0.3% or below.

Your questions answered

Throughout the rest of this post, we’re going to feature some of the most asked questions around each of these requirements from our recent Fireside chat with Google and Yahoo which you can watch on-demande here. To kick it off, we’re going to dive into an easy, albeit existential question. Why now?

Why are these requirements being enforced now?

Like we said, these requirements may seem familiar and that’s because they’ve been around for a while. The goal is not to disrupt senders, it’s to make the inbox safer for users. Here’s what the experts had to say:

Aside from why now, the next big question is who will these requirements affect?

Who do these changes impact?

The ultimate goal is to create a better and more secure experience for users. If you take away only one thing from this post it should be this: Users are shared customers between mailbox providers, ESPs and senders. Enforcing these requirements is about building a better email ecosystem that will benefit us all.

The requirements are specific to bulk senders. Much of the confusion surrounding these requirements has revolved around what that means. What send volume makes you a bulk sender?

Google has placed a 5,000 daily send nametag on bulk senders – purely for the sake of documenting a ballpark for reference – but senders shouldn’t think they can skirt around the requirements by sending 4,999 messages. There is no magic number or final straw that breaks the camel’s back. These requirements are more about sending habits than they are about exact math.

What does one-click unsubscribe mean?

Now that we’ve covered who will be impacted, let’s dive into the actual requirements, starting with one-click unsubscribe. One-click unsubscribe has confused a lot of senders who already include unsubscribe links in the body of their emails. But this requirement isn’t about that, it’s about including unsubscribe headers defined by RFC 8058.

RFC 8058 defines the "Unsubscribe" header field for email messages. This header field provides a standardized way for email clients to display an unsubscribe option to users, allowing them to easily opt-out of receiving future emails from the sender directly from the UI of their mailbox. In other words, the "Unsubscribe" header field defined in RFC 8058 offers a standardized mechanism for facilitating unsubscribes in email messages.

According to Anu Yamunan, if you aren't compliant with the one-click unsubscribe requirement yet, you have until June 2024 before Gmail starts rejecting the traffic.

Why is a 0.3% spam rate threshold being enforced, and what happens if you go over the limit?

First off, a spam rate of 0.3% is generous. By many accounts, keeping your spam complaint rate below 0.1% – 1 email in 1,000 marked as spam– is the mark of a healthy sender.

One of the main goals of these requirements is to make the inbox less spammy. DMARC helps prevent bad actors from stealing and spoofing sender identities, the unsubscribe requirements gives users control to manage the messages they receive with the same ease as it takes to mark a message as spam (saving senders the pain of being spammed), and the low spam threshold is a way to identify and react to senders that empl0y spam tactics.

Remember when we said these requirements weren’t about exact math? Well, that applies to the spam rate requirement also. In our podcast Email’s Not Dead, we sat down with Marcel Becker and he broke down this spam rate requirement a bit more and left us with the mantra, more than a day, less than a year.

Senders who hit a higher spam rate on one campaign won’t automatically be punished for it. Mailbox providers are looking at your average spam complaint rate over an undisclosed period of time, somewhere between a day and a year. If your high spam rate becomes habitual it will impact you, but this requirement isn’t a one and done limit.

Why enforce a DMARC policy when requirements only dictate setting it to "none"

You’ve got to start somewhere. With DMARC the requirement is about enforcing adoption…finally. When DMARC first emerged as an authentication, mailbox providers crossed their fingers and prayed to the deliverability gods that senders would catch on, but that didn’t happen.

DMARC adoption has been slow and according to Sinch Mailgun’s 2023 State of Email Deliverability report, among those using DMARC for authentication, 40% don’t know what their policy is. According to dmarc.org, most active DMARC policies (68.2% as of 2022) are p=none. If your DMARC policy is "p=none" mailbox providers take that as an indication you are focusing on the "R" in DMARC which stands for reporting, but this isn’t the end goal.

Keep calm and Yoogle on

These sender requirements aren’t the end of the world. Not even a little bit. Ultimately, mailbox providers like Gmail and Yahoo are hopeful that implementing these requirements will benefit senders as well as users. But it can be complicated to break these requirements down, understand them, and then bring your unique email program into compliance.

If you want to dive deeper, check out the full-length Fireside Chat with Gmail and Yahoo, and visit our Yoogle resources page for more insights and answers.