Gmail and Yahoo sender requirements: what venue marketers need to change
Use this guide to work out whether Gmail and Yahoo treat your venue as a bulk sender, and what to fix first. That means SPF, DKIM and DMARC on your own domain, one-click unsubscribe honoured within two days and spam reports below 0.3%.
Part of the guide topicEmail marketing compliance for venues
Since February 2024, Gmail and Yahoo have required bulk senders to authenticate mail with SPF, DKIM and DMARC. Gmail draws the bulk line at 5,000 messages a day. Bulk senders must also offer one-click unsubscribe, honour opt-outs within two days and keep reported spam below 0.3%. For venues, that means fixing your sending domain and mailing only consented guests.
What are the Gmail and Yahoo sender requirements?
Google and Yahoo announced joint sender rules in October 2023 for anyone emailing their personal mailboxes. Enforcement began in February 2024. One-click unsubscribe became mandatory for Gmail bulk senders from June 2024. The rules split senders into two tiers, and the second tier carries most of the work.
Three terms come up throughout:
- SPF (Sender Policy Framework) is a DNS record that lists the servers allowed to send email for your domain.
- DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each message. It proves the message was not altered and ties it to a sending domain.
- DMARC (Domain-based Message Authentication, Reporting and Conformance) tells mailbox providers what to do when SPF or DKIM fails. It also sends you daily reports on who is sending mail under your name.
The rules every sender must meet
Every venue that emails a gmail.com, googlemail.com or yahoo.com address must meet a baseline, whatever its volume. Google's email sender guidelines set it out:
- Authenticate mail with SPF or DKIM.
- Send from domains and IP addresses with valid forward and reverse DNS records.
- Use a TLS connection, which encrypts the message in transit.
- Keep the spam rate shown in Google Postmaster Tools below 0.3%.
- Never send marketing mail that claims to come from a gmail.com address.
Your sending platform normally handles DNS records for its servers and TLS. Domain authentication and spam rate are yours to manage.
The extra rules for bulk senders
Google defines a bulk sender as one that sends close to 5,000 or more messages to personal Gmail accounts within 24 hours. Mail from the same primary domain counts together, so your subdomains add up. Once you cross the line, Google treats you as a bulk sender permanently. Yahoo applies the same bulk requirements but does not publish a numeric threshold.
Bulk senders must also:
- Authenticate with both SPF and DKIM.
- Publish a DMARC record with a policy of at least p=none, which means "monitor and report" rather than "block".
- Align the domain in the From address with the domain that passes SPF or DKIM.
- Support one-click unsubscribe in marketing messages, as defined in RFC 8058, and include a visible unsubscribe link in the body.
- Process unsubscribe requests within two days.
| Requirement | All senders | Bulk senders (5,000+ a day to Gmail) | What a venue changes |
|---|---|---|---|
| SPF | SPF or DKIM required | SPF and DKIM both required | Add your sending platform to your domain's SPF record |
| DKIM | SPF or DKIM required | Required, signed with your domain | Authenticate your domain inside your sending platform |
| DMARC | Not required | Required, policy at least p=none | Publish a DMARC record with a reporting address |
| From-address alignment | Not required | From domain must match the SPF or DKIM domain | Send from your own domain, never a gmail.com or yahoo.com address |
| One-click unsubscribe | Not required | Required on marketing messages (RFC 8058) | Confirm your platform adds the List-Unsubscribe and List-Unsubscribe-Post headers |
| Unsubscribe processing | No Gmail deadline; GDPR still requires you to stop | Within two days | Sync opt-outs to every system that holds guest data |
| Spam rate | Below 0.3% | Below 0.3%; Google advises below 0.1% | Monitor Postmaster Tools and mail recent visitors first |
| DNS and TLS | Required | Required | Confirm with your sending platform |
Why do the sender requirements matter for a venue?
The outcome at stake is revenue per send. A campaign that lands in spam earns nothing, however good the offer. A Gmail rejection is worse, because the message never arrives. Your repeat-visit programme only works if your email reaches the inbox.
Three features of venue marketing put you closer to the rules than you might expect.
