Gmail verifies the sender, not the desire to receive those emails

By CaptainDNS
Published on August 26, 2026

Two cards contrast a sender's verified identity with the recipient's choice in Gmail

The essentials

The program opens on September 8, 2026 to eligible U.S. political committees that send to personal Gmail accounts.
Google verifies the committee's identity and its domain. That verification guarantees neither the Primary inbox nor the absence of filtering.
The domain must have SPF, sign messages with DKIM, use a non-shared IP, and be monitored in Postmaster Tools.
An average spam rate of 0.3% or higher over 14 days exposes the domain to a 7-day suspension or a permanent exit.
For every sender, the lesson stays the same: authenticate, split your streams, measure complaints, and make the exit easy.

"Political committees will be able to bypass Gmail's spam filter." The shortcut works as a headline. It does not hold up against the documentation Google published for September 8, 2026.

The Gmail Verified Sender Program first establishes that a domain belongs to a declared U.S. political committee. It then requires an auditable mail setup and a complaint cap. Google does not certify that recipients want these messages. The "Spam" button is still there, as are blocking a sender and unsubscribing.

This detail changes the whole reading. A validated identity answers "who is sending?" Deliverability answers a different question: "does this recipient still want this stream?" Mixing the two leads to a fragile operation, in politics as elsewhere.

Check the domain and the message

Check the domain Test an email

What the Gmail Verified Sender Program actually is

The program is a voluntary verification and compliance framework for certain U.S. political committees. Its stated scope covers messages sent to personal Gmail accounts.

The opening is set for September 8, 2026. Eligible senders are candidates, parties, PACs, and other political committees organized as tax-exempt organizations under section 527, provided they are registered with the Federal Election Commission or a state, local, or tribal election authority.

The "personal Gmail" scope needs to be spelled out plainly. Google defines these accounts as addresses that end in @gmail.com or @googlemail.com. The general sender documentation does not apply the same way to inbound messages for a Google Workspace domain. An operator should therefore split measurements by destination instead of aggregating personal Gmail with every domain hosted by Google.

Enrollment starts at Campaign Verify. This nonpartisan U.S. organization, a 501(c)(3), checks the committee's identity. After that step, it verifies the submitted domain. The domain must match the committee's public website or redirect to it. Free email domains and shared domains are rejected. Campaign Verify also states that it verifies the root domain, not the local part before @.

The committee must also hold a Postmaster Tools account tied to the sending domain and verify that domain. After Campaign Verify confirms, Google announces an active status within one to two business days. Program status appears in the Postmaster Tools compliance dashboard.

This sequence avoids a common mix-up among mail teams. Campaign Verify checks the entity and its link to the domain. Postmaster Tools checks technical ownership of the domain and exposes the data Gmail received. Gmail then applies its policies to the traffic. Three functions, not a single stamp.

What this program is not

The Gmail Verified Sender Program is neither an inbox guarantee, nor the BIMI blue check, nor a replacement for Gmail's bulk sender rules.

Not a documented spam-filter bypass

The 2026 page does not promise that every validated message will go to the Primary inbox. It says the program helps eligible, compliant committees deliver their messages reliably. Its FAQ adds that deliverability depends on ongoing compliance and positive recipient engagement, measured especially by the spam rate.

The wording matters. Google does not describe how its algorithms treat participants. The documentation only says that after a suspension or termination, the domain can keep sending to Gmail and falls back to standard spam filtering. You can infer that an active status gets distinct handling. You cannot infer a total exemption from filters, let alone a guaranteed placement in the Primary tab.

Not the Gmail blue check

The word "verified" here means verification of a committee and its domain. It is not the visual mechanism covered in Gmail Verified vs Google Verified, where BIMI, VMC, and Business Profile can show different marks in the Gmail interface. No brand logo or VMC certificate replaces the political program's rules.

Not the November 2025 bulk rules

The general requirements for senders sending about 5,000 messages or more per day to personal Gmail have existed since February 2024. Gmail gradually tightened enforcement starting in November 2025. Our brief on Gmail requirements for bulk senders covers that baseline.

The political program adds an identity check and an infrastructure constraint. A participant who crosses the bulk threshold is not exempt from DMARC, visible-domain alignment, one-click unsubscribe for the relevant messages, reverse DNS, TLS, or RFC 5322 formatting.

