You don't send 5,000 emails a day. Gmail's other rule list is still yours.

Google’s sender guidelines are one page with two sections. The one that made headlines in February 2024 is titled “Requirements for sending 5,000 or more messages per day.” Almost every funeral home read that number, did the arithmetic, and correctly concluded it wasn’t them.

The section above it is titled “Requirements for all senders.” It carries no volume threshold. Four rules, and they bind a firm sending forty messages a week exactly as they bind a retailer sending four million.

Nobody sent an email about that one.

The four rules that apply to you

Quoted from Google’s page, in full, because paraphrase is where this gets muddy:

• “Set up SPF or DKIM email authentication for your sending domains.”
• “Ensure that sending domains or IPs have valid forward and reverse DNS records, also referred to as PTR records.”
• “Use a TLS connection for transmitting email.”
• “Keep spam rates reported in Postmaster Tools below 0.3%.”

Three of the four are things your mail provider or web host either did on setup or never did at all. None of them is ongoing work. All of them are invisible until they aren’t.

Why this is a funeral home problem specifically

Deliverability failures are silent on both ends. Gmail does not bounce an unauthenticated message back to you with an explanation — it files it, and the recipient never knows a message existed.

Consider what your firm actually sends. Service details to a family coordinating relatives across three time zones. The obituary link the daughter is supposed to forward. Aftercare mail in the months afterward. Pre-need follow-up to someone who asked for it. Every one of those is a message where the person on the other end has no reason to go digging in a spam folder, because they don’t know it’s coming.

A family that never received the service time does not conclude that Google filtered it. They conclude the funeral home didn’t send it.

That is the cost, and it is why this belongs beside the other silent failures — the first call that now arrives by contact form and waits, or the page almost every funeral home site is missing. Same shape: the business never learns it lost anything.

Set up both SPF and DKIM, not either

Google’s lower tier says “SPF or DKIM.” Set up both anyway.

The reason is in the tier above. Google’s requirements for senders at 5,000+ messages a day ask for SPF and DKIM, a DMARC record, and From: alignment — and the direction of travel over the past decade has been one tier’s requirements becoming the next one’s. More immediately: SPF alone breaks when mail is forwarded, which is exactly what happens when a family member forwards the service details to six relatives. DKIM survives that; SPF does not. The scenario where SPF-only fails is the scenario your firm’s mail lives in.

If your firm does cross 5,000 messages a day — a large group, or a marketing list nobody told you about — that tier also requires that “marketing messages and subscribed messages must support one-click unsubscribe, and include a clearly visible unsubscribe link in the message body,” implemented as two specific headers Google prints on the page, including List-Unsubscribe-Post: List-Unsubscribe=One-Click.

One detail worth handing your provider: “Sending to personal Gmail accounts requires a DKIM key of 1024 bits or longer. For security reasons, we recommend using a 2048-bit key.” Older setups are sitting on 1024. Ask which yours is.

The two spam numbers, and which one to use

Google’s page prints two different spam-rate figures, and quoting one as the other is a real error.

The requirement is “Keep spam rates reported in Postmaster Tools below 0.3%.” The recommendation, elsewhere on the same page, is stricter: “Keep spam rates reported in Postmaster Tools below 0.10% and avoid ever reaching a spam rate of 0.30% or higher.”

Use 0.10% as the number you manage to. At the volumes a funeral home sends, the arithmetic is unforgiving — a handful of spam complaints against a few hundred messages clears 0.3% on its own. That is an argument for sending less mail to people who asked for it, not more mail to everyone.

What to actually do this week

Three things, none of which takes an afternoon.

Ask who sends your mail. Firms routinely send from three places without realizing it: the mailbox provider, the website’s contact form, and whatever tool sends the aftercare sequence. Each one is a separate sending path and each needs its own authentication. The website form is the one most often missed, because nobody thinks of it as email.

Send yourself a test from each path and read the headers. In Gmail, open the message, then “Show original.” You are looking for SPF, DKIM and DMARC each reading PASS. Anything else is your answer, and it is a specific answer you can hand to a vendor.

Sign up for Google Postmaster Tools. It is free, it requires a DNS record to verify the domain, and it is the only place the 0.3% figure is actually measurable. Without it you are managing to a number you cannot see.

The rule nobody announced

The 5,000-a-day headline did real damage, because it told every small sender that email authentication was somebody else’s compliance problem. It isn’t. Google wrote a section called “Requirements for all senders” and meant the word “all.”

The work is an afternoon with whoever runs your domain, once. What it buys is that the message telling a family when to arrive gets seen — which is not a marketing outcome, it’s the job.