--- title: "Deliverability checklist: auth and lists" url: "https://coldmeetings.com/blog/email-deliverability-guide.md" canonical_url: "https://coldmeetings.com/blog/email-deliverability-guide" last_updated: "2026-10-20" type: "guide" summary: "What Gmail and Yahoo ask of senders, how SPF, DKIM and DMARC fit together, and a clean-list routine, with a worked SPF and complaint-rate example." related: ["https://coldmeetings.com/blog/cold-emails-going-to-spam.md", "https://coldmeetings.com/blog/how-to-verify-email-address.md", "https://coldmeetings.com/blog/cold-email-metrics.md"] --- # Deliverability checklist: auth and lists > **For AI agents:** the complete index of ColdMeetings pages is [llms.txt](https://coldmeetings.com/llms.txt). Every page is also served as markdown at its URL plus .md. What Gmail and Yahoo ask of senders, how SPF, DKIM and DMARC fit together, and a clean-list routine, with a worked SPF and complaint-rate example. Deliverability is the share of your email that reaches an inbox instead of a spam folder or a rejection. For cold email it comes down to two things you control: whether the receiving server can prove the message really came from your domain, and whether the people on your list are real, reachable and unlikely to press the spam button. This guide sticks to those two. It reads the published rules from Google and Yahoo and the standards behind SPF, DKIM, DMARC and one-click unsubscribe, then gives you a worked SPF count and a complaint-rate table you can copy into a spreadsheet. Every outside fact is dated and linked at the bottom. ## What Gmail and Yahoo ask of senders Both providers write their rules by sending volume. Google splits them at 5,000 messages a day to Gmail accounts. Yahoo asks more of what it calls bulk senders, and the page we read does not state a daily number for that label, so check Yahoo's page for the current wording before you decide which column you sit in. The table puts the published requirements side by side. Where a cell says not listed, that means the page we read did not list it for that group, not that it is optional. Published sender requirements, read 2026-10-19 | Requirement | Gmail, all senders | Gmail, more than 5,000 a day | Yahoo, all senders | Yahoo, bulk senders | | --- | --- | --- | --- | --- | | SPF and DKIM | SPF or DKIM | SPF and DKIM | SPF or DKIM at a minimum | SPF and DKIM | | DMARC | Not listed | Required, and the policy can be none | Not listed | Valid policy of at least none, and DMARC must pass | | Alignment | Not listed | From domain aligned with the SPF domain or the DKIM domain | Not listed | From domain aligned with the SPF domain or the DKIM domain; relaxed is acceptable | | Spam rate | Below 0.3% in Postmaster Tools | Below 0.30% in Postmaster Tools | Below 0.3% | Below 0.3%, calculated on mail delivered to the inbox | | Reverse DNS | Valid forward and reverse DNS | Valid forward and reverse DNS | Valid forward and reverse DNS | Valid forward and reverse DNS | | One-click unsubscribe | Not listed | Marketing and subscribed messages, plus a visible link in the body | Not listed | List-Unsubscribe header with one-click support, a visible link, and requests honored within 2 days | | TLS | Required | Required | Not listed | Not listed | ## SPF, DKIM and DMARC in plain terms SPF is a list, published in DNS as a TXT record, of the servers allowed to send for your domain. A receiver compares the sending server with that list. The standard says a domain must publish a single SPF record: if a lookup returns more than one record that begins with v=spf1, the result is a permanent error, and a record with a syntax error also stops evaluation with a permanent error. DKIM adds a cryptographic signature to each message. The signing domain publishes a public key under a selector name, and the standard uses selectors so one domain can hold several keys at once, which makes it possible to rotate a key or let a second system sign. Google says sending to personal Gmail accounts needs a key of 1024 bits or longer and recommends 2048 bits where your domain provider supports it; Yahoo also names 1024 bits as the minimum. DMARC ties