tmailrDeliverability
The bulk sender rules, summarised
9 July 2026 · 2 min read · TMailr
In early 2024 Gmail and Yahoo published requirements for anyone sending them serious volume. They were not new ideas, they were existing good practice with a date attached, and they moved a large amount of mail from tolerated to refused.
What they ask for
- SPF and DKIM, both set up.
- DMARC published, at least at p=none.
- Alignment: the domain that authenticates has to match the domain in the From: header.
- One-click unsubscribe on promotional mail, meaning List-Unsubscribe with List-Unsubscribe-Post, honoured within two days.
- Spam complaints kept under 0.3%, and ideally nearer 0.1%.
- Valid forward and reverse DNS on the sending IP, and TLS for the connection.
The threshold is around five thousand messages a day to one of those providers, and it is better read as a floor than a target. Everything on that list is worth doing at any volume.
The two that catch people
Alignment, because SPF and DKIM can both pass for a domain that is not the one in the From: line. If your platform sends with its own bounce address and signs with its own key, you have two passes and no alignment, and DMARC fails. The fix is to authenticate on a subdomain of your own domain rather than on theirs.
And the complaint rate, because it is not a number you can fix on the day it goes wrong. It reflects who is on your list and whether they wanted to be. Buying a list, importing an old one, or making unsubscribing hard all show up here, weeks later, as a deliverability problem that no amount of DNS will fix.
One-click means one click
List-Unsubscribe on its own is not enough. Without List-Unsubscribe-Post the client cannot unsubscribe on the reader’s behalf, so it falls back to opening your page, which is exactly the friction the requirement exists to remove.
List-Unsubscribe: <https://example.com/u/abc>, <mailto:u@example.com> List-Unsubscribe-Post: List-Unsubscribe=One-Click
And honour it. A provider that sees continued mail to somebody who unsubscribed through their interface treats it as worse than a complaint.
How to check before it is a problem
Send yourself one message and read the headers on arrival. Authentication-Results tells you what a real receiver concluded, which is worth more than your configuration. Confirm the domain that passed matches the From: domain, and confirm both unsubscribe headers are present on anything promotional.
Then publish DMARC with a reporting address and read the reports for a month. They name every source sending as you, which is the only reliable way to find the one that has been failing alignment since 2019.
More on deliverability
