For twenty years, the deal with mailbox providers has been fairly mechanical. Prove you control the domain, sign your messages, publish a policy telling receivers what to do with mail that fails. SPF, DKIM, DMARC. Do the homework, get the benefit of the doubt.

That deal is starting to change, and the Gmail Verified Sender Program is the clearest signal yet. Starting September 8, eligible senders who confirm their actual organizational identity get preferential handling in the inbox. Not better authentication. Better placement, in exchange for proving who they are. If you send email for a living, the mechanics of how a verified sender earns that treatment are worth understanding now, before the model spreads.

What Google actually announced

The program is narrow. It applies to US political committees: candidates, parties, PACs, and other 527 tax-exempt organizations registered with the FEC or a state, local, or tribal election authority. Those groups verify their identity with Google, and in return their campaign mail lands in the personal Gmail inbox more reliably instead of being routed straight to spam.

There’s a leash on it. Participants have to hold a spam complaint rate under 0.3% on a rolling 14-day average, and recipients keep every lever they had before. Mark as spam, block the sender, unsubscribe. As MarTech put it, verification changes how Gmail initially handles a message while leaving the recipient in control of what happens next.

So it’s not a free pass. It’s a different starting position.

Why this is bigger than political email

I know how this reads at first glance. Political fundraising email is the least sympathetic category on earth, and there’s a decent argument that Google is responding to years of lobbying rather than executing a considered product strategy. Engadget covered it with roughly that framing, and honestly, they might be right about the motivation.

But motivation and mechanism are separate things. And the mechanism here is new.

Think about what authentication actually proves. SPF says a particular IP was allowed to send for your domain. DKIM says the message wasn’t tampered with in transit and was signed by a key published in your DNS. DMARC ties those together and tells receivers what to do on failure. All three answer the same underlying question: did whoever sent this have legitimate access to the domain?

None of them answer a different question: who is the organization behind that domain, and did anyone check?

A spammer with a freshly registered domain and thirty minutes can pass SPF, DKIM, and DMARC perfectly. I’ve seen plenty of cold outreach operations do exactly that, cycle through domains every few weeks, and stay technically compliant the entire time. Authentication was never designed to stop them. It proves custody, not identity.

The Verified Sender Program is Google saying, out loud, that it will trade inbox position for confirmed identity. That’s a category shift, and it applies well beyond campaign email.

BIMI was the first hint, and most of us read it as a logo feature

Remember when BIMI started rolling out and the conversation was almost entirely about brand logos in the inbox? Marketers looked at it and saw a design win. Get your mark next to your name, stand out in the list view, nice.

That framing missed the interesting part. To display a BIMI logo in Gmail, you need a Verified Mark Certificate, which means a certificate authority checks your trademark registration and confirms your organization is what it claims to be. The logo was the visible reward. The identity check was the actual product.

BIMI required DMARC at enforcement before it would do anything. The Verified Sender Program requires FEC registration and a complaint ceiling. Different mechanisms, same direction of travel: authentication gets you to the table, verified identity gets you something extra.

The enforcement climate makes this land harder

None of this is happening in a vacuum. The grace period on the 2024 Gmail and Yahoo bulk sender requirements is fully over, Microsoft has adopted a near-identical framework, and the pattern this year is that providers are punishing senders who are technically compliant but behave badly. SPF records that validate but blow past the ten-lookup limit. DMARC published at p=none and left there for two years. One-click unsubscribe headers that exist in the source and don’t actually unsubscribe anyone.

Stable senders have quietly moved their complaint-rate target from 0.30% to 0.10%. That’s not a published rule anywhere. It’s just where the people who don’t have deliverability problems are operating.

Which means the floor is rising and, at the same time, a ceiling is appearing above it. Doing the technical work correctly is becoming table stakes rather than a differentiator. The differentiator is moving toward whether a provider knows who you are.

What a verified sender posture looks like right now

You can’t join Google’s program unless you’re a political committee, so this isn’t a checklist you can complete today. It’s a posture to adopt while the model is still forming.

  1. Get DMARC to enforcement and leave it there. p=quarantine or p=reject — our free DMARC record generator will build the record if you need it. If you’ve been sitting at p=none collecting reports you don’t read, that’s the single highest-value thing on this list.
  2. Pursue BIMI properly, with a VMC. Treat the identity verification as the point and the logo as a side effect. You’re building a record of having been checked.
  3. Stop rotating your from-domain. Identity-based systems reward continuity. Every new subdomain you spin up for a campaign starts from zero.
  4. Work your complaint rate to 0.10%, not 0.30%. Google’s stated ceiling for the program is 0.3%, but that’s a disqualification line, not a target. There’s a meaningful difference.
  5. Keep your registration and WHOIS data accurate and consistent. If verification programs expand, they’ll check against public records. Mismatches between your legal entity name, your domain registration, and your from-name are exactly the kind of friction that stalls an application.

None of that is exotic. Most of it is deliverability hygiene you already know about. The reason to prioritize it now is that the payoff is shifting from “avoid punishment” to “qualify for advantage.”

The part I’d push back on

I don’t want to oversell this. One program, one narrow sender category, one country, launching in September. It could stay exactly that size. Google has piloted plenty of things that went nowhere, and there’s a real risk that a program built under political pressure never generalizes because generalizing it would mean building an identity verification operation at internet scale. That is genuinely hard and genuinely expensive.

But the precedent matters even if the program doesn’t grow. Google has now demonstrated that it’s willing to grant differential inbox treatment based on verified identity, with recipient feedback as the check on that privilege. Once a mailbox provider proves it will do that for one category, the question stops being whether identity becomes a deliverability signal and starts being which category comes next.

My guess is regulated industries. Financial services and healthcare already deal with identity verification as a cost of doing business, and they’re the categories where spoofing does the most damage.

Where this leaves the rest of us

Here’s what I keep coming back to. If sender identity becomes something you establish once and then carry with you, the value of every message you send under that identity goes up. Which makes it a lot more expensive to waste one.

That’s the uncomfortable implication for most email programs. Earning verified status doesn’t help if the mail you send under it is generic enough that people complain anyway. Complaint rate is the leash on Google’s program for a reason: identity gets you in the door, relevance is what keeps you there.

We built Alterable around the render-time half of that problem, generating content at the moment of open so the message reflects where someone actually is and what they’ve actually done. It’s not a deliverability tool and I won’t pretend otherwise. But the two halves connect. Verification is you proving to Gmail that you’re worth trusting. Relevance is you proving the same thing to the person who opens the message. The first one is starting to get formalized. The second one never will be.

Get your DMARC to enforcement this quarter. Then go look at what you’re actually sending.