The New Gmail / Apple Mail Deliverability Rules

Google tightened sender auth again in March. Here's the SPF/DKIM/DMARC checklist, the exact record values, and a free deliverability score generator.

Gmail and Apple Mail tightened the screws. Here's what actually changed.

Google's November 2025 enforcement pushed Gmail beyond "soft fails" into permanent rejections. Apple's iOS 18 updates buried your brand emails in the Promotions tab. If you've been coasting on SPF alone, crossing your fingers about DMARC, or skipping BIMI entirely. Your inbox rates just got worse.

The authentication landscape shifted hard in 2024–2026. Google's February 2024 bulk sender requirements (demanding SPF + DKIM + DMARC for anyone hitting 5,000+ Gmail recipients per day) were the appetizer. November 2025 brought the main course: Gmail moved from temporary 421 rejection codes to permanent 550 codes for non-compliant traffic. Apple added iOS inbox tabbing that shoves almost everything into Promotions unless it's a receipt. Meanwhile, Yahoo, Microsoft, and Apple all enforced similar rules in May 2025.

You can't ignore this anymore. Here's what changed, how to audit your setup in five minutes, and the exact DNS records you need.

The 5-Minute Audit (Do This Now)

If you send any volume of email, newsletters, transactional, cold outreach, run this checklist. If you can't answer "yes" to all five, you have work to do.

SPF and DKIM are both published and aligned. Check your DNS. Both must exist; SPF alone fails Gmail's November 2025 enforcement. DKIM's signing domain must align with your From header.

DMARC record exists with at least `p=none`. You must have a DMARC DNS record. p=none is the minimum; p=quarantine or p=reject are enforcement policies. Gmail requires at least `p=none` to pass.

Spam complaint rate is under 0.3%. Gmail measures this as actual "Report Spam" clicks, not spam folder landing. Pull this from your mail provider's feedback loops or bounce logs.

List-Unsubscribe headers are signed in DKIM. Marketing mail needs the List-Unsubscribe header (the visible link) and the List-Unsubscribe-Post header (the one-click POST endpoint). Both must be included in your DKIM signature.

You're publishing a BIMI record (optional but valuable). BIMI shows your logo in Gmail's inbox if you have DMARC enforcement + a Verified Mark Certificate (VMC) or Common Mark Certificate (CMC). CMCs are new in 2025 and don't require a trademark.

If you nailed all five: your inbox placement won't crater on Gmail or Apple Mail. If you missed even one: your deliverability is already compromised.

What Google Actually Changed (and Why It Matters)

Before November 2025: Temporary failures gave you a pass.

Gmail accepted mail that failed SPF or DKIM, then moved it to spam or deferred it with a 421 error (temporary rejection). Senders could ignore it or fix it later.

After November 2025: Permanent rejections hit hard.

Gmail now returns permanent 550 rejection codes for non-compliant bulk mail. Your messages bounce back to your sender immediately. No spam folder, no second chance.

The specific rules that tightened:

1. Both SPF and DKIM are now required. Not "SPF or DKIM", both. Before, some senders could get away with just SPF. As of November 2025, Gmail requires SPF and DKIM for any sender hitting 5,000+ messages per day to Gmail addresses.

2. DMARC enforcement moved to baseline. Gmail's minimum DMARC requirement is now `p=none` (reporting-only), but enforcement policies (`p=quarantine` or `p=reject`) are strongly recommended. Compliance checkers and deliverability platforms now treat p=none as the bare minimum; p=quarantine is the industry standard for serious senders.

3. One-click unsubscribe became non-negotiable. Marketing mail must include both the `List-Unsubscribe` header (the visible unsubscribe link) and the `List-Unsubscribe-Post` header (RFC 8058, the one-click POST endpoint). Both headers must be signed in your DKIM signature. No login screen, no confirmation modal, just one POST request and you're unsubscribed.

4. Spam complaint rate enforced at 0.3%. Gmail measures spam complaints as the percentage of recipients who explicitly click "Report Spam," not how many land in the spam folder. If more than 0.3% of your recipients report your mail as spam, Gmail degrades deliverability.

