Google & Yahoo Bulk Sender Requirements: What You Must Do

In February 2024, Google and Yahoo stopped asking nicely. Requirements that had lived in "best practices" documents for a decade — authenticate your mail, make unsubscribing easy, don't generate complaints — became enforced rules, with rejection as the penalty. Two years on, the rules are stable, enforcement is routine, and Microsoft has joined with similar requirements of its own.

This post covers what's actually required (versus merely recommended), who counts as a "bulk sender," and a practical checklist for compliance.

Who counts as a bulk sender?

Google defines a bulk sender as anyone sending 5,000 or more messages per day to personal Gmail accounts — counted across all mail from the same primary domain, on any single day. Cross the line once and Google treats you as a bulk sender from then on. Yahoo uses a similar threshold and describes it deliberately vaguely ("a significant volume").

Two important nuances:

• The count is per domain, not per mailbox or per tool. Marketing mail, sales outreach, and transactional mail from the same domain add up together.
• "Personal accounts" means consumer addresses (@gmail.com, @yahoo.com) — but Google Workspace and other business hosts apply similar filtering logic in practice, so treating the rules as universal is the sane approach.

What every sender must do (any volume)

These apply even if you send ten emails a day:

If you're on Google Workspace, Microsoft 365, or Zoho, the DNS, formatting, and TLS items are handled by the provider. Authentication is the part you must set up yourself.

What bulk senders (5,000+/day) must also do

1. Both SPF and DKIM, plus DMARC

Bulk senders need SPF and DKIM passing, and a published DMARC record. The minimum accepted policy is p=none — you aren't required to enforce, only to publish and to have the visible From domain align with the domain passing SPF or DKIM. Alignment is where third-party sending tools most often fail: if your email tool signs with its own domain instead of yours, you don't meet the requirement. Our SPF/DKIM/DMARC setup guide walks through the full configuration.

2. One-click unsubscribe

Marketing and promotional mail must include RFC 8058 one-click unsubscribe: List-Unsubscribe and List-Unsubscribe-Post headers that let the recipient opt out with a single click from their mail client's UI, without loading a page or confirming. Requests must be honored within two days. A visible unsubscribe link in the body is also expected — the headers complement it, they don't replace it.

Transactional mail (receipts, password resets) is exempt, but mixed-purpose messages are judged by their promotional content.

3. Spam complaint rate under 0.3%

Measured in Google Postmaster Tools, your user-reported spam rate must stay below 0.3%, and Google explicitly recommends staying below 0.1% — the 0.3% figure is the line where enforcement kicks in, not a budget to spend. Sustained rates above it lead to progressively aggressive junking and then rejection of your mail.

What's changed since 2024

The rollout was gradual through 2024 — temporary errors first, then increasing rejection of non-compliant traffic. Since then the picture has been evolution, not upheaval:

• Enforcement hardened. Google moved from bouncing a percentage of non-compliant traffic to routine rejection, typically with explicit SMTP errors (e.g., 550 5.7.26 for authentication failures) that make diagnosis easier than the old silent spam-foldering.
• Microsoft joined. In 2025, Outlook.com adopted materially similar requirements for high-volume senders (5,000+/day): SPF, DKIM, and DMARC at p=none or stronger, with non-compliant mail junked and rejection signaled as the eventual consequence. The industry has effectively converged on one standard.
• The thresholds held. As of mid-2026, the 5,000/day trigger, the p=none DMARC minimum, and the 0.3% complaint line remain the published requirements. Expect the direction of travel to be stricter — DMARC enforcement above none is the obvious next ratchet — but that's reading tea leaves, not an announced rule.

Required versus recommended

It's worth being precise, because a lot of coverage blurs this line:

• Required: SPF+DKIM, DMARC at p=none minimum, From alignment, one-click unsubscribe on promotional mail, complaint rate under 0.3%, valid PTR, TLS.
• Recommended, not required: DMARC at quarantine/reject, complaint rate under 0.1%, separating mail streams by subdomain, BIMI. These are good ideas — enforcement just doesn't hinge on them yet.

Practical compliance checklist

1. Verify SPF, DKIM, and DMARC for every sending domain — the free checker shows all three in one lookup, no signup.
2. Confirm alignment: the domain in your From header must match the domain passing DKIM or SPF. Check every third-party tool that sends as you.
3. Set up Google Postmaster Tools for your domain and watch the spam-rate dashboard. Yahoo offers a complaint feedback loop; register for it.
4. Add one-click unsubscribe headers to all promotional mail and confirm your platform honors them within two days.
5. Audit your total daily volume per domain across all tools — you may be a "bulk sender" without any single tool knowing it.
6. Watch complaint rates weekly, and cut or re-permission segments that generate reports.

Compliance is the floor, not the ceiling

Meeting these requirements gets your mail evaluated instead of rejected. Where it lands is still decided by sender reputation — the engagement history attached to your domain and mailboxes. Plenty of fully compliant senders live in the spam folder.

If you're bringing a new domain or mailbox up to standard anyway, EmailWarmer's free plan builds that engagement history for one mailbox, free forever — details on the pricing page.