Google and Yahoo sender requirements for cold email

The campaign is ready. The client approved the list. The inboxes are connected. The sender shows green checkmarks.

Then the first batch hits Gmail and Yahoo recipients, and the launch starts producing policy bounces, spam-folder complaints, or unclear sender errors. The agency has to debug authentication, unsubscribe handling, complaint risk, and DNS under pressure.

That is why Google and Yahoo sender requirements belong in the cold email launch gate. They are not a newsletter-only concern. They define the baseline mailbox providers expect before a domain starts sending commercial mail at scale.

If you need the setup reference, read the Google and Yahoo bulk sender requirements guide. If you need a launch-day pass for a client workspace, use this checklist with the cold email pre-launch checklist and the client-ready deliverability report template.

The short version

Google and Yahoo both enforce sender rules around authentication, alignment, complaint control, unsubscribe handling, DNS, and message standards.

For cold email agencies, the practical launch standard is:

Requirement	Cold email launch question	OutboundQA check
SPF	Is the active sender authorized for the domain?	SPF presence, syntax, duplicate records, lookup count, and provider alignment
DKIM	Does every active sender have a resolving selector?	DKIM selector resolution and malformed-key risk
DMARC	Does the domain publish a valid policy?	DMARC presence, syntax, policy, reporting, and alignment notes
Alignment	Does the visible From domain align with SPF or DKIM?	Sender-requirement readiness and report notes
Unsubscribe	Can recipients opt out cleanly when required?	Launch assumption and campaign-type note
Complaint control	Is the first send small enough to avoid complaint spikes?	Launch-risk note and report assumption
Forward and reverse DNS	Does the sending path have valid identity signals?	SMTP egress identity checks when the path is provided
TLS and message format	Is the sending provider using modern transport and valid message format?	Provider and SMTP path evidence when available

Google says all senders to Gmail need SPF or DKIM, while senders over 5,000 messages per day to Gmail accounts need SPF, DKIM, and DMARC. Yahoo lists a similar bulk sender standard, including SPF and DKIM, DMARC with at least p=none, alignment, one-click unsubscribe for marketing mail, complaint rates below 0.3 percent, and valid DNS.

Cold email teams should build to the stricter standard even when each domain sends far less than 5,000 messages per day. The smaller the launch, the less room there is for avoidable complaints and authentication mistakes.

1. Publish SPF for the active sender

SPF tells receiving servers which systems are authorized to send for the domain. For agencies, the risk is rarely “no SPF ever existed.” The risk is that the record authorizes an old sender, has duplicate records, or exceeds the 10 DNS lookup limit after several tools were added.

Check:

• Exactly one SPF TXT record exists.
• The active sending provider is included.
• Stale providers are removed.
• The SPF record stays under 10 DNS lookups.
• The mechanism at the end matches the launch policy.

OutboundQA check: SPF record discovery, duplicate SPF detection, syntax, lookup count, and provider alignment.

Manual tool: run the SPF checker before you approve the domain.

2. Turn on DKIM for every active sender

DKIM signs the message so receivers can verify that the sending domain is tied to the message. It is also a common launch blocker because the selector is specific to the sender and workspace.

Check:

• DKIM is enabled in the sending platform.
• The selector shown in the sender is the selector checked in DNS.
• The public key resolves.
• The key is not malformed, truncated, or pasted into the wrong host.
• Every active sender has its expected selector.

OutboundQA check: DKIM selector resolution, malformed-key risk, and provider-by-provider selector notes.

Manual tool: use the DKIM checker when you know the selector, or the SPF DKIM DMARC checker for a combined authentication pass.

3. Publish DMARC and verify alignment

DMARC is the part agencies often under-check. A domain can have SPF and DKIM and still fail the launch standard if the visible From domain does not align with either authenticated domain.

Check:

• _dmarc exists for the sending domain.
• The policy is valid and intentional.
• p=none is the minimum starting point, not the end state.
• Reporting addresses work if rua is used.
• A real campaign message passes DMARC alignment through SPF or DKIM.

OutboundQA check: DMARC presence, policy, syntax, reporting configuration, and sender-requirement notes.

Manual tool: run the DMARC checker, then confirm alignment with the sending platform’s authentication report or a real message header.

4. Treat one-click unsubscribe as a launch requirement

Google requires one-click unsubscribe for marketing and subscribed messages at the bulk tier. Yahoo requires a functioning list-unsubscribe header for marketing and subscribed messages and says unsubscribe requests should be honored within 2 days.

Cold email often sits in a gray operational zone, especially for B2B outreach. That is a bad reason to ignore the requirement. If the campaign is commercial and recipients can complain, make opt-out handling part of launch QA.

Check:

• The sending platform supports List-Unsubscribe.
• One-click unsubscribe is enabled when required.
• The email body includes a visible unsubscribe or opt-out path.
• Suppression updates happen within 2 days.
• The client knows who owns suppression before launch.

