Since February 1, 2024, Google has required more from anyone who sends mail to Gmail addresses. The rules come in two tiers: a short list for every sender, and a longer one for bulk senders. Most people who send cold email one at a time are in the first tier. Here is what each tier says, based on Google's own sender guidelines, and how to check where you stand.

Who counts as a bulk sender

Google defines a bulk sender as someone who sends 5,000 or more messages in a day to personal Gmail accounts. If you send 40 emails a day from your own mailbox, you are well below that, but the first tier still applies to you.

The rules for every sender

  • Set up SPF or DKIM authentication for your sending domain.
  • Have valid forward and reverse DNS records for the sending domain or IP.
  • Use a TLS connection to send mail.
  • Keep your spam rate, as reported in Postmaster Tools, below 0.3 percent. Google's best practice is below 0.1 percent.
  • Format messages according to the Internet Message Format standard (RFC 5322).
  • Do not impersonate Gmail From headers.

The extra rules for bulk senders

  • Set up both SPF and DKIM, and DMARC for the domain. The DMARC policy can be set to none.
  • The domain in the From header must align with the SPF domain or the DKIM domain.
  • Marketing and subscribed messages must support one click unsubscribe, with a visible unsubscribe link in the body.
  • DKIM keys should be 1024 bits or longer for personal Gmail recipients, and Google recommends 2048 bits when your provider supports it.

What this means for a one to one cold sender

You are not a bulk sender, but the first tier and its spirit apply. In practice, that means three things. First, your domain should have SPF, DKIM and DMARC set up; this guide walks through all three. Second, keep your complaint rate low. Sending to people who plainly have no use for you is how that number rises. Third, make it easy to opt out. A line like "Reply stop and I won't write again" costs nothing, and US commercial email also requires an opt out under CAN-SPAM.

How to check your own status

  1. Send a test to a Gmail address and open the message. Choose Show original.
  2. Look for SPF, DKIM and DMARC lines. You want PASS on each.
  3. Add your domain to Google Postmaster Tools to see your spam rate and authentication results. Postmaster Tools may show little data for domains with low volume.

If you see a fail

An SPF fail often means a service sends on your behalf without being listed; see SPF softfail. A DKIM fail is usually a setup step missed; see DKIM fail in Gmail. A DMARC fail means neither aligned; see DMARC fail.

Why this matters even if you are small

Google applies the same filtering ideas to everyone, and the rules describe what its systems look for. A domain with proper authentication, a low complaint rate and clean formatting is treated as a sender worth delivering. A domain with none of that looks like a throwaway. Setting it up takes an afternoon and protects every message you send afterward, which makes it one of the few deliverability tasks with a clear finish line. Do it before you scale volume, not after your first bounce.

Volume is a separate limit

These rules are about authentication and complaints. Gmail also limits how much a single account can send in a day; see daily sending limit exceeded. Staying well under both is the safest plan.

Rocketship sends from your own Gmail at a daily limit that rises over time, with approval an optional setting. Try it for 7 days, card required to begin.