the two together. A DMARC record states a policy for mail that fails both checks (none, quarantine or reject), can ask for aggregate reports with the rua tag, and requires that the domain in the visible From address matches the domain SPF or DKIM authenticated, either exactly (strict) or at the organizational-domain level (relaxed). A policy of none leaves receivers free to take no particular action, which both Google and Yahoo accept as the minimum. SPF has one limit that catches teams who add tools over time. The standard caps the terms that cause DNS queries (include, a, mx, ptr, exists and redirect) at 10 during one evaluation, and exceeding it returns a permanent error. Terms inside a record that an include pulls in are evaluated too, so a provider's own record uses part of your budget. The table counts a fictional sender, with the number of terms inside each included record assumed so the arithmetic is visible. SPF query budget for a fictional sender (limit 10); the terms inside each include are assumptions for the example | SPF term | Query used by the term | Assumed inside the include | Counts toward the limit | | --- | --- | --- | --- | | include:_spf.sendhost-a.example | 1 | 2 | 3 | | include:_spf.crm-b.example | 1 | 3 | 4 | | mx | 1 | 0 | 1 | | a | 1 | 0 | 1 | | ip4:203.0.113.0/24 | 0 | 0 | 0 | | -all | 0 | 0 | 0 | | include:_spf.survey-c.example | 1 | 1 | 2 | | Total before adding the last include | | | 9 of 10, within the limit | | Total after adding the last include | | | 11 of 10, permerror | ## Start from a list that can be delivered Authentication proves who you are. The list decides how people react. Both providers say it plainly: send only to people who want the mail, do not buy addresses, and remove addresses that bounce. Yahoo asks senders to monitor hard and soft bounces and to remove invalid recipients promptly. Google suggests removing people who repeatedly bounce and says to consider unsubscribing recipients who never open or read. A cold list has no opt-in step, so the hygiene work moves to before the first send. Check that every address is formatted correctly, that the domain accepts mail, and that the mailbox exists, then keep a suppression list so a person who asks to stop, or whose address bounced, is never mailed again. In ColdMeetings the import step does this for you. Each address is checked for format, duplicates, region, the do-not-contact list, an earlier import and email verification, and you spend a credit only for prospects actually imported. The Professional plan ($495/month) covers sending-domain setup, mailbox setup and the SPF, DKIM and DMARC records described above. - Verify every address before it enters a sequence, and drop undeliverable results. - Hold risky or unknown results back instead of mailing them with everyone else. - Put every bounce, unsubscribe and complaint on a suppression list that applies to all your domains. - Support one-click unsubscribe with a visible link in the body, and act on requests inside two days, the window Yahoo states. ## Raise sending volume slowly A new domain has no history, and a sudden jump looks like abuse. Google's guidance for senders is to send at a consistent rate, start with a low volume to engaged recipients, increase gradually, and monitor server responses, spam rate and reputation as you go. It warns that suddenly doubling previously sent volume can cause rate limiting or a reputation drop, and says to reduce volume if messages start bouncing or being deferred, then increase slowly again. That is the only sense in which we use the word warm-up: real messages, to real prospects, at a rising but modest rate. ColdMeetings does not offer mailboxes that email each other, and neither provider's guidance suggests anything of the kind. ## Watch the complaint rate yourself Google publishes two lines for the user-reported spam rate in Postmaster Tools: stay below 0.10% and never reach 0.30%. It calculates the rate daily, and a bulk sender above 0.30% is not eligible for delivery mitigation until the rate stays below 0.30% for 7 consecutive days. Yahoo's rate is calculated on mail delivered to the inbox, and its