Contents
- Why Gmail delivery deserves its own guide
- The Gmail bulk sender requirements in 2026
- The spam rate thresholds
- Permanent rejections and Postmaster Tools v2
- Configuring the gmail.com domain block
- The authentication PowerMTA must get right
- One-click unsubscribe for marketing mail
- Monitoring Gmail delivery
- When Gmail delivery degrades
Why Gmail delivery deserves its own guide
Gmail is, for most senders, the single largest destination, and it is also the receiver with the most clearly defined and most strictly enforced sender requirements. Getting Gmail delivery right is therefore disproportionately important: a sender doing well with Gmail is reaching a large share of their audience, and a sender struggling with Gmail has a large problem. Gmail's requirements are also, conveniently, a good template for good sending generally, meeting Gmail's bar tends to mean meeting most receivers' bars.
This guide exists to bring together what a PowerMTA operator needs for reliable Gmail delivery in 2026, both the Gmail-side requirements and the PowerMTA-side configuration. The structure of this guide: why Gmail deserves focused attention, the Gmail bulk sender requirements as they stand in 2026, the spam rate thresholds and why the working ceiling is well below the enforcement threshold, the move to permanent rejections and Postmaster Tools v2, configuring the PowerMTA gmail.com domain block, the authentication PowerMTA must get right, one-click unsubscribe for marketing mail, monitoring Gmail delivery, and the diagnostic workflow when Gmail delivery degrades.
The Gmail bulk sender requirements in 2026
Gmail's bulk sender requirements, in force since 2024 and progressively enforced since, apply to senders of roughly 5,000 or more messages per day to Gmail consumer accounts. For such a sender, the requirements are mandatory.
The core requirements:
| Requirement | What it means |
|---|---|
| Authentication | SPF and DKIM set up, and DMARC with passing alignment |
| Spam rate | User-reported spam rate kept low, below the thresholds |
| One-click unsubscribe | RFC 8058 one-click for marketing mail, processed within 48 hours |
| Honest headers | No impersonation of Gmail From headers; valid, consistent message formatting |
| Visible unsubscribe | A clearly visible unsubscribe link in marketing message bodies |
These requirements are not new, and they are not exotic, they are essentially the practices a careful legitimate sender already follows. What changed with the bulk sender rules is that they became mandatory and enforced, rather than recommended.
For a PowerMTA operator, meeting these requirements is partly PowerMTA configuration, the authentication PowerMTA performs, the headers it produces, and partly sending practice, the list quality and engagement that keep the spam rate low. The rest of this guide covers both sides.
The spam rate thresholds
The user-reported spam rate, the rate at which Gmail recipients mark the sender's mail as spam, is the metric at the center of Gmail deliverability, and its thresholds deserve careful understanding.
| Spam rate | Status |
|---|---|
| 0.30% and above | Enforcement threshold; ineligible for mitigation |
| Above 0.10% | Already harming inbox delivery (graduated impact) |
| 0.10% | The working ceiling to manage against |
| 0.08% and below | A safe operating target with a buffer |
0.30 percent is the hard enforcement threshold. A sender whose spam rate reaches or exceeds 0.30 percent becomes ineligible for Gmail's delivery mitigation, and stays ineligible until the rate stays below 0.30 percent for seven consecutive days. This is the formal enforcement line.
But 0.10 percent is the real working ceiling. Gmail's guidance is explicit that spam rates above 0.10 percent already harm inbox delivery for bulk senders, and the harm is graduated, it gets worse as the rate rises toward 0.30. So a sender sitting between 0.10 and 0.30 percent is not safely compliant; they are already suffering degraded delivery and are dangerously close to the enforcement threshold.
The common and costly mistake is to treat 0.30 percent as the number to stay under, reasoning that anything below it is fine. It is not. By the time a sender's spam rate is approaching 0.30 percent, their delivery is already significantly degraded and they are one bad campaign from tripping enforcement. The number to manage against is 0.10 percent, and a sensible operating target with a safety buffer is 0.08 percent or below, fewer than one complaint per 1,250 messages. A sender should watch the spam rate in Postmaster Tools continuously and act on an upward trend well before it approaches even 0.10 percent, not wait for the 0.30 percent emergency.
