Since February 1, 2024, Gmail requires all senders to authenticate with SPF or DKIM, have valid forward and reverse DNS, use TLS and keep spam rates below 0.3%. Bulk senders of over 5,000 messages a day also need SPF, DKIM, DMARC, alignment and one-click unsubscribe.
\nGoogle’s email sender guidelines say that starting February 1, 2024, all senders to Gmail accounts must set up SPF or DKIM for their sending domains, ensure sending domains or IPs have valid forward and reverse DNS records, also called PTR records, use a TLS connection, and keep spam rates reported in Postmaster Tools below 0.3%. Messages must follow RFC 5322, and senders must not impersonate Gmail From headers.
\nSenders of more than 5,000 messages per day must set up SPF and DKIM and DMARC, whose enforcement policy can be set to none, and for direct email the From domain must align with either the SPF or DKIM domain. Their marketing and subscribed messages must support one-click unsubscribe and include a clearly visible unsubscribe link.
\nMessages that aren’t authenticated might be marked as spam or rejected with a 5.7.26 error. Google advises confirming that an email service provider authenticates your domain’s mail with SPF and DKIM, and recommends a 2048-bit DKIM key where the domain provider supports it.
\nUse this for any domain that sends mail to Gmail users, which includes most customer and employee mail. Other mailbox providers publish their own requirements, so treat Gmail’s list as a baseline rather than the full set.
\nDSE recommends inventorying every system that sends email using your domain and confirming each one passes SPF or DKIM before relying on it for alerts or customer mail. Route device and alarm notifications through an authenticated relay or provider instead of letting each device send directly, publish a DMARC record and read its reports, and keep the SPF record within lookup limits as services are added.
\nSend a test message from each system to a Gmail account and check the headers for SPF, DKIM and DMARC results, then review DMARC aggregate reports for unknown senders each month. Track spam rate in Postmaster Tools if the domain sends in volume.
\nGmail Help — Email sender guidelines. Reviewed October 18, 2026.
", "content_text": "Since February 1, 2024, Gmail requires all senders to authenticate with SPF or DKIM, have valid forward and reverse DNS, use TLS and keep spam rates below 0.3%. Bulk senders of over 5,000 messages a day also need SPF, DKIM, DMARC, alignment and one-click unsubscribe.\nSource facts\nGoogle’s email sender guidelines say that starting February 1, 2024, all senders to Gmail accounts must set up SPF or DKIM for their sending domains, ensure sending domains or IPs have valid forward and reverse DNS records, also called PTR records, use a TLS connection, and keep spam rates reported in Postmaster Tools below 0.3%. Messages must follow RFC 5322, and senders must not impersonate Gmail From headers.\nSenders of more than 5,000 messages per day must set up SPF and DKIM and DMARC, whose enforcement policy can be set to none, and for direct email the From domain must align with either the SPF or DKIM domain. Their marketing and subscribed messages must support one-click unsubscribe and include a clearly visible unsubscribe link.\nMessages that aren’t authenticated might be marked as spam or rejected with a 5.7.26 error. Google advises confirming that an email service provider authenticates your domain’s mail with SPF and DKIM, and recommends a 2048-bit DKIM key where the domain provider supports it.\nApplicability\nUse this for any domain that sends mail to Gmail users, which includes most customer and employee mail. Other mailbox providers publish their own requirements, so treat Gmail’s list as a baseline rather than the full set.\nDSE recommendation\nDSE recommends inventorying every system that sends email using your domain and confirming each one passes SPF or DKIM before relying on it for alerts or customer mail. Route device and alarm notifications through an authenticated relay or provider instead of letting each device send directly, publish a DMARC record and read its reports, and keep the SPF record within lookup limits as services are added.\nVerification\nSend a test message from each system to a Gmail account and check the headers for SPF, DKIM and DMARC results, then review DMARC aggregate reports for unknown senders each month. Track spam rate in Postmaster Tools if the domain sends in volume.\nOfficial reference\nGmail Help — Email sender guidelines. Reviewed October 18, 2026.", "content_markdown": "Since February 1, 2024, Gmail requires all senders to authenticate with SPF or DKIM, have valid forward and reverse DNS, use TLS and keep spam rates below 0.3%. Bulk senders of over 5,000 messages a day also need SPF, DKIM, DMARC, alignment and one-click unsubscribe.\n\n## Source facts\n\nGoogle’s [email sender guidelines](https://support.google.com/a/answer/81126?hl=en) say that starting February 1, 2024, all senders to Gmail accounts must set up SPF or DKIM for their sending domains, ensure sending domains or IPs have valid forward and reverse DNS records, also called PTR records, use a TLS connection, and keep spam rates reported in Postmaster Tools below 0.3%. Messages must follow RFC 5322, and senders must not impersonate Gmail From headers.\n\nSenders of more than 5,000 messages per day must set up SPF and DKIM and DMARC, whose enforcement policy can be set to none, and for direct email the From domain must align with either the SPF or DKIM domain. Their marketing and subscribed messages must support one-click unsubscribe and include a clearly visible unsubscribe link.\n\nMessages that aren’t authenticated might be marked as spam or rejected with a 5.7.26 error. Google advises confirming that an email service provider authenticates your domain’s mail with SPF and DKIM, and recommends a 2048-bit DKIM key where the domain provider supports it.