Store emails going to spam? Gmail’s new sender requirements

Since 1 February 2024, Gmail only accepts mail from senders with an authenticated domain. Without it, a message can be rejected or end up in spam, as Google’s guidelines for email senders state plainly. And yes, the Gmail sender requirements also apply to online stores that send order confirmations and password reset links. Below you’ll find a list of things to check in your domain’s DNS and in your store settings, whether you run WordPress with WooCommerce or PrestaShop.

What Gmail sender requirements apply since February 2024?

Anyone sending mail to @gmail.com and @googlemail.com addresses must have SPF or DKIM, valid DNS records including PTR, an encrypted TLS connection and messages that follow RFC 5322. Specifically:

• SPF or DKIM set up for the domain you send from,
• valid forward and reverse DNS, which means a PTR record that maps the server’s IP address to a hostname,
• mail sent over a TLS connection,
• a spam complaint rate in Postmaster Tools below 0.3%, in line with Google’s requirements for all senders,
• message format compliant with RFC 5322,
• no impersonating a gmail.com address in the From field.

Stores miss that last point most often. Gmail has a DMARC quarantine policy for its own domain. A message signed as store@gmail.com but sent from a hosting server? It won’t pass verification. Period. And if you don’t meet the requirements, expect rate limiting, blocked messages or the spam folder.

Do the new rules apply to a small online store?

Yes. The basic requirements apply to everyone, no matter how many emails they send. On top of that, the rules for bulk senders say that companies sending more than 5,000 messages a day to Gmail accounts must have both SPF and DKIM, DMARC in place, a From domain aligned with the SPF or DKIM domain, and one-click unsubscribe. A small store usually doesn’t reach that threshold. But a single newsletter to your whole customer base is enough to cross it in one day. That’s why, in my view, there’s no point cutting corners. Better to meet the full set right away.

SPF, DKIM and DMARC for your store: what to set in DNS

We’re talking about three TXT records. They tell Gmail who may send mail on behalf of the domain and whether anyone tampered with the content along the way.

• SPF is a list of servers and services allowed to send mail: your hosting, SMTP server, newsletter system. One domain, one SPF record. You add further services to it instead of creating a second one (a classic mistake).
• DKIM is a digital signature on the message. Your email or hosting provider generates the key pair, and only the public key goes into DNS.
• DMARC tells the receiver what to do with a message that failed SPF and DKIM. To start with, a none policy with a reporting address is perfectly fine.

Then there’s domain alignment. The domain in the From field must match the SPF or DKIM domain. Otherwise DMARC fails, even if both records are set up perfectly.

Why do transactional emails from WooCommerce and PrestaShop land in spam?

Usually because of PHP mail. The store sends mail with this function from a hosting server that isn’t listed in SPF and doesn’t sign anything with a DKIM key. And transactional emails are order confirmations, status updates, invoices, password resets. The customer is waiting for them. Every lost message means lost sales and lost trust. Add the usual slip-ups: a sender address on a different domain than the store, a @gmail.com mailbox in the From field, no PTR record on shared hosting. Oh, and plugins and modules with their own notifications use the same sending path. Same problem.

How to improve WooCommerce and PrestaShop email deliverability step by step

First, find out what your store actually uses to send mail. Then move sending to an authenticated channel.

1. Check whether the store uses PHP mail, an SMTP server or an external service.
2. Switch sending to an authenticated SMTP server or a transactional email service.
3. Set the sender address on the store’s domain.
4. Add SPF and DKIM records.
5. Add DMARC with a none policy.
6. Send a test message to a Gmail account, open Show original and check that SPF, DKIM and DMARC all show PASS.
7. Connect your domain to Google Postmaster Tools.

In WordPress with WooCommerce, changing the sending method usually means an SMTP plugin. PrestaShop is simpler, because the panel settings are enough: Advanced Parameters > E-mail. You’ll find tools to extend both platforms, that is WordPress and WooCommerce plugins and PrestaShop modules, at K4.pl among other places. And Postmaster Tools? It comes in handy later, for keeping an eye on spam complaints and domain reputation.

Store newsletters and one-click unsubscribe

Marketing messages from bulk senders must support one-click unsubscribe and include a clearly visible unsubscribe link in the body. I also recommend separating marketing and transactional mail, for example with a separate subdomain or a separate service. Why? So that if the newsletter collects spam complaints, your order confirmations don’t take the hit with it. And only send it to people who signed up themselves. Consent to marketing communication is a legal requirement anyway, not just a Gmail whim.

Where to start to meet Gmail’s requirements this week

With a test. Send a message to Gmail and look at the headers. Then SPF and DKIM, changing the From address to one on the store’s domain, and finally DMARC and Postmaster Tools. In practice, meeting the Gmail sender requirements comes down to a few DNS records and a change of sending method. Not much work. In return, order confirmations and password resets reach the customer’s inbox, not the spam folder.

Frequently asked questions