Your email is going to spam and you are not a bulk sender.

You sent the newsletter to four hundred customers. A handful opened it, one replied to say it turned up in spam, and the rest went nowhere you can see. Somewhere in the follow-up someone mentioned Google's new sender rules and DMARC, and the conversation stopped being one you could take part in.

Most of what you have been told about those rules does not apply to your business. What does apply is stricter than people realise, and it is not the part anyone talks about.

The 5,000 number is not the rule you think it is

Google's requirements took effect on 1 February 2024, and they come in two tiers. The headline items that made the rounds — publish DMARC, support one-click unsubscribe, run SPF and DKIM together, keep your From: header aligned — are the requirements for senders of 5,000 or more messages a day to Gmail personal accounts.

A nine-person business emailing four hundred customers once a month is not in that tier and will not be soon.

One caveat before you relax about it. Yahoo runs the same two-tier structure, all senders and bulk senders, but it does not publish a number defining which is which. So "we are under 5,000" is a statement about Gmail specifically, not a general exemption, and it is worth knowing that before someone assures you the rules are for other people.

What binds you regardless of volume

The all-senders list is short, and every item on it applies to a business sending one campaign a quarter.

You need SPF or DKIM set up for the sending domain. Your sending infrastructure needs valid forward and reverse DNS records. Connections need TLS. Messages need to be formatted properly. Your spam rate has to stay below 0.3%. And you must not impersonate Gmail From: headers, which is the one that quietly catches small businesses and gets its own section below.

Notice that the authentication requirement at this tier is SPF or DKIM rather than both. If you send through a platform and completed its domain setup, you have probably satisfied this without knowing what you did. If you skipped that setup because it involved DNS records and someone said it was optional, you have not.

Three complaints per thousand

The spam rate threshold deserves its own heading because the decimal point hides how small it is. Below 0.3% means that out of a thousand delivered messages, three people marking you as spam puts you at the line.

Three.

Which reframes the monthly argument about whether to send to the whole list again. The cost of mailing people who did not really want to hear from you is not a low open rate; it is a metric with a ceiling you can hit with a handful of irritated recipients, and it affects whether the customers who do want your email receive it. That is the mechanism behind over-sending being self-defeating rather than merely annoying.

Gmail monitors this in Postmaster Tools, which is free and which almost no small business has set up. Yahoo notes its version is calculated against mail delivered to the inbox, so the figure you see and the complaints you hear about are not measuring the same thing. Either way, you cannot manage a number you have never looked at.

The From address that fails quietly

Here is the most common version of this problem in a business under twenty people. The campaign goes out through a platform, and the From address is a free mailbox: the owner's gmail.com address, because that is the address customers actually know and nobody wanted to confuse them with a new one.

Google lists not impersonating Gmail From: headers under the requirements for every sender. When your platform sends mail claiming to be from a gmail.com address, that is what it is doing, whatever your intent was, and providers have got progressively less forgiving about it.

The fix is the same one that fixes several other problems at once: send from your own domain, and complete the authentication setup your platform asks for. It puts your business name in the sender line, it makes the mail attributable to you rather than to a shared consumer domain, and it is a prerequisite for anything else you might do later.

Where to start on a Tuesday

Open your sending platform and find the domain authentication section. If it shows anything other than verified, that is the job, and it is usually three DNS records and a twenty-minute wait for them to propagate. Whoever manages your domain can add them, and if nobody knows who that is any more, finding out is worth doing on its own account, because the same registrar login governs your website, your email, and your ability to move either of them. Then set up Google Postmaster Tools so the spam rate becomes a number you can see rather than a rumour you hear about from one customer who mentioned it in passing.

After that, the honest work is about who is on the list. Deliverability problems and consent problems are the same problem wearing different clothes, which is exactly the case on the texting side too, and no DNS record compensates for mailing people who never asked.

If your email runs through a platform like GoHighLevel and you are not sure whether any of this was ever configured, book a strategy call. It is usually a short answer, and it is a cheap thing to check against the cost of a year of campaigns nobody received.