Sender reputation in 2026: what the Gmail and Yahoo bulk sender rules mean for you

Sender reputation is the score mailbox providers such as Gmail and Yahoo keep for your sending domain and IP address, built from your bounce rate, spam complaints, authentication, engagement and volume history. Since February 2024, anyone sending 5,000 or more messages a day to those providers must authenticate with SPF, DKIM and DMARC, offer one-click unsubscribe, and keep the reported spam rate under 0.3%, or their mail is throttled or rejected.

What sender reputation actually is

There are two reputations, and they behave differently.

IP reputation attaches to the address your mail leaves from. If you send through an email service provider on shared IPs, you inherit the behaviour of everyone else on them, for better and worse. On a dedicated IP, you own the history entirely, including the slow warm-up at the start.

Domain reputation attaches to the domain in your From address and in your DKIM signature. It follows you across providers and IPs. Switch ESPs and your IP reputation resets; your domain reputation comes with you. This is why Gmail leans on domain reputation and why the bulk sender rules care so much about which domain signs the mail.

Both are built from the same raw signals: how many of your messages bounce, how many recipients mark you as spam, whether you hit spam traps, whether people open and reply or delete without reading, whether your authentication is consistent, and whether your volume is steady or spiky.

The February 2024 rules, one by one

Google and Yahoo published their requirements together and enforce them in the same spirit. They apply in full to bulk senders, defined by Google as roughly 5,000 or more messages a day to Gmail addresses, but several are now expected of every sender.

1. Authenticate with SPF and DKIM. Every message must pass at least one, and bulk senders must pass both.

1. Publish a DMARC record. A policy of p=none is the minimum. It does not block anything, but it declares the domain and turns on reporting.

1. Align the From domain. The domain people see in the From header must match the domain that passed SPF or DKIM. This is DMARC alignment, and it is what stops a stranger sending as you.

1. Keep forward and reverse DNS valid. The sending IP must resolve to a hostname, and that hostname must resolve back to the IP.

1. Send over TLS. Connections to Gmail and Yahoo must be encrypted in transit.

1. Offer one-click unsubscribe. Marketing and subscribed mail must carry the RFC 8058 List-Unsubscribe and List-Unsubscribe-Post headers so the mailbox provider can show an unsubscribe button, and you must honour the request within two days.

1. Keep the spam rate low. Stay under 0.3% in Google Postmaster Tools, and aim for under 0.1%. At 0.3% that is three complaints per thousand delivered messages.

1. Do not impersonate Gmail. Sending with an @gmail.com From address through your own servers fails DMARC and is rejected.

1. Format messages to the standard. Messages must follow RFC 5322: a valid Message-ID, a single From, proper headers.

None of these are exotic. The point of listing them is that any one failure is enough to push mail into spam, and most senders we see fail at least one without knowing it.

How bounces and complaints feed reputation

A hard bounce tells the receiving provider that you tried to mail an address that does not exist. One or two are noise. A pattern of them looks like a purchased list, a scraped list or a list nobody has cleaned in years, which is exactly the profile of a spammer. Providers begin throttling when hard bounces approach 2% of a send, and the damage compounds because throttled mail is delayed, delayed mail is opened less, and low engagement is itself a negative signal.

Spam complaints are the most direct signal there is: a real person said they did not want this. The 0.3% ceiling sounds generous until you see how quickly a stale list reaches it. Addresses that have not heard from you in a year do not remember signing up.

Verification removes the bounce signal almost entirely. Our engine does a real SMTP handshake with the receiving server and shows you the transcript, so you know before you send whether the mailbox exists. Our deliverability page explains how each verdict maps to what the provider would have done. The bounce rate calculator shows what a given bounce rate costs you, and how to reduce email bounce rate covers the fixes.

SPF, DKIM and DMARC in plain words

SPF is a DNS record listing the servers allowed to send mail for your domain. A receiver checks whether the connecting server is on the list.

DKIM is a signature. Your mail server signs each message with a private key, publishes the public key in DNS, and the receiver checks the signature. A valid signature proves the message was not altered and that it was signed by someone holding your key.

DMARC is the policy that ties them together. It tells receivers what to do when a message fails both checks (none, quarantine or reject) and where to send reports about who is sending as your domain. Start at p=none, read the reports for a few weeks, fix anything legitimate that is failing, then move to quarantine and eventually reject.

Run your domain through the SPF and DMARC checker. It reads the live records and tells you what is missing, what is misaligned and whether your DMARC policy is published at all.

Google Postmaster Tools

Postmaster Tools is the only place Gmail shows you how it sees you. Verify your domain with a DNS record and you get: the spam rate per day, domain and IP reputation rated from bad to high, SPF, DKIM and DMARC pass rates, the share of mail sent over TLS, and delivery error categories. The dashboards only populate once you send meaningful volume, so low-volume senders see gaps.

Check it weekly. A reputation that drops from high to medium is recoverable in days; one that sits at bad for a month takes much longer.

A 30-day plan to recover a damaged reputation

Days 1 to 7: stop and audit. Pause all non-essential sending. Check authentication with the SPF and DMARC checker and fix every failing record. Confirm one-click unsubscribe headers are present and unsubscribes are honoured. Export your full list and verify it with the bulk email verifier. Suppress every undeliverable address, every hard bounce and every complaint.

Days 8 to 14: send only to the engaged. Build a segment of verified-deliverable addresses that opened or clicked in the last 90 days. Send to them only, at a fraction of your usual volume, with content worth opening. Watch Postmaster Tools daily.

Days 15 to 21: widen gradually. Add verified-deliverable addresses engaged in the last 180 days. Increase volume by no more than half each send. If spam rate or bounces tick up, hold for a few days before growing again.

Days 22 to 30: return to normal with the routine in place. Resume full sends to verified addresses only, sunset anyone unengaged for a year, and add real-time verification to your forms so the list does not decay back. Our list hygiene checklist is the maintenance schedule from here.

What to do next

Check your domain with the SPF and DMARC checker first; it takes a minute and catches the failures that no amount of list cleaning can fix. Then verify the list you send to most with the bulk email verifier and suppress what comes back undeliverable. A new account includes 100 free credits to start with.