# Google's stricter email sender rules (Nov 2025) > Gmail's tighter bulk-sender enforcement began Nov 2025. What changed, who's affected, and the SPF, DKIM, DMARC, and complaint-rate checks to pass now. ## Are Google's stricter sender requirements affecting my delivery? Yes. Gmail began ramping up enforcement of its bulk-sender rules in November 2025, and that enforcement is now in effect. Mail to Gmail addresses that is unauthenticated or otherwise non-compliant is more likely to be deferred or rejected outright — not just filtered to spam. If your delivery to Gmail has slipped since late 2025, this is the first thing to check. ![Screenshot of Gmail's email sender guidelines announcement.](/images/cms/690e3e7fcd0f6b1aa1dd0260_screenshot-2025-11-07-at-12.49.54-pm.png) *Gmail's sender-guidelines enforcement notice.* The requirements themselves aren't new — Google and Yahoo introduced them in February 2024. What changed in November 2025 is enforcement: Google moved from warning non-compliant senders to actively disrupting their mail with temporary and permanent rejections. The [official guidance](https://support.google.com/a/answer/14229414) states that "messages that fail to meet the email sender requirements will experience disruptions, including temporary and permanent rejections." ### Who is affected by the enforcement ramp-up? Bulk senders first. Any organization sending roughly 5,000 or more messages to personal Gmail addresses within 24 hours is squarely in scope: email marketers, CRM platforms, SaaS apps, and large newsletters. But smaller senders aren't exempt — if your mail triggers authentication failures or abuse signals, Gmail can defer or reject it regardless of volume. Crossing 5,000 sends in a day even once can classify your domain as a bulk sender. ## What Gmail now requires The compliance bar for bulk senders has several parts, and the enforcement ramp means each one can now block mail rather than merely count against your reputation: - **Authenticate with [SPF](/learning/what-is-spf) and [DKIM](/learning/what-is-dkim).** Both must be set up for your sending domain. - **Publish [DMARC](/learning/what-is-dmarc).** A policy of at least `p=none` is required for bulk senders, and it must be aligned. - **Pass DMARC alignment.** For direct mail, the domain in the visible `From:` header must align with either the SPF domain or the DKIM domain. - **Have valid forward and reverse DNS.** Sending IPs need matching [PTR records](/learning/what-is-a-ptr-record), and your HELO/EHLO name should resolve correctly. - **Use TLS.** Connections that transmit mail to Gmail must be encrypted with TLS. - **Support one-click unsubscribe.** Marketing and subscribed messages need a working one-click unsubscribe that honors opt-outs within two days, plus a clearly visible unsubscribe link in the body. - **Keep complaints low.** Keep the spam rate reported in Postmaster Tools below **0.10%**, and never let it reach **0.30%** — that upper figure is the level Google explicitly warns senders to avoid. ![Checklist of email authentication and compliance steps senders should complete for Gmail's enforcement.](/images/figures/google-is-making-email-sender-requirements-stricter-star-fig1.webp) *The checks to complete now that Gmail's enforcement is live.* ## What to do now Start with authentication, because it's the fastest way to move from "rejected" back to "delivered." Confirm SPF, DKIM, and DMARC are published and that the `From:` domain aligns with one of the authenticated domains — a message can pass SPF and DKIM individually yet still fail DMARC because neither aligns with what the recipient sees. Verify your sending IPs have valid reverse DNS, that mail is sent over TLS, and that marketing streams carry a functioning one-click unsubscribe. Then watch your numbers. Google's Postmaster Tools now includes a compliance-status dashboard that shows where you stand against each requirement, and your spam-complaint rate is the metric to guard most closely. A single bad campaign that pushes complaints toward 0.30% can undo months of good [deliverability](/learning/what-is-email-deliverability). If mail is already being deferred or rejected, read the SMTP error your logs return and cross-reference it with your [DMARC reports](/resources-post/how-to-understand-dmarc-reports) to find which stream is failing authentication. Fix the failing record, and temporary deferrals often clear on retry once the underlying issue is corrected. ## Why this matters Tighter enforcement cuts down on spoofing and abusive bulk mail, which improves inbox quality for recipients. For legitimate senders, it means that following best practices is now rewarded with more reliable inbox placement — and that neglecting them carries a real delivery penalty rather than a quiet reputation ding. It also aligns Gmail's behavior with Microsoft's own enforcement moves, which tightened over the same period. The industry is converging on a single expectation: authenticated, permission-based email is the baseline, not a nice-to-have. Meeting these requirements is no longer optional for anyone who sends at scale. It all starts with visibility. The [Email Security Score](/tools/email-security-score) shows exactly who is sending on behalf of your domains and whether [SPF, DKIM, and DMARC](/resources-post/what-are-dmarc-dkim-and-spf) pass and align by sender, so you can catch configuration issues before they turn into blocked mail. You can also check enforcement directly with the [DMARC checker](/tools/dmarc). ## Quick takeaways - Gmail's enforcement ramp began November 2025 and is now live. - Unauthenticated mail faces more deferrals and outright rejections, not just spam filtering. - Bulk senders (5,000+ Gmail sends per 24h) are most affected, but failures can block smaller senders too. - Essential checks: SPF, DKIM, aligned DMARC, TLS, valid rDNS/PTR, and one-click unsubscribe. - Keep spam complaints below 0.10% and never reach 0.30%. ## Frequently asked questions ### What should I check first? Start with SPF, DKIM, and DMARC configuration and alignment, then confirm your sending IPs have valid reverse DNS and correct HELO/EHLO settings. Authentication failures are the most common cause of the new rejections. ### What if my mail is deferred or rejected? Look for authentication failures in your mail logs and [DMARC reports](/resources-post/how-to-understand-dmarc-reports), fix the failing records, and monitor retry behavior. Temporary deferrals frequently clear once the underlying record is corrected. ### Can small senders be blocked? Yes. Any sender producing authentication failures or high complaint rates can see delivery problems, regardless of volume. The 5,000-per-day threshold defines who must meet every bulk requirement, not who can be blocked. ### How does this compare to Microsoft's approach? Microsoft tightened enforcement of similar requirements over the same period. Gmail's ramp narrows the gap, so a single authenticated, well-behaved mail stream now satisfies both major providers. ### Where can I get help? Use the [Email Security Score](/tools/email-security-score) to audit DMARC, BIMI, DKIM, and SPF in one pass, or the [DMARC checker](/tools/dmarc) to confirm your policy and alignment.