Run a Gmail and Yahoo sender-requirements preflight before scaling

Scope the preflight by actual streams and current rules

Record every system sending to Gmail or Yahoo recipients, visible and envelope domains, DKIM selectors, IPs, message category, expected daily volume, recent peak, acquisition path, and owner. Determine whether current provider bulk-sender thresholds and definitions apply by reading the official pages on the review date; do not rely on an old checklist. PASS means scope covers all legitimate sources and volumes. REVIEW means a low-volume legacy source is isolated with an owner and deadline. STOP means an unknown sender can use the domain or volume cannot be estimated. Save the official URLs, access date, and applicable requirement text in the controlled review record rather than copying a permanent claim into code.

Evidence: Google Gmail Help; Yahoo

Authentication gate: prove results in received mail

Verify authoritative SPF, DKIM key retrieval and signatures, DMARC record and alignment, reverse DNS and forward confirmation where applicable, and transport security. Send representative artifacts through every real stream and inspect Authentication-Results. PASS requires current provider rules for that sender class to be met consistently. REVIEW covers a legitimate low-risk source being migrated under a bounded plan. STOP covers failing authentication, misalignment where required, an expired selector, permissive unknown authorization, or no owner for DMARC reports. Gmail and Yahoo requirements may evolve. Authentication demonstrates domain authorization under technical rules; it does not prove that the recipient requested the message.

Evidence: Google Gmail Help; Yahoo

Message-and-identity gate: inspect standards and recognition

Check RFC-compliant construction, visible From consistency, truthful subjects, valid Message-ID and date, HTML and plain text, accessible essential content, safe links, functioning reply path, and reasonable identity continuity from signup. Verify that forwarding and mailing-list modifications are handled according to current provider guidance where relevant. PASS means the received message is technically valid and recognizable. REVIEW covers a cosmetic issue that cannot obscure identity, content, or control. STOP covers malformed headers, deceptive presentation, broken essential resources, unsafe redirects, or brand rotation that makes the sender unrecognizable. Provider compliance does not excuse misleading content or a message outside the promised scope.

Evidence: Google Gmail Help; Messaging, Malware and Mobile Anti-Abuse Working Group

Complaint-and-acquisition gate: prevent the problem upstream

Review signup evidence, confirmation practice, list imports, invalid-address handling, complaint feedback, provider dashboards where available, segmentation, cadence, and volume changes. Gmail and Yahoo publish spam-rate expectations for relevant senders; verify the current metric, threshold, and enforcement context in official sources. PASS requires permission-based acquisition, monitored complaint signals, and hard stops below crisis. REVIEW covers a contained source under investigation with sending paused. STOP covers purchased lists, hidden co-registration, unexplained spikes, ignored complaints, or attempts to manufacture positive engagement. M3AAWG practice reinforces that authentication cannot compensate for mail people did not reasonably expect.

Evidence: Yahoo; Messaging, Malware and Mobile Anti-Abuse Working Group

Unsubscribe gate: validate RFC 8058 and visible control separately

For subscribed or marketing messages within current applicability, inspect List-Unsubscribe and List-Unsubscribe-Post headers, HTTPS endpoint, DKIM coverage, POST handling, visible body link, confirmation, and propagation to all queues. RFC 8058 specifies technical one-click signaling; provider pages specify who must implement it and how quickly requests should be honored. PASS means controlled opt-out stops applicable mail without login or extra data. REVIEW means a monitored delay still within the relevant rule. STOP covers a missing header when required, dead endpoint, misleading preference, fee, continued promotion, or re-import. Preserve no unnecessary test-person data.

Evidence: Google Gmail Help; Internet Engineering Task Force

Ruling and recurring verification

The next action is to run the preflight on the highest-volume stream and refuse scaling until zero STOP findings remain. Assign every REVIEW item an owner, date, safe volume cap, and rollback. Monitor provider response codes, authentication, complaints, unsubscribe discrepancies, volume, and DNS changes after release. Limits remain: passing published requirements does not guarantee placement, provider algorithms are proprietary, legal obligations vary, and official rules change. Schedule a quarterly check and immediate review after provider, domain, selector, IP, acquisition, volume, template, or unsubscribe changes. The record should link to current official evidence, not present a 2026 snapshot as eternal truth.