\n\n## Applicability\n\nUse this for any domain that sends mail to Gmail users, which includes most customer and employee mail. Other mailbox providers publish their own requirements, so treat Gmail’s list as a baseline rather than the full set.\n\n## DSE recommendation\n\nDSE recommends inventorying every system that sends email using your domain and confirming each one passes SPF or DKIM before relying on it for alerts or customer mail. Route device and alarm notifications through an authenticated relay or provider instead of letting each device send directly, publish a DMARC record and read its reports, and keep the SPF record within lookup limits as services are added.\n\n## Verification\n\nSend a test message from each system to a Gmail account and check the headers for SPF, DKIM and DMARC results, then review DMARC aggregate reports for unknown senders each month. Track spam rate in Postmaster Tools if the domain sends in volume.\n\n## Official reference\n\n[Gmail Help — Email sender guidelines](https://support.google.com/a/answer/81126?hl=en). Reviewed October 18, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/gmail-sender-requirements-spf-dkim-dmarc-device-alert-email/", "url": "https://update.dsesecurity.com/updates/gmail-sender-requirements-spf-dkim-dmarc-device-alert-email/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-18" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/gmail-sender-requirements-spf-dkim-dmarc-device-alert-email/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Make every system that emails as your domain meet Gmail’s sender requirements: SPF or DKIM, PTR, TLS and low spam", "item": "https://update.dsesecurity.com/updates/gmail-sender-requirements-spf-dkim-dmarc-device-alert-email/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/gmail-sender-requirements-spf-dkim-dmarc-device-alert-email/#article", "identifier": "https://update.dsesecurity.com/updates/gmail-sender-requirements-spf-dkim-dmarc-device-alert-email/", "url": "https://update.dsesecurity.com/updates/gmail-sender-requirements-spf-dkim-dmarc-device-alert-email/", "headline": "Make every system that emails as your domain meet Gmail’s sender requirements: SPF or DKIM, PTR, TLS and low spam", "description": "Since February 1, 2024, Gmail requires all senders to authenticate with SPF or DKIM, have valid forward and reverse DNS, use TLS and keep spam rates…", "abstract": "Since February 1, 2024, Gmail requires all senders to authenticate with SPF or DKIM, have valid forward and reverse DNS, use TLS and keep spam rates below 0.3%. Bulk senders of over 5,000 messages a day also need SPF, DKIM, DMARC, alignment and one-click unsubscribe.", "articleBody": "Since February 1, 2024, Gmail requires all senders to authenticate with SPF or DKIM, have valid forward and reverse DNS, use TLS and keep spam rates below 0.3%. Bulk senders of over 5,000 messages a day also need SPF, DKIM, DMARC, alignment and one-click unsubscribe.\nSource facts\nGoogle’s email sender guidelines say that starting February 1, 2024, all senders to Gmail accounts must set up SPF or DKIM for their sending domains, ensure sending domains or IPs have valid forward and reverse DNS records, also called PTR records, use a TLS connection, and keep spam rates reported in Postmaster Tools below 0.3%. Messages must follow RFC 5322, and senders must not impersonate Gmail From headers.\nSenders of more than 5,000 messages per day must set up SPF and DKIM and DMARC, whose enforcement policy can be set to none, and for direct email the From domain must align with either the SPF or DKIM domain. Their marketing and subscribed messages must support one-click unsubscribe and include a clearly visible unsubscribe link.\nMessages that aren’t authenticated might be marked as spam or rejected with a 5.7.26 error. Google advises confirming that an email service provider authenticates your domain’s mail with SPF and DKIM, and recommends a 2048-bit DKIM key where the domain provider supports it.\nApplicability\nUse this for any domain that sends mail to Gmail users, which includes most customer and employee mail. Other mailbox providers publish their own requirements, so treat Gmail’s list as a baseline rather than the full set.\nDSE recommendation\nDSE recommends inventorying every system that sends email using your domain and confirming each one passes SPF or DKIM before relying on it for alerts or customer mail. Route device and alarm notifications through an authenticated relay or provider instead of letting each device send directly, publish a DMARC record and read its reports, and keep the SPF record within lookup limits as services are added.\nVerification\nSend a test message from each system to a Gmail account and check the headers for SPF, DKIM and DMARC results, then review DMARC aggregate reports for unknown senders each month. Track spam rate in Postmaster Tools if the domain sends in volume.\nOfficial reference\nGmail Help — Email sender guidelines. Reviewed October 18, 2026.", "datePublished": "2026-10-18T21:00:55+00:00", "dateModified": "2026-10-18T22:22:07+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/gmail-sender-requirements-spf-dkim-dmarc-device-alert-email/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/gmail-sender-requirements-spf-dkim-dmarc-device-alert-email/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Make every system that emails as your domain meet Gmail’s sender requirements: SPF or DKIM, PTR, TLS and low spam" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Checklist", "Advisory priority" ], "genre": "Checklist", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 367, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Gmail Help — Email sender guidelines", "url": "https://support.google.com/a/answer/81126?hl=en" } } ] } }