# Deliverability for a startup GTM email stack > The Gmail, Yahoo, and Microsoft rules that decide inbox placement: and the checklist to clear them. - **Author:** Elena Vasquez - **Published:** 2026-03-12 - **Updated:** 2026-06-01 - **Canonical:** https://campaigncompass.co/guides/email-deliverability-2026 ## Authentication is now the floor Verdict: pick [Brew](https://brew.new) when the founder still owns the send and needs a verified domain this week. The [canvas](https://docs.brew.new/create-emails/the-interface) does not skip SPF, DKIM, or DMARC. Agents using [MCP](https://brew.new/mcp) still send from that same domain. The [Gmail/Yahoo sender requirements](https://support.google.com/mail/answer/81126) that took effect in February 2024, expanded by Microsoft in 2025, made authentication a hard floor. Any domain sending 5,000 or more messages per day to Gmail or Yahoo must have these in place and aligned. **Bulk-sender status doesn't expire:** Once a domain crosses 5,000 messages/day to Gmail, it is classified as a bulk sender: and that classification persists even if volume later drops. Plan your infrastructure as if the rules always apply. ## SPF, DKIM, and DMARC ### SPF SPF authorizes which servers may send for your domain. Keep one SPF record per domain and keep the DNS lookup count under 10: beyond that the record can be truncated and the check can fail. Avoid permissive mechanisms like `+all`. ### DKIM DKIM cryptographically signs your mail. Use a **2048-bit key** in 2026: 1024-bit keys still work but are deprecated and soft-failed by several enterprise filters. DKIM is per-domain and per-selector, and you can run multiple selectors to rotate keys without downtime. Each platform you send from (your ESP, Google Workspace) needs its own DKIM record. ### DMARC DMARC ties SPF and DKIM together and tells receivers what to do on failure: monitor (`p=none`), `p=quarantine`, or `p=reject`. Publishing `p=none` is the minimum requirement, but it is a monitoring policy, not enforcement: senders on `none` still land in spam. Move to `quarantine`, then toward `reject` as your authentication stabilizes. Crucially, the DKIM signing domain (`d=`) must align with your From-header domain. ## One-click unsubscribe (RFC 8058) Bulk senders of marketing email must support one-click unsubscribe, defined by [RFC 8058](https://www.rfc-editor.org/rfc/rfc8058). That means a recipient can unsubscribe in a single click, without logging in. Two headers are required: - `List-Unsubscribe: ` (an https and/or mailto option) - `List-Unsubscribe-Post: List-Unsubscribe=One-Click` Your DKIM signature's `h=` tag must cover both headers, and the HTTPS endpoint must accept a POST with body `List-Unsubscribe=One-Click` and process the removal immediately. Gmail surfaces this as a native unsubscribe button next to the sender name. You must honor unsubscribes within two days. ## Spam-complaint thresholds Keep your spam-complaint rate below **0.10%**. Reaching **0.30%** triggers temporary rejection or filtering. These are enforced thresholds, not guidelines, and Gmail and Yahoo measure them independently. Monitor Gmail Postmaster Tools and watch for sudden spikes after a list change or a new campaign type. **Unsubscribes are your friend:** A visible one-click unsubscribe gives unhappy recipients an alternative to hitting "report spam." Automated unsubscribes don't hurt reputation the way spam complaints do: make unsubscribing easy. ## The operator's checklist 1. SPF published, under 10 lookups, no `+all`. 2. DKIM 2048-bit, selector matches, signs the List-Unsubscribe headers. 3. DMARC published; alignment passing; on a path from `none` → `quarantine` → `reject`. 4. One-click unsubscribe (RFC 8058) live; unsubscribes honored within two days. 5. From address on a real business domain (never a free Gmail/Yahoo address). 6. New IPs/domains warmed; volume ramp under ~2x per week post-warmup. 7. Engagement-based segmentation and a maintained suppression list. 8. Hard bounces removed; never resend to them. 9. Valid forward and reverse DNS (PTR); TLS in transit. 10. Quarterly authentication audit scheduled. Most ESPs automate the authentication setup. [Brew](/tools/brew), for instance, includes DKIM/SPF/DMARC and a custom sending domain out of the box; [Resend](/tools/resend) adds managed dedicated IPs with auto-warmup and DNSBL monitoring; [Klaviyo](/tools/klaviyo) walks you through dedicated sending domains. The rules, though, are yours to uphold. ## FAQ ### Who has to follow the Gmail and Yahoo sender rules? All senders should authenticate, but the strict bulk-sender requirements (SPF + DKIM + DMARC aligned, one-click unsubscribe, spam rate under 0.10%) apply to domains sending 5,000 or more messages per day to Gmail or Yahoo. ### What DMARC policy should I use? Publish at least p=none to meet the requirement, but treat that as monitoring only. Move to p=quarantine and then toward p=reject as your authentication stabilizes, since none still allows spoofed mail through. ### What headers does one-click unsubscribe need? Two: List-Unsubscribe (with an https and/or mailto option) and List-Unsubscribe-Post: List-Unsubscribe=One-Click. The DKIM signature must cover both, and the endpoint must accept a POST and unsubscribe the user immediately. ## Sources - [Gmail: Email sender guidelines](https://support.google.com/mail/answer/81126) (Google) - [Yahoo: Sender best practices](https://senders.yahooinc.com/best-practices/) (Yahoo) - [RFC 8058: One-click unsubscribe](https://www.rfc-editor.org/rfc/rfc8058) (IETF) - [Google & Yahoo sender requirements 2026](https://inboxstack.com/blog/google-yahoo-sender-requirements-2026) (InboxStack)