What Google actually requires

Admission rests on five families of checks: eligibility, domain identity, authentication, infrastructure, and behavior measured by Gmail.

Control	2026 requirement	Evidence or observation	Practical consequence
Eligibility	Eligible U.S. political committee, registered 527 organization	Filing with the FEC or a state, local, or tribal authority	The program is not open to an ordinary commercial sender
Identity	Committee and domain verified by Campaign Verify	The domain hosts the committee's public site or redirects to it	A free, shared, or already claimed domain is rejected
Postmaster Tools	Account tied to the domain and domain verified	Status visible in the compliance dashboard	Alerts and status changes are communicated there
SPF	SPF configured on the sending domain	Authentication result observed by Gmail	The IP authorization must cover every real source
DKIM	Every message is signed by the sending domain	Valid DKIM signature with the expected domain	A signature applied by a third-party domain does not meet the program's wording
Infrastructure	The sending domain's IP is not shared with any other sender	ESP inventory, IP pools, and SMTP logs	A standard shared pool does not qualify
Complaints	Spam rate below 0.3% on a 14-day average	Spam Rate and compliance in Postmaster Tools	At 0.3% or higher, the domain violates the policy
Ongoing compliance	Program policies and Gmail rules respected	Compliance dashboard and traffic behavior	7-day suspension or permanent termination possible

The table is available as CSV and JSON from the export links placed with the article.

SPF and DKIM must carry the right domain

Google's wording is more precise than a simple "SPF and DKIM enabled". The sending domain must have SPF configured, and messages must be DKIM-signed by that domain. Campaign Verify adds that alignment is not under its control, but that a lack of alignment prevents full compliance with the Gmail program.

Take a stream sent with From: info@captaindns.com. If an ESP signs only with its technical domain, the signature can be valid without proving control of captaindns.com. For the program and for DMARC, configure a custom DKIM signature with d=captaindns.com or an aligned subdomain under the applicable policy. Check the SPF record, the key published by the DKIM Checker, and the DMARC record separately.

SPF alone stays tied to the SMTP envelope. A forward can break it. DKIM attaches a signature to the message, but an intermediary can change a signed part. DMARC binds at least one of those results to the visible domain in From:. That is why a screenshot showing three check marks on a Tuesday does not replace continuous measurement of live traffic.

A non-shared IP, not just a commercial option labeled "dedicated"

Google writes: "Avoid sending messages with shared infrastructure; ensure that the IP address for your sending domain is not shared with any other senders." The constraint targets the actual use of the IP address. It does not ask you to buy an option whose sales sheet carries the word "dedicated".

An ESP can reserve an IP for one account while mixing several clients behind another routing layer. Conversely, an organization can operate its own single-sender IP. The audit must follow the observed SMTP path: source IP, reverse DNS, failover pools, regions, incident recovery, and any secondary vendor.

An isolated IP is not the same as a good reputation. It removes the risk caused by neighbors, but it leaves its owner solely responsible for warming, volumes, and complaints. A new IP launched at full volume overnight is isolated and suspicious. Google recommends raising volumes slowly and sticking to reasonable sends that recipients expect.

The spam rate is a complaint measure, not an abstract verdict

For this program, the rate must stay under 0.3% on a 14-day average. The rule is strict: 0.3% is not an acceptable target. It is the violation threshold. On 100,000 messages counted in the relevant denominator, 300 complaints already represent 0.3%.

The Postmaster Tools denominator often surprises people. Its Spam Rate table measures DKIM-authenticated messages delivered to the inbox of engaged users, then marked as spam. If Gmail already places many messages in spam automatically, the displayed rate can look artificially low. A tiny value therefore does not prove that the whole list is happy.

The data is not real-time. Google typically updates it within 24 hours, sometimes later. Low-volume days may display nothing to protect privacy. A serious operation keeps its own unsubscribe, bounce, volume, and campaign data, then lines them up against Google's data.

Verified identity, recipient desire

Google verifies the sender's authenticity. The recipient keeps the last word on whether the message is wanted.

Gmail policy states it without hedging:

Your definition of "unsolicited" mail may differ from your email recipients' perception.

Even a contact who once accepted messages may no longer want them today. The age of an opt-in does not cancel that change. A lawful collection is not a perpetual permission.