Apple Mail's Own Brand of Hell

Gmail's rules are strict. Apple's are weird.

iOS 18 Inbox Tabbing

Apple's iOS 18.2 and 18.3 updates introduced inbox tabs: Primary, Transactions, Updates, and Promotions. Your marketing emails go to Promotions by default. Your transactional mail (receipts, confirmations) stay in Primary.

The hidden catch: preview text changed. Apple now shows the subject line of an older email or generates a summary via AI instead of your preview text. Subject lines that worked two months ago may not match the preview Apple renders, confusing users.

Mail Privacy Protection (MPP) Tanks Open Rates

Mail Privacy Protection, introduced in 2021, lets Apple Mail users hide when they open an email. Open rates dropped from 48.69% in 2022 to 26.9% in 2025. That's not a bug; it's a feature. Your open rates won't recover. Measure engagement differently: clicks, replies, conversions.

WebKit Rendering Breaks Complex HTML

Apple Mail uses WebKit (the Safari engine). Microsoft Outlook uses its own engine. Nested tables, complex floats, and certain CSS properties that work in Gmail often break in Apple Mail. Test your templates in both Apple Mail and Gmail before sending. Simple wins: inline CSS, avoid CSS Grid, test image fallbacks.

Deliverability Rate: 66% (Worse Than Gmail)

Apple Mail subscribers show a 66% average deliverability rate compared to 86% across Gmail, Outlook, and Yahoo. This isn't your fault (usually). Apple's filtering is aggressive, and its Mail Privacy Protection reduces visibility into bounce patterns. Focus on list quality: clean imports, monitor complaints, remove inactive subscribers quickly.

The Exact DNS Records You Need

Stop guessing. Here's what to publish. Replace example values with your domain and mail provider's instructions.

1. SPF Record (TXT)

v=spf1 include:sendgrid.net include:mailchimp.com ~all

Key rules:

Use include: to list your mail provider(s).
End with ~all (softfail, not -all fail). Softfail lets DKIM and DMARC do their job even if SPF fails.
Keep it under 10 DNS lookups total to avoid hitting the lookup limit.
Test with MXToolbox SPF lookup to see if you're at the limit.

For multiple senders:

v=spf1 include:mailgun.org include:sendgrid.net include:mailchimp.com ~all

2. DKIM Record (TXT)

Ask your mail provider for the selector and public key. They'll give you something like:

selector1._domainkey.yourdomain.com: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC...

Publish exactly what they provide. Different mail providers use different selectors (selector1, default, s1, etc.). Some require multiple DKIM records if you're sending from multiple platforms.

To verify it's published:

MXToolbox DKIM lookup: Search selector1._domainkey.yourdomain.com.
Check that the public key matches what your mail provider shows.

3. DMARC Record (TXT)

Start with p=none (reporting only), move to p=quarantine after a few weeks of clean reports, eventually p=reject.

Minimum DMARC (reporting only):

v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]

Recommended DMARC (enforcement):

v=DMARC1; p=quarantine; pct=100; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1; adkim=s; aspf=s

Field breakdown:

v=DMARC1: Always this.
p=quarantine: Quarantine (spam folder) emails that fail alignment. Use p=reject only after 30+ days of clean reports.
pct=100: Apply the policy to 100% of mail. Start at pct=25 if you're nervous, scale up.
rua=mailto:: Weekly aggregate reports (which IPs authenticated, which failed).
ruf=mailto:: Forensic reports (detailed failures). Can be spammy; optional but useful.
fo=1: Generate forensics on any alignment failure (both SPF and DKIM).
adkim=s: Require DKIM to be in strict alignment (domain in signature header must exactly match From header).
aspf=s: Require SPF to be in strict alignment (MAIL FROM domain must exactly match From header).

Publish at `_dmarc.yourdomain.com` (TXT record).

4. BIMI Record (Optional, But Adds Credibility)

BIMI shows your logo next to your email in Gmail (with a blue checkmark if you have a VMC). You need:

A valid DMARC record with p=quarantine or p=reject (enforcement).
An SVG Tiny PS logo (1:1 square, under 32 KB).
A Verified Mark Certificate (VMC) if you have a registered trademark, or a Common Mark Certificate (CMC) if you can prove your logo has been publicly used for 12+ months.

Gmail accepts both VMC and CMC as of 2025; CMC doesn't require a trademark.