Your list is made of personal addresses
Guests sign in to guest WiFi on their own phones with the address they use every day. A WiFi-captured list therefore leans towards consumer mailbox providers rather than work accounts. Before you change anything, count the gmail.com, googlemail.com, yahoo.com and outlook.com addresses in your list. That share tells you how much of your revenue per send depends on these rules.
Venue sends are spiky
A restaurant group sends one newsletter a month to everyone. A stadium emails every fan on a matchday. A retailer pushes hard on Black Friday. Your daily volume can jump from 2,000 to 30,000 overnight. One spike over 5,000 Gmail messages in 24 hours makes you a bulk sender for good.
Spam reports count; unsubscribes do not
A guest who connected once, 18 months ago, may not recognise your sender name. If they tap "Report spam" instead of "Unsubscribe", that report counts against your 0.3% ceiling. An unsubscribe does not. Every guest who finds leaving easy is a guest who does not report you.
How do the sender requirements work in practice?
Compliance comes down to three jobs: authenticate your domain, make leaving easy and keep complaints low. Each one is measurable.
Authenticate the domain you send from
Start with a domain you own, such as yourvenue.co.uk. An independent café sending its newsletter from a gmail.com address through a marketing platform will fail. Gmail and Yahoo publish DMARC policies on their own domains, so mail that claims to be from them but comes from elsewhere fails authentication.
Next, authenticate your domain inside your sending platform. Most platforms give you DKIM records and a custom return-path record to add to your DNS. This step creates alignment: the domain guests see in the From line matches the domain that passes the checks.
Then publish a DMARC record with p=none and a reporting address. Read the aggregate reports for two to four weeks. They show every service sending as your domain, including the booking system or loyalty app you forgot about. Once every legitimate sender passes, move to p=quarantine and then p=reject. That stops anyone impersonating your venue.
To check a live campaign, send it to a Gmail inbox and open "Show original". Gmail displays a pass or fail for SPF, DKIM and DMARC at the top. Our guide to email deliverability for venues: a compliance checklist covers each record in more depth.
Make unsubscribing a single tap
One-click unsubscribe relies on two message headers defined in RFC 8058: List-Unsubscribe and List-Unsubscribe-Post. When both are present, Gmail and Yahoo can show an unsubscribe option next to your sender name. The guest leaves without visiting a preference page or logging in. You still need a visible unsubscribe link in the email body.
GDPR sets the same expectation from a different angle. Article 7(3) says withdrawing consent must be as easy as giving it. Article 21(3) says that once someone objects to direct marketing, you must stop. In the UK, the Privacy and Electronic Communications Regulations (PECR) also govern marketing email.
The two-day deadline exposes a common gap. If an opt-out lands in your email platform but not in your WiFi or CRM data, the guest can reappear on the list. That can happen at their next visit or your next import. Make sure every opt-out reaches every system that holds guest records.
Keep spam reports under 0.3%
Google Postmaster Tools is free. Verify your domain and it reports your daily spam rate: the share of inboxed messages that recipients mark as spam. It only shows data once your volume to Gmail is high enough.
The arithmetic is unforgiving. If 20,000 of your messages reach Gmail inboxes in a day, 60 spam reports put you at 0.3%. Google advises staying below 0.1%, which is 20 reports.
Four levers keep you under the line:
- Send to recent visitors first. A guest who visited last month recognises you. A guest from two years ago may not.
- Use your venue's name as the sender name. Guests opted in to "The Crown", not to your parent company.
- Match the promise made at opt-in. If the WiFi opt-in mentioned offers and events, send offers and events, not daily newsletters.
- Control frequency during peaks. Christmas is when every venue sends more, and guest patience is shortest.
Worked scenario: a hotel group's monthly newsletter
The figures in both scenarios are illustrative arithmetic, not customer results.
Situation. A group of five hotels holds 60,000 guest addresses captured on guest WiFi. About 24,000 are gmail.com or googlemail.com. The group sends one monthly newsletter to everyone, from hello@hotelgroup.co.uk, through a mainstream marketing platform. Each send exceeds 5,000 Gmail messages, so the group is a bulk sender. "Show original" reveals that DKIM is signed with the platform's domain, not the group's. There is no DMARC record. Each hotel also sends its own offers from a subdomain, and that volume counts towards the same primary domain.
