Google and Yahoo sender requirements

What changed in 2024

Google and Yahoo tightened bulk-sender rules. They did not invent authentication, and they did not make warmup optional. They made the ID check mandatory and they started enforcing complaint rates that cold email was already supposed to stay under.

In practice, for anyone sending cold email toward Gmail or Yahoo:

• SPF and DKIM must pass alignment
• DMARC must be present (EmailPal uses p=reject)
• Spam complaint rates must stay tiny (Google has talked about staying under 0.3%, and treating 0.1% as the healthy zone)
• Marketing / bulk mail needs a working unsubscribe, including one-click where the standard applies

EmailPal's job is the authentication and the sending reputation of the mailbox. EmailPal's own sequencer (Engage) warns when the first email has no unsubscribe link (you place it yourself; nothing is added for you), and sets the one-click List-Unsubscribe and List-Unsubscribe-Post headers by default. If you send from another tool, that tool should add its own unsubscribe link and headers and honor unsubscribes. EmailPal does not add headers to that mail unless you turn on the optional workspace setting described below.

Yahoo and AOL sit in the same family of expectations. That is one reason EmailPal warming runs through a network of real inboxes at Yahoo and Outlook as well as Gmail, not only Gmail.

What EmailPal already does

On hosted domains we publish:

• MX so replies can land
• SPF on the apex, v=spf1 include:s1.example.com -all, with the sending IP ranges in a second record at s1.example.com
• DKIM at dated selectors, rsa<YYYYMMDD>._domainkey (RSA-2048) and ed<YYYYMMDD>._domainkey (Ed25519), for example rsa20261007
• DMARC p=reject

The examples here use example.com; copy the exact records shown in your dashboard.

Then we re-verify those records on public resolvers. A green check means Gmail's lookup of your domain will see the same values. How to set up DNS records (MX, SPF, DKIM, DMARC).

Warming runs through a network of real inboxes at Gmail, Outlook and Yahoo, including the two providers those requirements came from. Pre-warmed listings attach the inbox rate measured on that network. Email warming by EmailPal.

Isolated IP pools keep one customer's list from defining another customer's reputation. Isolated IP pools.

What you still have to do

• Verify lists so you are not mailing dead addresses. Bounces and catch-alls are how complaint rates and block rates start. List verification.
• Keep per-mailbox volume modest. Sending limits: 15/day per inbox recommended, 100/day hard cap.
• Put an unsubscribe path in the tool you actually send from. In EmailPal's own sequencer it is built in: the launch check warns if the first email has no unsubscribe link, and the One-click unsubscribe header setting is on by default. In another sequencer, one-click unsubscribe is a header that tool should set. If yours does not, you can turn on the optional header setting in your workspace settings (see the FAQ below).
• Stay off the company .com. Secondary sending domains.
• Do not turn open tracking on for the first mail from a new or newly claimed mailbox. Bot opens are not engagement.

The full checklist: Cold email deliverability guide.

What "bulk sender" means for cold email

Google's threshold has been in the neighborhood of 5,000 messages per day to Gmail. Cold programs often sit under that per domain and still get treated like bulk because the copy, the list and the sudden volume look like bulk.

Do not plan around "we send 4,900 so the rules do not apply." Authenticate anyway. EmailPal will not let you send unauthenticated mail from a hosted domain.

FAQs

Does p=reject satisfy Gmail?

Yes. They asked for a DMARC policy to exist. Reject is stronger than none, and it is what EmailPal ships. Why DMARC is p=reject.

Do I need BIMI?

No. BIMI is a brand logo for high-volume authenticated senders. It is not required for cold email and will not save a burned domain.

Does EmailPal add List-Unsubscribe headers?

Yes, on campaigns you run in EmailPal's own sequencer: it adds List-Unsubscribe and List-Unsubscribe-Post (one-click) while One-click unsubscribe header is on, which is the default. On mail you send through your own SMTP or another sequencer such as Instantly or Smartlead, it is off by default: EmailPal leaves those messages untouched, and those tools own the campaign headers.

It is optional. If your sender does not add its own, open the sequencer's workspace Settings page (/engage/settings) and turn on Add unsubscribe headers to mail sent through your own SMTP or sequencer. With it on, EmailPal adds List-Unsubscribe and List-Unsubscribe-Post to that mail, and the unsubscribe link points at an Emailpal-hosted page. When someone clicks it, their address goes on the Emailpal-wide suppression list, which blocks mail to them from every account on the platform. That opt-out is not sent to your own tool, so your sequencer will not know about it. If your tool already adds its own headers, leave this off. Mail you send through EmailPal's own send API follows what that API documents.

Will a pre-warmed inbox automatically pass Gmail?

It is authenticated and it finished a measured ramp. That is the infrastructure half. A scraped list and a three-link HTML pitch can still land in spam. Staying near 15/day is how you keep the measurement from collapsing; it is not a Gmail SLA.

What about Microsoft?

Microsoft is often harsher on new domains than Gmail. The 2024 headlines were Google and Yahoo. Outlook still wants authentication and still punishes volume spikes. Slow down rather than chasing the worse provider with more volume.

Need more help?

Cold email deliverability guide or open a ticket with the domain and whether you send via SMTP to a sequencer or via our API.