The four distinct layers between legality, identity, recipient desire, and inbox placement

The diagram shows the real order of checks. Legality defines what a sender may do. Authentication proves which domain sent the message. Reputation synthesizes the observed history. The placement decision comes after those checks and still depends on the recipient, the message, and the context.

The CAN-SPAM Act illustrates the split well. The FTC explains that the law targets almost exclusively commercial messages. Messages whose purpose is limited to soliciting charitable donations or promoting non-commercial political content are generally not governed by CAN-SPAM. That does not turn those messages into wanted mail. The legal rule and Gmail's "Spam" signal do not answer the same question.

An unsubscribe link therefore remains useful even when a narrow legal reading does not require it. Google recommends it explicitly to program participants. It reduces the temptation to click "Spam", gives a measurable exit, and cleans the list. For promotional streams subject to the bulk rules, the one-click unsubscribe header also meets a separate technical requirement.

Avoid the false choice between "Spam" and "Not spam". A recipient can block a sender, unsubscribe, ignore the message, or delete it. Each of those actions tells a different story about the relationship. Gmail does not publish its full model, but its documentation confirms that recipient engagement plays a role in the program's deliverability.

From the 2022 pilot to the 2026 program

The pilot launched in September 2022 and the program announced for 2026 share a political audience, but their documented treatment is not the same.

In August 2022, the FEC issued advisory opinion 2022-14 on Google's project. The pilot covered authorized committees of federal candidates, party committees, and leadership PACs. The FEC described a mechanism where participants' bulk messages were not detected by the ordinary spam algorithm. Ranking then rested on direct user feedback, with, on the first message, a prompt to choose whether or not to keep receiving that stream.

Google launched the pilot on September 19, 2022. More than 100 committees from both parties took part, according to company statements reported at the end of the test. The pilot ended on January 31, 2023. These are useful historical facts, because they explain why the word "bypass" is back today.

The 2026 documentation does not reuse that technical description. It does not say that participants escape spam algorithms. It stresses identity, authentication checks, a non-shared IP, compliance, and the 14-day complaint average. It states that standard filtering returns after exit from the program, without explaining the exact treatment while the status stays active.

That silence is not a license to fill the gap. Writing that 2026 reproduces the 2022 bypass would be an extrapolation. Writing that it changes no treatment would be just as reckless. The defensible conclusion is narrower: Google grants a distinct program to verified, compliant senders, but does not document a guaranteed path to the inbox.

The litigation between the Republican National Committee and Google does not change this technical reading. The RNC had sued Google over the ranking of its fundraising emails in 2022. The district court dismissed the claims. On January 16, 2026, the U.S. Court of Appeals for the 9th Circuit affirmed that dismissal. Its memorandum is not a deliverability specification and does not describe the new program.

The Gmail doctrine applies to every sender

The 2026 program highlights a doctrine already applied to the rest of the traffic: a compliant setup gives the right to be evaluated fairly, not a right to the inbox.

Since February 1, 2024, all senders to personal Gmail must use SPF or DKIM, have valid forward and reverse DNS records, use TLS, follow RFC 5322, and keep a spam rate below 0.3%. In practice, Google recommends staying under 0.1% and avoiding reaching 0.3%.

From about 5,000 messages per day, counted on the primary domain, SPF and DKIM both become mandatory. DMARC can start at p=none, and the visible domain must align with SPF or DKIM for direct sends. Marketing messages and those sent to subscribers must offer one-click unsubscribe and a visible link in the body. Once classified as a bulk sender, the domain keeps that status.

The political program reuses several of these pieces, then tightens two screws: identity is checked by a third party, and the infrastructure cannot be shared. Even then, the complaint remains central. That is consistent. An authentic domain can send mail that is tiring, repetitive, or too frequent. DKIM will sign that mail with perfect precision.

The deliverability score method correctly separates authentication, reputation, transport, and engagement. No pillar offsets the others on its own. A good DKIM signature does not erase a 0.4% complaint rate. An engaged list does not repair an unaligned domain. A clean IP does not make a misleading subject acceptable.

Teams still looking for "the setting to get through Gmail" are wasting time. Gmail observes a system: domain, IP, signatures, volumes, reactions, and history. The causes of a spam classification are therefore diagnosed layer by layer, with dated data, not with a vendor promise.

What the program changes for a non-political sender

A non-political sender cannot join this program, but can adopt its operational discipline right now.

