Gmail's 2026 Bulk Sender Rules Are Now Enforced. 72% of Shopify Brands Are Out of Compliance. Here's the 90-Minute Fix.
As of November 2025, Gmail rejects non-compliant bulk email permanently. Most Shopify brands using Klaviyo, HubSpot, or multiple sending tools are failing silently. Here's how to audit, fix, and never get caught again — in under 90 minutes.
Mark Cijo
Founder, GOSH Digital
Most Shopify brands sending email through Klaviyo are out of compliance with Gmail's 2026 bulk sender rules and don't know it.
This is the kind of post nobody wants to read. It's about DNS records, authentication headers, and acronyms most marketers hate. It's also the post that, if you skip it, costs you somewhere between 30% and 80% of your email revenue when Gmail starts hard-bouncing your sends and you don't notice for six weeks.
Read it. Then fix the gaps. Then thank me later.
What changed in November 2025
Gmail and Yahoo updated their bulk sender rules for the second time since the original February 2024 enforcement. The 2026 changes have teeth that the 2024 version didn't:
- SPF, DKIM, and DMARC are now required for any sender pushing 5,000+ emails per day to Gmail addresses. Not "recommended." Required.
- DMARC policy must be at least
p=nonewith monitoring active. Brands atp=quarantineorp=rejectget preferred routing. - Spam complaint rate must stay under 0.3%. Hit 0.3%, your reputation starts decaying. Hit higher and Gmail begins rejecting your mail wholesale.
- One-click unsubscribe (RFC 8058) is mandatory. Klaviyo handles this for you if it's configured correctly. If you're using a custom unsubscribe page, you're likely non-compliant.
- Non-compliant mail now receives permanent rejections (550 errors). Not soft bounces. Not "delayed delivery." Permanent rejection. Your message never reaches the inbox.
Klaviyo has been quietly enforcing these requirements for accounts with 5K+ emailable profiles since late 2025. Most brands haven't noticed because Klaviyo doesn't bounce your mail — Gmail does, downstream of Klaviyo.
That's why this is silent. Klaviyo says the send went out. Gmail rejects it. Your dashboard shows "delivered." Your customers never see the email. Your revenue declines and nobody can figure out why.
The 72% number — where it comes from
We audit Klaviyo accounts for free as part of our standard intake. Over the last 90 days, we've reviewed 50 Shopify brands ranging from $500K to $30M in annual revenue. Of those 50:
- 36 (72%) had at least one missing or misconfigured DNS record for SPF, DKIM, or DMARC
- 14 (28%) had multiple sending tools (Klaviyo + HubSpot + Postmark + Sendgrid) sharing the same domain without consolidated authentication — guaranteed to fail SPF's 10-DNS-lookup limit
- 8 (16%) had DMARC policy at
p=rejectwith subdomains misconfigured — which means their own marketing emails were getting rejected by their own DMARC rules - 22 (44%) had spam complaint rates above 0.3% and didn't know what their current rate was
This is not a small problem. It is a "your business is losing money right now and you can't see it" problem.
The 90-minute fix
Block out 90 minutes today. Get your domain registrar credentials (Cloudflare, GoDaddy, Namecheap, wherever your DNS lives), open Klaviyo's deliverability hub, and walk through these steps in order.
Step 1 — Confirm SPF is set correctly (15 min)
Your SPF record should include Klaviyo's sending servers (include:_spf.klaviyo.com) along with every other sending service you use. The total number of DNS lookups your SPF record requires must stay under 10.
Use MXToolbox's SPF lookup tool to check. If you see "PermError: too many DNS lookups" — that's the failure. You need to flatten your SPF record. Klaviyo's docs walk you through it.
Step 2 — Confirm DKIM is configured for every sending domain (20 min)
Every sending service must have its own DKIM signature. Klaviyo's DKIM is a single CNAME record. HubSpot's is different. Postmark's is different. Sendgrid's is different.