The spam rate is driven by list quality and engagement: mailing people who want the mail produces few complaints; mailing poorly-sourced lists or over-mailing produces complaints. Keeping the spam rate low is fundamentally a list-and-engagement discipline, and it is the single most important factor in Gmail deliverability.
Permanent rejections and Postmaster Tools v2
Two developments have hardened Gmail's enforcement, and a PowerMTA operator should understand both.
Enforcement moved to permanent rejections. Gmail's enforcement began gently, non-compliant mail got temporary 4xx deferrals, delayed but eventually delivered. Gmail escalated, and the enforcement moved to permanent 5xx rejections for mail that fails authentication or comes from senders tripping the spam-rate threshold. A permanent 5xx rejection means the message hard-bounces, no retry, the mail is lost. The early enforcement gave a non-compliant sender a delayed-but-delivered outcome; the current enforcement gives them a hard bounce. This is the concrete reason the requirements are not optional, the cost of non-compliance is now rejected, lost mail.
Postmaster Tools v2. Google retired the legacy Postmaster Tools dashboard and launched Postmaster Tools v2. The old High/Medium/Low domain reputation scores are gone, replaced by a Compliance Status view that shows, in effect, whether the sender is meeting the bulk sender requirements. A PowerMTA operator sending meaningful Gmail volume should be registered in Postmaster Tools and should treat any non-compliant indicator in the Compliance Status as an urgent problem. Postmaster Tools is also where the spam rate is visible, calculated and updated daily.
The combined picture: Gmail enforcement is now hard, non-compliance causes permanent rejection, and Postmaster Tools v2 is the operator's window into their compliance and spam rate. Registering in Postmaster Tools and watching the Compliance Status and spam rate is not optional for a serious Gmail sender.
Configuring the gmail.com domain block
On the PowerMTA side, Gmail delivery involves the gmail.com domain block. The block tunes the throttling and routing for Gmail.
<domain gmail.com>
max-msg-rate 12000/h
max-smtp-out 20
max-conn-rate 20/m
virtual-mta gmail-pool
</domain>The domain block sets the message rate cap, the connection limits, and the VMTA or pool assignment. Gmail tolerates substantial volume from a sender with good reputation, so the gmail.com block can carry a reasonable rate, but the specific number is reputation-dependent and should be tuned from observation: start at a sensible rate, watch the accounting log for 421 deferrals and throttle responses, and adjust, lower if Gmail throttles, higher if Gmail accepts smoothly and the queues drain.
Note that the Gmail family includes googlemail.com, and the Gmail family domains should be collapsed onto the gmail.com block with queue-to so the throttling applies to the combined Gmail stream.
An operator can tune the gmail.com domain block carefully and still have poor Gmail delivery, because the domain block throttling is not what decides whether Gmail accepts the mail. Gmail decides how much mail to accept from a sender based on that sender's reputation, the spam rate, the authentication, the engagement, the history. The domain block's job is to keep PowerMTA's sending pace within what Gmail's current acceptance allows, not to push a high number. A well-configured gmail.com block is necessary but not sufficient: it works only alongside meeting the bulk sender requirements and maintaining the low spam rate that actually drives whether Gmail accepts the mail.
The authentication PowerMTA must get right
Authentication is a hard Gmail requirement, and the parts of it that PowerMTA performs must be correct.
SPF. SPF authorizes the sending IPs to send for the domain. SPF is a DNS record, not a PowerMTA setting, but PowerMTA must send from IPs that the SPF record authorizes. The operator ensures the SPF record covers the PowerMTA sending IPs.
DKIM. DKIM signing is PowerMTA's job, performed through the domain-key directive on the VMTAs. PowerMTA must sign the mail with a valid DKIM signature, and the public key must be published in DNS. The DKIM signing must also use the sender's own domain so it aligns, see below.