OutboundQA check: campaign-type assumption, unsubscribe-readiness note, and report signoff field.

Example report row:

Requirement	Status	Launch note
One-click unsubscribe	Needs Review	Confirm sender-level headers before first campaign send
Visible opt-out path	Ready	Body copy includes clear opt-out language
Suppression owner	Ready	Ops lead owns suppressions within 2 days

5. Keep complaint risk below the 0.3 percent line

Google and Yahoo both publish a 0.3 percent complaint threshold. That number is small. It means 3 complaints per 1,000 delivered messages.

Cold email teams should treat 0.1 percent as the operating limit because early sends can swing quickly. A 500-recipient test can look fine until two recipients report spam. A new domain with no history has little margin for sloppy targeting.

Check:

• Google Postmaster Tools is set up for the domain when possible.
• Yahoo Complaint Feedback Loop is considered when volume and DKIM setup justify it.
• The first send segment is small.
• Suppressions and bounces are processed quickly.
• The account manager knows the stop condition for complaint spikes.

OutboundQA check: launch-risk note, sender-requirement readiness, and report assumption. OutboundQA does not measure private inbox placement, but it can make the operational complaint controls visible before launch.

6. Verify forward DNS, reverse DNS, and SMTP identity when you control the path

If the client sends through Google Workspace, Microsoft 365, or a major sending platform, the provider usually owns SMTP infrastructure. If the client uses custom SMTP, dedicated IPs, or a mixed sending path, DNS identity needs its own check.

Check:

• Sending IPs have reverse DNS.
• Reverse DNS resolves back through forward DNS.
• HELO or EHLO identity is not a generic cloud hostname.
• The SMTP banner does not contradict the approved sender path.
• IPs are not listed on severe blocklists before launch.

OutboundQA check: SMTP egress identity checks for PTR, forward-confirmed reverse DNS, HELO or EHLO alignment, generic cloud names, live banner identity, and blacklist status when the path is provided.

This matters because Google and Yahoo both expect valid forward and reverse DNS for sending infrastructure. A sender status screen may not show this layer when mail leaves through a custom route.

7. Confirm TLS and message format through the sender

Google lists TLS for transmitting email and valid message format as sender requirements. Agencies usually do not configure these directly in a modern sending platform, but they still need to know who owns the risk.

Check:

• The sending provider supports TLS for outbound mail.
• Custom SMTP paths are not using obsolete or broken transport.
• Message headers are generated by the sending tool without invalid formatting.
• The From domain is not impersonating a Gmail address.
• Commercial and transactional streams are not mixed in the same campaign path.

OutboundQA check: provider and SMTP path assumptions in the report, plus sender-requirement notes when the infrastructure path is known.

Google and Yahoo sender requirements checklist

Use this table before a client campaign goes live.

Area	Launch question	Pass condition	OutboundQA check
SPF	Is the active sender authorized?	One valid SPF record includes the sender and stays under 10 lookups	SPF syntax, duplicates, lookup count, and provider alignment
DKIM	Can receivers verify the sender signature?	Every active selector resolves with a valid public key	DKIM selector resolution and malformed-key risk
DMARC	Does the domain publish a receiver policy?	Valid DMARC exists with at least p=none	DMARC presence, syntax, policy, and reporting
Alignment	Does authentication align with the visible From domain?	SPF or DKIM aligns with the From domain	Sender-requirement readiness notes
Unsubscribe	Can recipients opt out cleanly?	One-click and visible unsubscribe handling are confirmed for campaign type	Launch assumption and report signoff
Complaints	Is complaint risk controlled before first send?	Segment size, suppression owner, and stop condition are documented	Launch-risk note
DNS identity	Does the sending path have valid DNS identity?	PTR, forward DNS, and SMTP identity are valid when path is controlled	SMTP egress identity checks
TLS and format	Does the sender meet transport and message-format expectations?	Provider or SMTP path supports TLS and valid headers	Provider and path evidence
Report	Can the agency prove the result?	Verdict, evidence, owner, and recheck plan are saved	Client-ready report

What this checklist does not prove

This checklist does not prove inbox placement. It does not prove the list is clean, the copy is appropriate, or the sending volume is safe. Google and Yahoo can still filter mail based on recipient behavior, complaints, reputation, content, and many signals a DNS checker cannot see.

It proves something narrower: the launch setup meets the visible sender-requirement baseline and the agency has documented the remaining assumptions before sending starts.

That is the part agencies can control before launch. A missing DKIM selector, absent DMARC record, broken unsubscribe workflow, unowned suppression process, or unmanaged SMTP path should not be discovered after the first batch is already in motion.

Run the SPF DKIM DMARC checker for the authentication pass, use the email deliverability checker for a broader one-domain read, include this row in the cold email pre-launch checklist, and share the sample launch QA report before the client campaign goes live.

Official references

Use the provider pages as the current source of truth before major launches:

• Google email sender guidelines
• Yahoo Sender Requirements and Recommendations