Deliverability checklist: auth and lists

What Gmail and Yahoo ask of senders

Both providers write their rules by sending volume. Google splits them at 5,000 messages a day to Gmail accounts. Yahoo asks more of what it calls bulk senders, and the page we read does not state a daily number for that label, so check Yahoo's page for the current wording before you decide which column you sit in.

The table puts the published requirements side by side. Where a cell says not listed, that means the page we read did not list it for that group, not that it is optional.

SPF, DKIM and DMARC in plain terms

SPF is a list, published in DNS as a TXT record, of the servers allowed to send for your domain. A receiver compares the sending server with that list. The standard says a domain must publish a single SPF record: if a lookup returns more than one record that begins with v=spf1, the result is a permanent error, and a record with a syntax error also stops evaluation with a permanent error.

DKIM adds a cryptographic signature to each message. The signing domain publishes a public key under a selector name, and the standard uses selectors so one domain can hold several keys at once, which makes it possible to rotate a key or let a second system sign. Google says sending to personal Gmail accounts needs a key of 1024 bits or longer and recommends 2048 bits where your domain provider supports it; Yahoo also names 1024 bits as the minimum.

DMARC ties the two together. A DMARC record states a policy for mail that fails both checks (none, quarantine or reject), can ask for aggregate reports with the rua tag, and requires that the domain in the visible From address matches the domain SPF or DKIM authenticated, either exactly (strict) or at the organizational-domain level (relaxed). A policy of none leaves receivers free to take no particular action, which both Google and Yahoo accept as the minimum.

SPF has one limit that catches teams who add tools over time. The standard caps the terms that cause DNS queries (include, a, mx, ptr, exists and redirect) at 10 during one evaluation, and exceeding it returns a permanent error. Terms inside a record that an include pulls in are evaluated too, so a provider's own record uses part of your budget. The table counts a fictional sender, with the number of terms inside each included record assumed so the arithmetic is visible.

Start from a list that can be delivered

Authentication proves who you are. The list decides how people react. Both providers say it plainly: send only to people who want the mail, do not buy addresses, and remove addresses that bounce. Yahoo asks senders to monitor hard and soft bounces and to remove invalid recipients promptly. Google suggests removing people who repeatedly bounce and says to consider unsubscribing recipients who never open or read.

A cold list has no opt-in step, so the hygiene work moves to before the first send. Check that every address is formatted correctly, that the domain accepts mail, and that the mailbox exists, then keep a suppression list so a person who asks to stop, or whose address bounced, is never mailed again.

In ColdMeetings the import step does this for you. Each address is checked for format, duplicates, region, the do-not-contact list, an earlier import and email verification, and you spend a credit only for prospects actually imported. The Professional plan ($495/month) covers sending-domain setup, mailbox setup and the SPF, DKIM and DMARC records described above.

• Verify every address before it enters a sequence, and drop undeliverable results.
• Hold risky or unknown results back instead of mailing them with everyone else.
• Put every bounce, unsubscribe and complaint on a suppression list that applies to all your domains.
• Support one-click unsubscribe with a visible link in the body, and act on requests inside two days, the window Yahoo states.

Raise sending volume slowly

A new domain has no history, and a sudden jump looks like abuse. Google's guidance for senders is to send at a consistent rate, start with a low volume to engaged recipients, increase gradually, and monitor server responses, spam rate and reputation as you go. It warns that suddenly doubling previously sent volume can cause rate limiting or a reputation drop, and says to reduce volume if messages start bouncing or being deferred, then increase slowly again.

That is the only sense in which we use the word warm-up: real messages, to real prospects, at a rising but modest rate. ColdMeetings does not offer mailboxes that email each other, and neither provider's guidance suggests anything of the kind.

Watch the complaint rate yourself

Google publishes two lines for the user-reported spam rate in Postmaster Tools: stay below 0.10% and never reach 0.30%. It calculates the rate daily, and a bulk sender above 0.30% is not eligible for delivery mitigation until the rate stays below 0.30% for 7 consecutive days. Yahoo's rate is calculated on mail delivered to the inbox, and its complaint feedback loop sends you a copy of each complaint so you can act on it.

You can track your own version from the complaints you receive and the messages you know reached an inbox. It will not match the providers' figure, but the trend by day and by mailbox is what tells you where to look. The formula is complaints divided by inbox-delivered messages, times 100.

The checklist

Work through these in order. Each item maps to a rule quoted above.

1. Send from a domain you control, with one SPF record, a DKIM key of 2048 bits where supported, and a DMARC record with a policy of at least none and a reporting address.
2. Make sure the From domain aligns with the SPF or DKIM domain, and that sending IPs have matching forward and reverse DNS.
3. Use TLS, and keep messages formatted to the Internet Message Format standard.
4. Add a List-Unsubscribe header with the one-click POST header (RFC 8058), a DKIM signature that covers both, and a visible link in the body.
5. Verify addresses before sending, suppress bounces and complaints, and never buy a list.
6. Increase volume gradually, and drop back if bounces or deferrals appear.
7. Review complaint rate and bounce rate every day and by mailbox, and act on a change before it compounds.