DMARC and alignment. DMARC is a DNS record, required at minimum p=none for bulk senders, and it requires alignment: the mail must pass SPF or DKIM in a way that aligns with the From domain. The practitioner recommendation is DKIM alignment, which means PowerMTA's DKIM signing must use the sender's own domain as the d= value, matching the From header, so DKIM aligns and satisfies DMARC.
The PowerMTA-side authentication tasks, then, are: send from SPF-authorized IPs, DKIM-sign with a valid key whose public counterpart is in DNS, and DKIM-sign with the sender's own domain so the signature aligns with the From header for DMARC. Get these right, alongside the DNS records the operator publishes, and the authentication requirement is met. Gmail's permanent-rejection enforcement applies to authentication failures, so this is not a place for partial setups, an authentication gap means rejected mail.
One-click unsubscribe for marketing mail
For marketing and promotional mail, Gmail requires RFC 8058 one-click unsubscribe, and the unsubscribe must be processed within 48 hours.
One-click unsubscribe requires two headers, List-Unsubscribe carrying an HTTPS URL and List-Unsubscribe-Post carrying the exact value List-Unsubscribe=One-Click, both DKIM-signed, with an endpoint that completes the opt-out on a POST. Gmail surfaces this as a native unsubscribe button, giving recipients an easy alternative to the Report Spam button, which matters because spam reports drive the spam rate while one-click unsubscribes do not.
The key scoping point: one-click unsubscribe is required for marketing and promotional mail, not transactional mail. A password reset or a receipt does not need one-click headers, and the headers should not be added to transactional mail.
For a PowerMTA deployment, the one-click headers are configured on the marketing streams, must be covered by the DKIM signature, and must point at a working unsubscribe endpoint, with the unsubscribe flowing through to suppression within the 48-hour window. A correct one-click implementation reduces spam complaints by giving recipients the easy unsubscribe, which directly helps the spam rate, the central Gmail metric.
Monitoring Gmail delivery
Gmail delivery should be monitored continuously, through two complementary windows.
Google Postmaster Tools. Postmaster Tools v2 is the Gmail-side view: the spam rate, the Compliance Status, the authentication results, the domain and IP data Gmail exposes. A serious Gmail sender registers their domain in Postmaster Tools and watches it. The spam rate trend is the most important thing to watch, an upward trend is an early warning to act on before it approaches the thresholds.
The PowerMTA accounting log. The accounting log is the sender-side view of Gmail delivery: the delivery rate to gmail.com, the deferrals and their codes, the bounce rate. Monitoring the accounting log for the Gmail delivery rate and the rate of 421 deferrals from Gmail catches a developing problem, a rising 421 rate from Gmail is an early sign of a reputation issue.
The two windows together give a complete picture. Postmaster Tools shows what Gmail thinks of the sender; the accounting log shows what is happening to the mail. A problem usually shows in both, the spam rate rising in Postmaster Tools, the 421 deferrals rising in the accounting log, and watching both means catching the problem early from whichever window shows it first.
When Gmail delivery degrades
When Gmail delivery degrades, the diagnostic workflow:
Step 1: check the spam rate in Postmaster Tools. The spam rate is the first thing to check. A rate above 0.10 percent, and certainly approaching 0.30 percent, is the likely cause and explains degraded delivery.
Step 2: check the Compliance Status. Postmaster Tools v2's Compliance Status shows whether the sender is meeting the bulk sender requirements. A non-compliant indicator points directly at what to fix.
Step 3: check authentication. Confirm SPF, DKIM, and DMARC with alignment are all passing for the Gmail mail. An authentication failure causes rejection. Verify a test message's authentication results.
Step 4: read the accounting log for Gmail. Check the deferrals and rejections from gmail.com. 421 deferrals indicate throttling; 550 rejections indicate a hard problem, authentication failure or the spam-rate enforcement.