complaint feedback loop sends you a copy of each complaint so you can act on it. You can track your own version from the complaints you receive and the messages you know reached an inbox. It will not match the providers' figure, but the trend by day and by mailbox is what tells you where to look. The formula is complaints divided by inbox-delivered messages, times 100. Complaint rate by day for a fictional sender, checked against Google's 0.10% and 0.30% lines | Day | Delivered to inbox | Complaints | Complaint rate | Against Google lines | | --- | --- | --- | --- | --- | | Monday | 800 | 0 | 0% | at or below 0.10% | | Tuesday | 900 | 1 | 0.11% | above 0.10% | | Wednesday | 850 | 3 | 0.35% | at or above 0.30% | | Thursday | 1,000 | 2 | 0.2% | above 0.10% | | Friday | 950 | 4 | 0.42% | at or above 0.30% | | Week | 4,500 | 10 | 0.22% | above 0.10% | ## The checklist Work through these in order. Each item maps to a rule quoted above. 1. Send from a domain you control, with one SPF record, a DKIM key of 2048 bits where supported, and a DMARC record with a policy of at least none and a reporting address. 2. Make sure the From domain aligns with the SPF or DKIM domain, and that sending IPs have matching forward and reverse DNS. 3. Use TLS, and keep messages formatted to the Internet Message Format standard. 4. Add a List-Unsubscribe header with the one-click POST header (RFC 8058), a DKIM signature that covers both, and a visible link in the body. 5. Verify addresses before sending, suppress bounces and complaints, and never buy a list. 6. Increase volume gradually, and drop back if bounces or deferrals appear. 7. Review complaint rate and bounce rate every day and by mailbox, and act on a change before it compounds. ## Questions ### Do I need DMARC if I send fewer than 5,000 emails a day? Google lists DMARC as a requirement for senders above 5,000 messages a day to Gmail, and its policy can be set to none. Below that line it still recommends SPF, DKIM and DMARC for every domain. Yahoo requires a published policy of at least none from bulk senders. ### What does the one-click unsubscribe header look like? RFC 8058 says the message carries one List-Unsubscribe header containing an HTTPS address and one List-Unsubscribe-Post header with the single value List-Unsubscribe=One-Click, and that a DKIM signature must cover both headers. The request to that address must work without cookies or a login. ### Does a low open rate mean my email is in spam? Not necessarily. Google says it does not track open rates, cannot verify the accuracy of open rates reported by third parties, and that low open rates are not an accurate indicator of spam classification on their own. ## Where to go next - [Domains and inboxes](https://coldmeetings.com/product/domains-and-inboxes.md) - [Safe sending](https://coldmeetings.com/product/safe-sending.md) - [SPF](https://coldmeetings.com/glossary/spf.md) - [DKIM](https://coldmeetings.com/glossary/dkim.md) - [DMARC](https://coldmeetings.com/glossary/dmarc.md) - [Sender reputation](https://coldmeetings.com/glossary/sender-reputation.md) ## Sources - [Google, Email sender guidelines](https://support.google.com/a/answer/81126), read 2026-10-19 - [Google, Email sender guidelines FAQ](https://support.google.com/a/answer/14229414), read 2026-10-19 - [Yahoo, Sender requirements and recommendations](https://senders.yahooinc.com/best-practices/), read 2026-10-19 - [RFC 7208, Sender Policy Framework (SPF)](https://www.rfc-editor.org/rfc/rfc7208), read 2026-10-19 - [RFC 6376, DomainKeys Identified Mail (DKIM) Signatures](https://www.rfc-editor.org/rfc/rfc6376), read 2026-10-19 - [RFC 7489, DMARC](https://www.rfc-editor.org/rfc/rfc7489), read 2026-10-19 - [RFC 8058, Signaling One-Click Functionality for List Email Headers](https://www.rfc-editor.org/rfc/rfc8058), read 2026-10-19 ## Related - [Cold emails landing in spam: find the cause](https://coldmeetings.com/blog/cold-emails-going-to-spam.md) - [How to verify an email before you send](https://coldmeetings.com/blog/how-to-verify-email-address.md) - [Cold email metrics: formulas and tables](https://coldmeetings.com/blog/cold-email-metrics.md)