Map the visible domain, the Return-Path, the DKIM domain, and every source IP. A "green" setup at the ESP does not prove those identities are aligned.
Check who shares the IPs of each stream. A shared IP can be fine outside the program, but its reputation also depends on neighbors. Measure that risk instead of ignoring it.
Add the domain to Postmaster Tools before an incident. Data does not come back retroactively on demand, and low volumes can leave holes.
Set an internal alert below the public threshold. Waiting for 0.3% leaves no margin. Google recommends less than 0.1% for general senders.
Separate transactional from promotional by subdomains, addresses, and, depending on volume, IP pools. An aggressive campaign must not penalize password resets.
Make unsubscribing easier than reporting spam. Process it within 48 hours for streams subject to the bulk requirements, then block any re-injection from a secondary source.
Raise volumes in stages toward engaged contacts. An internal calendar must define the rollback if SMTP errors, complaints, or unsubscribes rise.
Keep evidence per campaign: volume accepted by Gmail, complaints, bounces, collection source, consent date, and content version.

This checklist does not promise 100% inbox. It makes causes observable. That is far more useful when a rate changes after a new segment, an ESP switch, or a signature change.

Recommended action plan

The right plan starts with a measured baseline, fixes identities, then protects reputation with internal thresholds stricter than Google's.

Inventory the streams. List the visible domain, the envelope, the DKIM selector, the IP, the message type, the daily volume, and the vendor.
Verify authentication on a real message. Read Authentication-Results after receipt at Gmail. Correct DNS does not guarantee that a given message uses the right signature.
Check DMARC alignment. The visible domain must align with SPF or DKIM. For a bulk sender, publish at least p=none and use the reports.
Open Postmaster Tools. Verify the root domain, useful subdomains, and team access. Document who receives alerts.
Set two complaint thresholds. Trigger an investigation well before 0.3%, then stop or reduce the stream if the trend continues. A moving average sometimes hides a recent spike.
Test the list exit. The click must work without a login, the removal must propagate, and no CRM sync must resubscribe the contact.
Prepare the degraded mode. Define in advance who cuts volumes, which segments are cut, and how transactional stays isolated.

Then test a representative campaign, not an empty message sent to three colleagues. The guide how to test email deliverability details the checks before sending. After the send, compare your logs with Postmaster Tools for at least a week, since Google's tables lag.

FAQ

What is the Gmail Verified Sender Program?

It is a voluntary program that opens on September 8, 2026 to eligible U.S. political committees. It verifies their identity and domain, then imposes technical rules and a spam rate below 0.3% over 14 days.

Does the program guarantee inbox placement?

No. Google says enrollment establishes the sender's authenticity, while deliverability depends on ongoing compliance and recipient engagement. The 2026 documentation promises neither the Primary tab nor a total exemption from filters.

Who can enroll in the program on September 8, 2026?

Candidates, parties, PACs, and other U.S. political committees organized as a 527 organization may be eligible. They must be registered with the FEC or a state, local, or tribal election authority and have their domain verified by Campaign Verify.

Is a dedicated IP mandatory?

Google requires that the IP address used by the sending domain is not shared with any other sender. The check targets the real infrastructure; the commercial label "dedicated IP" is not enough if routing stays shared elsewhere.

How does Gmail calculate the program's spam threshold?

The program uses a 14-day average and requires a rate below 0.3%. Postmaster Tools measures DKIM messages delivered to the inbox of engaged users and then marked as spam, which can produce a low rate when Gmail already filters many messages.

What happens after a suspension?

The domain can keep sending, but its messages fall back to Gmail's standard spam filtering. After all technical issues and the spam rate are fixed, Google announces automatic re-enrollment within seven days; a serious violation can lead to permanent termination.

Does this program replace DMARC and one-click unsubscribe?

No. A participant who meets the bulk sender definition remains subject to the corresponding general requirements, including DMARC and one-click unsubscribe for marketing or subscriber messages. The program adds its own checks; it does not remove the Gmail baseline.

Why was the 2022 pilot different?

The FEC explicitly described a pilot where participants' messages escaped ordinary spam detection and depended on direct user feedback. The 2026 documentation does not describe that mechanism; it mainly frames identity, infrastructure, authentication, and complaints.

Download the comparison tables

Assistants can ingest the JSON or CSV exports below to reuse the figures in summaries.