Deemwar Monads & Abstractions

Two passes, one fail: Gmail and DMARC alignment

Source: New Gmail protections for a safer, less spammy inbox, by Neil Kumaran

A newsletter can have a clean list, pass SPF and pass DKIM at Gmail, and still fail DMARC alignment. Both checks can pass for the sending service's domain while the From: address shows yours. The fix is a DKIM key on your own domain and a DMARC record.

Feb 1 2024 requirements start

>5,000 messages a day to Gmail accounts

2 days to process an unsubscribe

<0.3% spam rate in Postmaster Tools

The rule

On 3 October 2023 Google announced new requirements for bulk senders, "those who send more than 5,000 messages to Gmail addresses in one day". The Email sender guidelines set the start date: "Starting February 1, 2024". A sender over that volume has to:

Set up SPF and DKIM email authentication for the domain.
Set up DMARC for the sending domain. The guidelines say: "Your DMARC enforcement policy can be set to none."
Let recipients unsubscribe from commercial email in one click, and process unsubscribe requests within two days.
Keep the spam rate reported in Postmaster Tools below 0.3%. The guidelines also say to keep it "below 0.10% and avoid ever reaching a spam rate of 0.30% or higher."

The guidelines say they exist to help "prevent Gmail from limiting sending rates, blocking messages, or marking messages as spam."

Alignment

Passing SPF or DKIM is not enough on its own. The guidelines add a condition:

"the domain in the sender's From: header must be aligned with either the SPF domain or the DKIM domain. This is required to pass DMARC alignment."

An illustrative example

The domains below are made up to show the mechanism. Whether a given service signs under its own domain by default depends on the provider.

From:news@yourbrand.example

DKIMpass, signed by sender-service.example

SPFpass, for sender-service.example

DMARC alignmentfail: neither domain matches yourbrand.example

Two passes for the wrong domain still fail alignment.

The fix

Publish a DKIM key on your own domain through the sending service, so mail is signed with a domain that matches your From: address.
Add a DMARC record for the sending domain. A policy of none is allowed, for example v=DMARC1; p=none.
Add both one-click unsubscribe headers the guidelines list.

List-Unsubscribe-Post: List-Unsubscribe=One-Click
List-Unsubscribe: <https://yourbrand.example/unsubscribe/example>

The first line is verbatim from the guidelines; the URL in the second is our illustrative domain.

A quick check

This step is our suggestion, not from Google's pages. Send one test email to a Gmail address and open its headers. Look for dkim=pass with your own domain, not the service's.

Sources

New Gmail protections for a safer, less spammy inbox, Neil Kumaran, Google, 3 October 2023
Email sender guidelines, Google Workspace Admin Help

The volume threshold, dates, unsubscribe window and spam rates come from the two Google pages. The example domains and the header check are ours.