BIMI record (TXT):

v=BIMI1; l=https://yourdomain.com/.well-known/bimi.svg; a=https://www.yourdomain.com/.well-known/vmc.pem

l=: URL to your logo (must be HTTPS, SVG Tiny PS, under 32 KB).
a=: URL to your certificate (VMC or CMC).

Publish at `default._bimi.yourdomain.com` (TXT record).

The Headers You Need for Marketing Mail

Every marketing email must include these headers:

List-Unsubscribe: <https://yourdomain.com/unsubscribe?token=abc123>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

Critical detail: Both headers must be included in your DKIM signature. If your mail provider doesn't sign these headers, ask them to. Many still don't, which means Gmail treats you as non-compliant.

The HTTPS endpoint you provide must:

Accept POST requests.
Process the unsubscribe immediately (no login, no confirmation).
Return a 200 OK response.

Example flow:

Gmail POSTs to: https://yourdomain.com/unsubscribe?token=abc123
Body: List-Unsubscribe=One-Click
Your server marks that token as unsubscribed in the database.
Return 200 OK.

Free Tools to Test Your Setup

Tool	What It Checks	Free Tier	Why Use It
MXToolbox	SPF, DKIM, DMARC records; blacklist status; DMARC report parser	Yes (limited reports)	Fast DNS validation, identifies misconfigurations, parses DMARC XML reports. Essential first stop.
Google Admin Toolbox	MX, SPF, DKIM, DMARC lookup	Yes, unlimited	Google's own checker. Most authoritative for Gmail rules.
Mail Tester	Sends test email, scores SPF/DKIM/DMARC alignment	Yes, 5 tests/day	Simple UI, generates a score (10 is perfect). Good for quick baseline.
250ok	Inbox placement test (seeds across ISPs)	Paid only	Gold standard for inbox vs. spam folder results. Worth paying for if sending volume justifies it.
DMARCIAN	DMARC report parsing, policy suggestions	Paid, free trial	Best DMARC report analyzer. Automates the "what do these aggregate reports mean?" question.
GlockApps	Detailed inbox placement, rendering tests	Paid, free trial	Tests rendering in actual clients (Gmail, Outlook, Apple Mail), not just code validation.

The workflow: Use MXToolbox first (5 minutes, free). Then send a test with Mail Tester (2 minutes). If you're sending at scale, invest in 250ok or GlockApps to see actual inbox placement across ISPs.

The Timeline: What You Need to Do Now vs. Later

Right now (this week):

Run the 5-minute audit above. If you fail any check, stop.
Check SPF and DKIM are both published and passing MXToolbox.
Publish DMARC with p=none if you don't have it yet.
Enable List-Unsubscribe headers on all marketing mail.

Next 2–4 weeks:

Collect DMARC aggregate reports. Use DMARCIAN or your mail provider's interface to review them.
Fix any SPF/DKIM failures in the reports (add missing mail providers, fix alignment issues).
Shift DMARC to p=quarantine once you have 7+ days of clean reports.

1–3 months:

Reach p=reject policy if you can sustain clean reports.
Set up CMC or VMC for BIMI (show your logo in Gmail).
Audit your subscriber list: remove hard bounces, old inactives, high-complaint addresses.

Ongoing:

Monitor DMARC reports weekly. Use MXToolbox DMARC analyzer to spot failures.
Keep spam complaint rate under 0.3%. This requires list hygiene (removing inactive users, respecting engagement patterns).
Update email templates to work in Apple Mail (avoid complex CSS, test in WebKit).

One More Thing: iOS Inbox Tabbing Doesn't Care About Your Authentication

You can nail every DNS record and still land in Apple Mail's Promotions tab on iOS. That tab is algorithmic, not rule-based. Send content that looks transactional (receipts, shipping confirmations, account alerts) and it stays in Primary. Send promotional mail and it goes to Promotions.

The workaround isn't better authentication. It's sending mail that Apple's algorithm classifies as personal or transactional. For newsletters and campaigns, that's impossible. Own the Promotions tab instead: clean design, fast mobile rendering, clear subject lines that stand out in a crowded inbox.

The New Gmail / Apple Mail Deliverability Rules (and the 5-Minute Audit Your List Needs)