Step 5: identify the cause from the signals. A high spam rate points at list quality and engagement. An authentication failure points at the SPF, DKIM, or DMARC setup. A non-compliant Compliance Status points at whichever requirement is unmet. 550 rejections with authentication passing point at the spam-rate enforcement.
Step 6: address the cause. For a spam-rate problem, the fix is list quality and engagement, clean the list, improve targeting, reduce over-mailing, and the spam rate recovers slowly. For an authentication problem, fix the SPF, DKIM, or DMARC setup. For a one-click compliance gap, implement one-click correctly.
Step 7: reduce volume while recovering. While the cause is being addressed, especially a spam-rate or reputation problem, reduce the Gmail volume so the sender is not pushing into the degraded state.
Step 8: monitor the recovery. Watch the spam rate and the Compliance Status in Postmaster Tools, and the delivery rate in the accounting log, as the recovery progresses. A spam-rate recovery is slow, the seven-consecutive-days requirement for mitigation eligibility means at least a week.
An operator we worked with was struggling with Gmail delivery. Their mail to Gmail was increasingly landing in spam, and they were convinced the problem was in their PowerMTA configuration. They spent considerable effort on the gmail.com domain block, adjusting the max-msg-rate, tuning the connection limits, experimenting with the throttling, trying to find the configuration that would restore their Gmail inbox placement. Nothing they did to the domain block made any difference, the mail kept landing in spam. We suggested they look at Google Postmaster Tools, which they had registered for but rarely checked. The picture there was immediate and clear. Their user-reported spam rate was sitting at around 0.18 percent. That is below the 0.30 percent hard enforcement threshold, so they were not formally in enforcement trouble, but it is well above the 0.10 percent working ceiling, and at 0.18 percent their inbox delivery was already significantly degraded, exactly the graduated impact Gmail's guidance describes. The Compliance Status confirmed they were not in a healthy state. The cause of the spam rate was not in PowerMTA at all: it was their list. They had been mailing an aggressively-grown list that included a lot of poorly-engaged and poorly-sourced addresses, and enough of those Gmail recipients were marking the mail as spam to push the rate to 0.18 percent. No domain block configuration could fix that, because the domain block does not influence the spam rate, the spam rate is driven by who the sender mails and how those recipients react. The real fix was on the list side: they cleaned the list, removed the poorly-engaged segments, tightened their acquisition to proper opt-in, and reduced their Gmail volume while the spam rate recovered. The spam rate came down over several weeks, and as it dropped back below 0.10 percent and toward 0.08, their Gmail inbox placement recovered. The lesson is the central point of this guide: the PowerMTA gmail.com domain block is necessary but not sufficient, and it is not what determines Gmail deliverability. Gmail deliverability is determined by reputation, above all the spam rate, and the spam rate is a list-and-engagement metric, not a configuration setting. An operator whose Gmail delivery is degrading should check the spam rate in Postmaster Tools first, before touching the domain block, because if the spam rate is the problem, no amount of domain block tuning will help.
Reliable Gmail delivery in 2026 rests on meeting Gmail's bulk sender requirements, which for a PowerMTA operator span both configuration and practice. On the PowerMTA side, the gmail.com domain block must be tuned to Gmail's reputation-governed acceptance, the authentication, SPF-authorized sending IPs, valid DKIM signing, DKIM alignment for DMARC, must be correct, and marketing mail must carry a proper RFC 8058 one-click unsubscribe. But the factor that most determines Gmail deliverability is the user-reported spam rate, and the thresholds must be respected: 0.30 percent is the hard enforcement line, but 0.10 percent is the real working ceiling and 0.08 percent the safe target, and the spam rate is a list-and-engagement metric that no domain block configuration can fix. With Gmail's enforcement now producing permanent 5xx rejections and Postmaster Tools v2 showing a binary Compliance Status, the requirements are baseline, not best practice. Operators who meet the authentication and one-click requirements, keep the spam rate well below the working ceiling through list discipline, and monitor both Postmaster Tools and the accounting log, get reliable Gmail delivery; operators who tune the domain block while ignoring the spam rate, as the case shows, find that the configuration was never the problem.