The Distribution loop dimension asks whether sends are authenticated and delivered. This page states the requirements that make that possible, and where they come from.
What changed and when
In February 2024 Google and Yahoo began enforcing a shared set of sender requirements. Before that, authentication was widely recommended. Since then it is the condition of delivery to their users.
The rules split into two tiers: obligations that apply to every sender, and additional obligations that apply to bulk senders. Google defines a bulk sender as a domain sending roughly 5,000 or more messages per day to Gmail addresses.
Requirements for all senders
- SPF or DKIM authentication configured for the sending domain
- Valid forward and reverse DNS (PTR) records for sending IP addresses
- TLS for transmission
- A From header that does not impersonate Gmail or Yahoo
Additional requirements for bulk senders
- Both SPF and DKIM configured, not just one
- A published DMARC record. A policy of p=none is the stated minimum
- Domain alignment. DMARC must pass through either SPF or DKIM alignment. Authenticating is not sufficient on its own: the domain that passes must match the From domain
- One-click unsubscribe via the List-Unsubscribe and List-Unsubscribe-Post headers, as specified in RFC 8058, for marketing and promotional mail, with opt-outs honoured within two days
- A spam complaint rate below 0.3 percent as reported in Google Postmaster Tools
The alignment trap
The most common failure is not missing authentication. It is authentication that passes without aligning. If mail is sent from a subdomain of the publisher domain but signed by a sending platform own domain, SPF and DKIM can both pass while DMARC still fails, because neither aligned domain matches the From header.
This is worth checking directly rather than assuming, because most email platforms will report authentication as configured whether or not it aligns.
The spam rate threshold in practice
Google guidance is to stay below 0.1 percent and never reach 0.3 percent. The 0.3 figure is where enforcement begins, not a safe operating target.
At small list sizes this threshold is easier to cross than it appears. A send of 10,000 messages needs only 30 spam reports to reach 0.3 percent. Google states that bulk senders become eligible for mitigation once spam rates remain below 0.3 percent for seven consecutive days.
One-click unsubscribe is required for marketing and promotional messages only. Transactional messages such as password resets and confirmations are excluded.
How this is used in a teardown
Authentication status is checkable from outside by inspecting the DNS records of the sending domain. A publisher who has capture, sends regularly, and fails alignment has a Distribution loop that leaks at the point of delivery rather than at the point of capture, which is a different fix and a different score.
Sources
Requirements verified August 2026. Google has indicated that DMARC alignment expectations may tighten, so this page records the state of the rules at the date each teardown was scored.