Four email rules that decide whether your password resets arrive

In February 2024 Gmail and Yahoo made a set of email rules mandatory, and by late 2025 they were rejecting mail that failed them. If you send anything automated, a welcome sequence, a password reset, an invoice, this decides whether it arrives.

Most founders I know have three of the four in place and are relaxed about the fourth. It doesn't work like that. All four, or you're gambling.

The four

SPF and DKIM both, aligned, with a published DMARC policy, plus one click unsubscribe.

The alignment word is where people come unstuck. It isn't enough for SPF and DKIM to pass. One of them has to pass in a way that matches the domain in the From line. A perfectly valid DKIM signature from your email provider's domain, on a message claiming to be from yours, fails DMARC and is invisible in every test that only checks whether DKIM passed.

The number that decides it

Under 0.1 percent is where you should sit. Google says never above 0.3.

Those look like small numbers until you turn them into people. At 5000 messages a day, 0.3 percent is fifteen complaints. Fifteen people clicking the spam button in one day can degrade delivery for everything you send, including the password resets.

This is why an aggressive email programme is a technical risk rather than just a taste question. The person who marks you as spam because you sent them a fifth onboarding email isn't only unsubscribing. They're spending your delivery budget, and the budget is measured in fractions of a percent.

Who counts as a bulk sender

Google's line is around 5000 messages a day to personal Gmail accounts. Yahoo publishes no number at all and says significant volume.

Two things follow from that and both matter for small products.

You can cross the line without a marketing campaign. Five thousand a day is achievable by a transactional system on a busy week, and the rules apply to the domain, not to the campaign.

And because Yahoo won't say, you can't plan to stay under it. The only sane position is to be compliant regardless of volume, which is fine, because all four requirements are a one afternoon job that then needs no maintenance.

What to actually do this afternoon

Publish a DMARC record even if you do nothing else. A p=none record is a few characters in DNS, breaks nothing, and starts sending you reports about who is sending mail as you. Most people are surprised by those reports.

Check alignment rather than checking pass or fail. Send a message to a Gmail account, open the original, and read the Authentication-Results header. You want dkim=pass with a domain that matches your From address, or spf=pass with the same. If both pass but neither is aligned, you fail DMARC while every tool tells you you're fine.

Put the unsubscribe in the header. The List-Unsubscribe and List-Unsubscribe-Post headers are what the requirement means. Your footer link stays, but it isn't what's being asked for.

Then watch the complaint rate. Google Postmaster Tools is free and it's the only place you can see the number that decides your fate. If you have no view of it, you'll find out you have a problem when a customer says they never received the reset email.

The part people find annoying

None of this improves your product and none of it's interesting. It's plumbing, and it belongs in the same box as backups.

What makes it worth an afternoon is the failure mode. Deliverability doesn't fail loudly. Nothing bounces onto your screen. Your open rates just drift down, some percentage of your password resets go to spam, and a proportion of your customers quietly conclude your product is flaky.

By the time you notice, you're repairing a reputation rather than configuring a record, and that takes months rather than an afternoon.

Sources: Valimail on the Google and Yahoo bulk sender requirements