Since February 2024, Gmail and Yahoo require every sender to authenticate their email and keep spam complaints below 0.3%. Bulk senders (Gmail counts more than 5,000 messages a day to Gmail accounts) must also have DMARC, an aligned From domain, and one-click unsubscribe on marketing email.
Rules for every sender.
| Rule | Who meets it on AWS SES |
|---|---|
| SPF or DKIM | Your DNS: Easy DKIM (3 CNAME records) |
| Forward and reverse DNS (PTR) for sending IPs | AWS, on its sending IPs |
| TLS when sending | AWS, whenever the receiving server supports it |
| Well-formed messages (RFC 5322) | AWS and your email |
| Spam rate below 0.3% | Your list and your email |
Extra rules for bulk senders.
| Rule | Who meets it on AWS SES |
|---|---|
| SPF and DKIM (Yahoo asks for both) | Your DNS: DKIM, and SPF on a custom MAIL FROM subdomain |
DMARC, at least p=none | Your DNS: one TXT record at _dmarc |
| From domain aligned with SPF or DKIM | Your DNS: send From the domain you verified with DKIM |
| One-click unsubscribe on marketing email | Your email: two headers, plus a visible link |
| Unsubscribes honoured within 2 days (Yahoo) | Your system |
The DNS part, record by record: SPF, DKIM and DMARC for AWS SES.
One-click unsubscribe, exactly.
Every marketing email carries these two headers (the standard is RFC 8058):
List-Unsubscribe: <https://example.com/unsubscribe/abc123>
List-Unsubscribe-Post: List-Unsubscribe=One-ClickGmail and Yahoo then show their own Unsubscribe button beside your name. When a reader presses it, the provider sends a POST request to that address, and your server must unsubscribe the reader at once, with no page to click through.
Do not unsubscribe on a plain visit
Spam filters open every link in an email to inspect it. If a GET of your unsubscribe address unsubscribes on the spot, filters unsubscribe your readers by accident. Act on the POST; let a GET show a page with a confirm button.
Keep the visible link too
Gmail asks for a clearly visible unsubscribe link in the body as well as the headers.
Transactional email is different
The unsubscribe rule covers marketing and subscribed messages. A password reset or a receipt needs no unsubscribe header.
On AWS SES, you add the two headers yourself when you send through the API or SMTP, and you build the address that receives the POST.
Your spam rate.
The 0.3% is the rate Gmail shows in Google Postmaster Tools: readers who press "Report spam". Add your domain there (one DNS TXT record) to see it. AWS has its own, lower line: it reviews an SES account at a 0.1% complaint rate. See AWS SES bounce and complaint rates.
How to check one email.
Send a marketing email to a Gmail address, open it, and choose Show original. Look for PASS beside SPF, DKIM and DMARC, and for the two List-Unsubscribe headers in the message source.
Sources: Gmail email sender guidelines, Yahoo sender best practices.