What was done. The marketing team authenticated hotelgroup.co.uk in the platform, adding its DKIM and return-path records. They published one DMARC record at p=none on the primary domain, which also covers the hotel subdomains. They confirmed the List-Unsubscribe-Post header in a test send. Finally, they connected the platform's opt-outs to the guest database so leavers stay suppressed.
Measurable outcome. The result is visible in two places. In "Show original", the newsletter moves from DMARC fail to DMARC pass for SPF, DKIM and DMARC alike. In Postmaster Tools, the team sets a complaint budget: at 24,000 Gmail recipients, 0.1% means fewer than 24 spam reports per send. That figure becomes the KPI reviewed after every campaign, next to revenue per send.
Worked scenario: a shopping centre's Christmas campaign
Situation. A shopping centre has collected 120,000 shopper addresses on guest WiFi over three years. About 48,000 are at Gmail. For Christmas, marketing wants to email all of them. Visit data shows 20,000 of those Gmail shoppers have not connected in 18 months.
What was done. The team modelled the risk before sending. They assumed the dormant group would report spam at 0.6% and active shoppers at 0.05%. That gives 120 reports from the dormant group and 14 from the active group. The total is 134 reports across 48,000 messages, or 0.28%: one bad afternoon from breaching the ceiling. So the team split the list. Shoppers seen in the last 12 months received the Christmas campaign. Dormant shoppers received a short re-permission email in October, sent in daily batches. Anyone who did not open or click was suppressed before the peak.
Measurable outcome. On the same assumptions, the Christmas send to 28,000 active Gmail shoppers produces about 14 reports, or 0.05%. That leaves headroom for every December send that follows. Shoppers who re-confirmed in October rejoin the active segment with fresh consent on record.
Where do the sender requirements fit with the rest of your marketing?
The rules do not judge your email platform. They judge your list and how guests react to it. That moves the hard question upstream, to how you build the list in the first place.
Consent at the point of capture
GDPR Article 4(11) defines consent as freely given, specific, informed and unambiguous. Article 7(1) requires you to show that each person gave it. A guest who ticked an unticked opt-in box at the WiFi login, after seeing what you will send, meets that test. That same guest is far less likely to report you as spam.
This is where Purple differs from Mailchimp, Klaviyo and HubSpot. Those platforms are built to send campaigns to a list you already have. Guest WiFi builds the list for you. Each login can capture a conscious-choice opt-in, so addresses arrive as consented first-party data. In 2024, Purple handled 440 million logins across 80,000+ live venues (Purple's own data). Purple also integrates with CRM and marketing platforms, so you can keep the sender you use today if you prefer.
Segment by visit, not by sign-up date
A WiFi-built list carries visit data alongside the address. You can see who came in last week, who visits monthly and who has not returned since summer. That lets you mail recent visitors first, the single most effective lever on spam rate. The Purple Engage product overview shows how visit-based segments feed campaigns. Visit data also underpins loyalty: see building a restaurant loyalty program on email and WiFi.
Decide what to change first
| Your situation | Your status | Change first | How to check |
|---|---|---|---|
| Independent venue sending from a gmail.com or yahoo.com address | Fails DMARC at Gmail and Yahoo at any volume | Move to a domain you own and authenticate it | Gmail "Show original" shows DMARC pass |
| Single site, under 5,000 Gmail messages a day | All-sender rules apply | SPF or DKIM on your domain, spam rate under 0.3% | Platform reports and Postmaster Tools |
| Group sending one newsletter to the whole list | Bulk sender, permanently | DKIM on your domain, DMARC at p=none, one-click unsubscribe | DMARC aggregate reports |
| Brand with a subdomain per venue | Volume counts at the primary domain | One DMARC record on the primary domain covering subdomains | DMARC reports list every subdomain |
| Reactivating addresses older than 12 months | Highest spam-report risk | Re-permission campaign before any peak send | Postmaster Tools spam rate per day |
| Sending booking confirmations and receipts | Authentication rules apply | Separate transactional mail from marketing mail | Headers checked on a test send |
What are the limits of the rules?
The requirements set a floor, not a guarantee. Keep these boundaries in mind:
- Compliance does not buy inbox placement. Gmail and Yahoo still filter on engagement and content. A compliant campaign nobody opens can still drift to spam.
