nanoPost

The WordPress Email Authority

Google enforced bulk sender requirements in February 2024. If your WordPress site sends more than 5,000 messages per day to Gmail addresses, you need to meet all three authentication requirements — and one header requirement — or Gmail will start rejecting your mail.

The four requirements

SPF

Your domain’s SPF record must include your SMTP provider’s sending IPs. If you use Postmark, add include:spf.mtasv.net. SendGrid: include:sendgrid.net. Amazon SES: include:amazonses.com.

A softfail (~all) passes the SPF check but signals low confidence. Use a hardfail (-all) once you’re sure your SPF record is complete.

DKIM

Every outbound message must carry a valid DKIM signature with a key of at least 1024 bits. Google recommends 2048 bits.

For WordPress, DKIM signing happens at the SMTP provider level — you generate a key pair in your provider’s dashboard, add the public key as a TXT record in DNS, and the provider signs each message on the way out.

DMARC

Your domain must have a DMARC record. The policy must be at least p=quarantine. p=none does not satisfy the bulk sender requirement.

A minimal compliant DMARC record:

_dmarc.yourdomain.com  TXT  "v=DMARC1; p=quarantine; rua=mailto:[email protected]"

The rua= address receives aggregate reports from receiving servers. Not required, but useful for monitoring.

One-click unsubscribe

Messages to marketing lists must carry a List-Unsubscribe header with a mailto: or HTTPS URL, and a List-Unsubscribe-Post: List-Unsubscribe=One-Click header. Gmail surfaces the unsubscribe link next to the sender name.

This requirement applies to marketing and promotional messages. Transactional email — password resets, order confirmations, account notifications — is exempt.

Spam rate threshold

Gmail rejects mail from senders whose spam complaint rate exceeds 0.10%. The cap for staying off the deferral list is 0.30%. Monitor your rate in Google Postmaster Tools.

WordPress context

Most WordPress sites are well under 5,000 messages per day. The requirements still matter: Gmail uses authentication as a trust signal across all senders, not just bulk volume. A missing SPF or DKIM record increases spam rates even if you never hit the threshold.

The critical setup path for WordPress:

  1. Choose an SMTP plugin (WP Mail SMTP, FluentSMTP, Postman SMTP).
  2. Connect it to a sending service that handles DKIM signing for you.
  3. Add the provider’s SPF include to your domain’s DNS.
  4. Add the DKIM TXT record the provider generates.
  5. Add a DMARC record at _dmarc.yourdomain.com.

Read next

Read next

Related