In Klaviyo: Settings → Email → Domains and senders. You'll see a DKIM verification status. If it's red — fix that first.
If you're sending from multiple platforms (which most Shopify brands are — Klaviyo for marketing, Postmark or Mailgun for transactional, sometimes HubSpot for sales sequences), each one needs its own DKIM record. Audit every platform.
Step 3 — Configure DMARC at p=none minimum (20 min)
Add a DMARC TXT record at _dmarc.yourdomain.com. Start at:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; ruf=mailto:dmarc@yourdomain.com; fo=1
p=none means "report failures, don't take action yet." This is the minimum for compliance. Don't go straight to p=reject — you'll black-hole legitimate mail you didn't realize was authenticating differently.
After 30 days of clean DMARC reports, move to p=quarantine. After another 60 days clean, move to p=reject. That's the safe ladder.
Step 4 — Verify one-click unsubscribe is live (10 min)
In Klaviyo: Settings → Email → Sending → Compliance. Check that "List-Unsubscribe-Post" is enabled. This is the RFC 8058 one-click unsubscribe Gmail requires. Klaviyo handles it automatically if the toggle is on. If you've ever customized your unsubscribe flow with a third-party tool, you may have broken this. Confirm.
Step 5 — Pull your spam complaint rate (15 min)
In Klaviyo: Analytics → Deliverability → Complaint Rate (by mailbox provider). Find your Gmail-specific complaint rate over the last 30 days.
- Under 0.1% → you're fine
- 0.1% to 0.3% → you're at risk, audit your list hygiene
- Over 0.3% → you're already losing inbox placement, this is urgent
If you're over 0.3%, you don't have a compliance problem — you have a list problem. We covered the cleanup playbook in detail in our Phoenix case study, where 11,392 spam complaints in a single month forced us to cut a 12-million-recipient list down to its engaged core. The list shrank dramatically. Open rates jumped to 39.54%. Revenue per subscriber went up.
If you're sitting at high complaint rates, list shrinkage is the only fix that doesn't get worse over time.
Step 6 — Set up monitoring so you never get caught again (10 min)
Klaviyo's new Deliverability Hub (rolled out late 2025) consolidates the metrics you need to watch into one screen with alerts when something starts trending wrong. We covered the broader updates in our Klaviyo Composer + Customer Agent breakdown — the Deliverability Hub is the underrated launch of that release.
Turn on weekly alerts. Check the Hub every Monday morning. Treat deliverability metrics like you treat your bank balance.
Why this matters more than it sounds
Deliverability is the silent killer of email programs. It doesn't show up in your dashboard. It doesn't ping you when it breaks. You just notice your campaign revenue dropped 30% and you can't figure out why. We've seen TheLiquorStore.com and Raw Rev both face deliverability cliffs that would have killed their programs if we hadn't caught them early.
Brands that get this right keep 100% of their potential email revenue. Brands that get this wrong cap out at 30–60% of what they could be doing — and don't know why.
If you're running our email and SMS playbook at scale, deliverability monitoring is non-negotiable. It's the first thing we check on every audit and the last thing we let degrade.
The honest summary
This isn't a fun blog post. It's an operational one. The brands that audit and fix their authentication this quarter keep their email revenue intact. The brands that don't will find out the hard way over the next 6 months.
The fix is 90 minutes. The cost of not doing it is somewhere between 30% and 80% of your email-attributed revenue.
That's not a tradeoff. That's a calendar event.
If you want us to do the audit for you — or check whether your current Klaviyo configuration is actually compliant — book a free Klaviyo audit and we'll send back a complete authentication + deliverability report within 48 hours. We're a Klaviyo Gold Partner and this is exactly the kind of work we obsess over.
Sources:
Written by Mark Cijo
Founder of GOSH Digital. Klaviyo Gold Partner. Helping eCommerce brands grow revenue through data-driven marketing.
Book a free strategy call →