Before that date, authentication was strongly advised. Plenty of senders got away without DMARC, and one-click unsubscribe was a nicety. The advice had been the same for years and enforcement was the missing ingredient.
Google and Yahoo announced aligned requirements and phased them in through 2024. The threshold is 5,000 messages a day to their users, and crossing it once makes you a bulk sender from then on.
The requirements themselves are unremarkable: SPF, DKIM, a DMARC record with at least p=none, alignment between the authenticated domain and the visible From domain, valid forward and reverse DNS, one-click unsubscribe headers, and unsubscribes honored within two days.
The complaint rate ceiling is the part people underestimate. 0.3% sounds generous until you realize it is three spam reports per thousand messages, and Google's own guidance suggests staying under 0.1%.
What actually catches people out
DMARC alignment rather than DMARC itself. Publishing a record is easy. Making SPF or DKIM authenticate your own domain rather than your sending platform's is the work, and it is where most failures sit.
One-click unsubscribe needing two headers. List-Unsubscribe with an HTTPS URL and List-Unsubscribe-Post with the one-click value. A mailto-only header does not satisfy the requirement.
The unsubscribe endpoint having to accept an automated POST with no login and no confirmation page. Pointing the header at your normal unsubscribe landing page fails silently.
Reverse DNS on the sending IP, which is somebody else's to configure and is frequently missing on cloud infrastructure.
Where this argument costs us something
The short version
- Confirm all three mechanisms pass with alignment on a real message rather than trusting your platform's settings page.
- Test your one-click endpoint with an actual POST request.
- Watch complaint rate in Google Postmaster Tools, which is the only place the real number appears.
Questions people ask
Does this apply below 5,000 messages a day?
The formal requirement starts there. The same signals are weighed at any volume, so a smaller sender with no authentication is filtered more rather than rejected outright.
Does Microsoft have the same rules?
Not identical published thresholds, and they weigh the same signals. Microsoft throttles unfamiliar senders aggressively and reacts strongly to complaint rate.