The grace period is over. In November 2025, Gmail moved from warnings to active enforcement: mail that fails its sender requirements now gets rejected at the SMTP level with permanent 550 errors — it never reaches the inbox, or even the spam folder. Microsoft rolled out its own requirements for high-volume senders in May 2025 with the same posture.
If your agency sends cold email for clients, this is now the first gate your mail has to pass — before reputation, before copy, before warmup. Here is the checklist.
Who this applies to
Gmail's strictest rules apply to bulk senders: anyone sending 5,000 or more messages per day to personal Gmail accounts, counted across all subdomains of the same primary domain. Microsoft applies similar requirements to senders above 5,000 per day. But the requirements below are the new baseline for everyone — smaller senders who ignore them are filtered harder every month.
The checklist
1. Authentication — all three, aligned
- SPF — publish a record listing every server allowed to send for your domain. For bulk senders, SPF alone is not enough.
- DKIM — sign every message. Both SPF and DKIM are required for bulk senders; this is no longer either/or.
- DMARC — publish a policy of at least p=none, and make sure your From domain aligns with your SPF or DKIM domain. Without alignment, DMARC cannot pass and Gmail rejects the mail.
2. Unsubscribe — one click, honored fast
- Marketing and promotional messages must carry a one-click unsubscribe: the List-Unsubscribe header, not just a footer link.
- Unsubscribe requests must be honored within 48 hours. A weekly batch process is non-compliant.
3. Spam rate — the hard ceiling
- Keep the user-reported spam rate below 0.3% in Google Postmaster Tools. Cross it and you lose mitigation support; stay near 0.1% to be safe.
- Postmaster Tools v2 now shows a binary Compliance Status: pass or fail. The old High/Medium/Low reputation bars are gone.
4. Infrastructure basics
- TLS on all outbound connections.
- Valid reverse DNS (PTR) matching your sending IP and hostname.
- Headers compliant with RFC 5322 — malformed headers now trigger rejections.
What failure looks like
You will see it in your logs, not your open rates: 421 codes are temporary deferrals (fix it and retry), 550 codes are permanent rejections — Gmail refuses the message outright and will not retry. A sudden spike in 5xx errors from Gmail after November 2025 almost always traces back to a failed authentication or compliance check, not content.
The agency problem
Every client domain you send for has to pass this checklist independently. One client with a missing DMARC record or a broken SPF include is their problem — but the bounces, the angry emails, and the churn are yours. Checking each domain by hand across MXToolbox tabs does not scale past a couple of clients.
Check any domain in under a minute
Our pre-send audit runs the compliance-critical checks — SPF, DKIM, DMARC, MX, blacklists, transport security — on any domain, free, with the DNS fixes ready to copy-paste. Run it on every client domain before the next campaign goes out.