Make every system that emails as your domain meet Gmail’s sender requirements: SPF or DKIM, PTR, TLS and low spam

Since February 1, 2024, Gmail requires all senders to authenticate with SPF or DKIM, have valid forward and reverse DNS, use TLS and keep spam rates below 0.3%. Bulk senders of over 5,000 messages a day also need SPF, DKIM, DMARC, alignment and one-click unsubscribe.

Source facts

Google’s email sender guidelines say that starting February 1, 2024, all senders to Gmail accounts must set up SPF or DKIM for their sending domains, ensure sending domains or IPs have valid forward and reverse DNS records, also called PTR records, use a TLS connection, and keep spam rates reported in Postmaster Tools below 0.3%. Messages must follow RFC 5322, and senders must not impersonate Gmail From headers.

Senders of more than 5,000 messages per day must set up SPF and DKIM and DMARC, whose enforcement policy can be set to none, and for direct email the From domain must align with either the SPF or DKIM domain. Their marketing and subscribed messages must support one-click unsubscribe and include a clearly visible unsubscribe link.

Messages that aren’t authenticated might be marked as spam or rejected with a 5.7.26 error. Google advises confirming that an email service provider authenticates your domain’s mail with SPF and DKIM, and recommends a 2048-bit DKIM key where the domain provider supports it.

Applicability

Use this for any domain that sends mail to Gmail users, which includes most customer and employee mail. Other mailbox providers publish their own requirements, so treat Gmail’s list as a baseline rather than the full set.

DSE recommendation

DSE recommends inventorying every system that sends email using your domain and confirming each one passes SPF or DKIM before relying on it for alerts or customer mail. Route device and alarm notifications through an authenticated relay or provider instead of letting each device send directly, publish a DMARC record and read its reports, and keep the SPF record within lookup limits as services are added.

Verification

Send a test message from each system to a Gmail account and check the headers for SPF, DKIM and DMARC results, then review DMARC aggregate reports for unknown senders each month. Track spam rate in Postmaster Tools if the domain sends in volume.

Official reference

Gmail Help — Email sender guidelines. Reviewed October 18, 2026.