Over the last couple of years Google, Yahoo, and Microsoft quietly moved their sender requirements from "recommended" to "enforced". In 2026 the penalty for failing them is not the spam folder any more, it can be outright rejection, where the mail arrives nowhere. Here is exactly what the rules are, straight from Google's own documentation, what changed, and what a cold sender specifically has to do.
Two tiers of rules apply. The first applies to every sender. The second adds requirements for bulk senders, defined by Google as anyone sending 5,000 or more messages a day to Gmail addresses. Yahoo publishes near-identical rules, and Microsoft has rolled out matching requirements for high-volume senders to Outlook.com. The through-line is simple: authenticate properly, keep complaints low, and make unsubscribing trivial.
The requirements themselves were published by Google and Yahoo and took effect on 1 February 2024. What changed since is enforcement. For the first year, failing the checks mostly meant degraded placement. Through late 2025 and into 2026, providers tightened the screws: non-compliant mail is increasingly rejected at the door rather than filed in spam. The difference is stark. A message in spam can still be found and rescued; a rejected message never existed as far as the recipient is concerned.
For cold outreach this matters more than for almost any other category, for one blunt reason: cold email generates more spam complaints than anything else, because the recipient did not ask for it. That makes the complaint-rate ceiling the rule you are most likely to hit, and the authentication rules the ones you cannot afford to get subtly wrong.
If you send 5,000 or more messages a day to Gmail addresses, Google adds the following on top of the universal rules:
p=none and still meet the minimum.List-Unsubscribe-Post: List-Unsubscribe=One-Click and List-Unsubscribe: <URL> headers, and you must honour unsubscribes within two days.A single cold sending domain rarely hits 5,000 Gmail messages a day on its own, and inbox-rotation setups spread volume across many mailboxes specifically to stay modest per domain. But do not read the threshold as permission to skip DMARC. Meeting the full bulk-sender bar is the safe baseline for any serious cold program, and it is what our grading treats as a passing configuration.
Authentication is a one-time setup you either have or you do not. The spam complaint rate is a living metric you can blow at any time, and it is the one that quietly kills domains. Google's rule is to keep it under 0.30% in Postmaster Tools, and to aim under 0.10%. That is a ceiling of three complaints per thousand delivered messages, with one per thousand as the target.
The trap is that this is measured per domain, so one careless campaign to a stale or poorly-targeted list can push the whole domain over the line, and then everything you send from it, including your good campaigns, suffers. This is exactly why list quality and warm-up are not separate concerns from compliance: a warmed domain sending to a verified, well-targeted list is how you keep the complaint rate under the number in the first place.
Most of the authentication side of these rules is published in your DNS and can be read back to you directly. Rather than take "we set up SPF and DKIM" on faith, run the sending domain through our warm-up calculator and authentication grader. It reads your live SPF, DKIM, and DMARC, checks that SPF actually evaluates within the limits that break it silently, confirms DMARC is present (including a policy inherited from your root domain), and scores the whole setup A to F. If it grades your domain a C or below, you are not yet meeting the bar Gmail checks, and no amount of careful sending compensates for that.
Grade your live SPF, DKIM, and DMARC against the requirements above, and get a warm-up schedule sized to your domain. No signup.
None of this is Gmail-specific any more. Yahoo announced parallel requirements on the same 2024 timeline, with the same authentication, one-click unsubscribe, and low-complaint-rate expectations. Microsoft followed, applying comparable rules to high-volume senders into Outlook.com and Hotmail addresses. Treating "Gmail's rules" as a Gmail problem is a mistake; the major mailbox providers have converged on the same baseline, and meeting it once broadly satisfies all three.
p=none; consider quarantine or reject for protectionGoogle requires every sender to Gmail to authenticate with SPF or DKIM, keep valid reverse DNS (PTR) records, use a TLS connection, format messages to RFC 5322, and keep the spam complaint rate below 0.30% in Postmaster Tools. Senders of 5,000 or more messages a day to Gmail must additionally set up all three of SPF, DKIM, and DMARC, align the From: domain with SPF or DKIM, and support one-click unsubscribe on marketing and subscribed mail. The DMARC policy can be p=none and still meet the requirement.
The universal requirements apply to every sender, cold email included: authentication, valid reverse DNS, TLS, and a spam rate under 0.30%. The extra bulk-sender requirements formally trigger at 5,000 messages a day to Gmail addresses, which a single cold sending domain rarely reaches on its own. But cold email generates more spam complaints than any other category, so the spam-rate ceiling is the rule cold senders hit first, and meeting the full bulk-sender bar (SPF, DKIM, and DMARC together) is the safe baseline regardless of daily count.
Keep your spam complaint rate, as reported in Google Postmaster Tools, below 0.30%. Google advises aiming below 0.10%. In practical terms 0.30% is three complaints per thousand delivered messages as an absolute ceiling, and 0.10% is one per thousand as the target. A single bad campaign can spike this, and once you cross it, delivery degrades for everything you send from that domain, not just the offending campaign.
The consequence in 2026 is no longer just the spam folder. Providers moved these requirements from recommended to enforced, and mail that fails the checks can be rejected outright rather than delivered to spam, meaning it does not arrive anywhere. Failing authentication or exceeding the spam-rate threshold leads to rate limiting, spam placement, or outright rejection depending on severity, and recovering a domain's reputation after that takes far longer than meeting the rules would have.
Yes, to meet Google's minimum bulk-sender requirement. You must publish a DMARC record, but it can be set to p=none, which monitors without quarantining or rejecting anything. That clears the bar Google checks. It is worth understanding that p=none gives you visibility into authentication failures without enforcement, so many senders move to quarantine or reject over time for actual protection, but that is a security decision, not a deliverability requirement Google imposes.
lemwarm runs the ramp inside a live network of inboxes and keeps engagement signals healthy while you send, in the same account you run sequences from. Start a 14 day free trial.
Start your free trial