- Only personal accounts count. Gmail's 5,000 threshold counts personal Gmail addresses, not Google Workspace business accounts.
- Bulk status does not expire. Once you cross the line, the bulk rules apply to every send that follows, including quiet months.
- Transactional mail is partly exempt. Google does not require one-click unsubscribe on transactional messages such as booking confirmations. Authentication still applies.
- Gmail compliance is not GDPR compliance. Passing DMARC says nothing about your lawful basis for sending. Consent records and opt-out handling are separate obligations.
- Microsoft has followed. In 2025, Microsoft introduced comparable SPF, DKIM and DMARC requirements for domains sending over 5,000 messages a day to Outlook.com, Hotmail.com and Live.com addresses.
What should you do next?
Work through these six steps in order. Most venues complete the first four in a week.
- Count your exposure. Find the share of your guest list at Gmail, Yahoo and Outlook, and your peak daily volume to each.
- Send from your own domain. Retire any gmail.com or yahoo.com sender address.
- Authenticate and align. Add SPF and DKIM for your sending platform, then publish DMARC at p=none with a reporting address.
- Confirm one-click unsubscribe. Check for the List-Unsubscribe and List-Unsubscribe-Post headers, and make sure opt-outs reach every guest database within two days.
- Register for Postmaster Tools. Set a complaint budget of 0.1% for each campaign and review it with revenue per send.
- Fix the list at source. Segment by last visit, re-permission dormant guests and capture new addresses with conscious-choice opt-ins on guest WiFi.
For the full record-by-record checklist, see email deliverability for venues: a compliance checklist.
Frequently asked questions
Do the Gmail and Yahoo sender requirements apply to a single restaurant?
Yes, the baseline rules apply to every sender, whatever its size. You need SPF or DKIM, valid DNS records, a TLS connection and a spam rate below 0.3%. The stricter bulk rules, including DMARC and one-click unsubscribe, start once you send close to 5,000 messages to Gmail in 24 hours. A single newsletter to a large WiFi-captured list can cross that line, so check your peak day.
Can I keep using Mailchimp, Klaviyo or HubSpot with WiFi-captured guest data?
Yes. Purple integrates with CRM and marketing platforms, so guest data captured on WiFi can flow into the sender you use today. The Gmail and Yahoo rules apply to whichever platform sends the email. Authentication sits on your own domain, so you set up SPF, DKIM and DMARC once for each platform that sends as your venue.
Are guests who opted in at the WiFi login valid under GDPR consent rules?
Yes, provided the opt-in was a conscious choice. GDPR Article 4(11) requires consent to be freely given, specific, informed and unambiguous. In practice, that means an unticked box, clear wording about what you will send and a separate choice from accepting the network terms. Article 7(1) also requires you to show each guest's consent, so keep those records.
What happens if our spam rate goes above 0.3%?
Gmail and Yahoo are more likely to filter or reject your mail, and recovery takes time. Google's guidance says senders above 0.3% are not eligible for mitigation of their delivery problems until the rate falls. Pause sends to older segments, mail only recent visitors and check that unsubscribing takes one tap. Then watch Postmaster Tools daily until the rate holds below 0.1%.
Do we need a dedicated IP address to meet the requirements?
No. Neither Gmail nor Yahoo requires a dedicated IP address. The requirements focus on your sending domain: authentication, alignment, one-click unsubscribe and spam rate. Most venues send from their platform's shared infrastructure without issue. A dedicated IP only makes sense at high, steady volume, because it needs consistent sending to build and keep a reputation.
Does one-click unsubscribe apply to booking confirmations and receipts?
No. Google does not require one-click unsubscribe on transactional messages such as booking confirmations, receipts or password resets. Authentication still applies to them. Never add promotional content to a transactional message to avoid the rule, because that turns it into marketing mail. Many venues send transactional mail from a separate subdomain, which keeps the two streams cleanly apart.
How much does it cost to become compliant?
Usually nothing beyond staff time. SPF, DKIM and DMARC are DNS records you publish through your domain registrar at no extra charge. Google Postmaster Tools is free. Most venues need a few hours to publish the records, plus two to four weeks of DMARC reports. The main cost comes from list clean-up, because suppressing dormant guests reduces send volume.