What Gmail, Yahoo and Outlook now require from bulk senders
The authentication, unsubscribe and spam rate rules Google, Yahoo and Microsoft publish for senders, the dates each took effect, and what missing one costs.
Since 1 February 2024, anyone sending email to personal Gmail accounts has to authenticate it, send it over an encrypted connection and keep the spam rate below 0.3%. Anyone sending more than 5,000 messages a day to Gmail must also publish SPF, DKIM and DMARC, align them with the visible From address, and offer one-click unsubscribe (Google, Email sender guidelines). Yahoo began enforcing a near-identical set of rules the same month (Yahoo Sender Hub).
Microsoft followed for Outlook.com, Hotmail and Live addresses. It announced its rules for domains sending more than 5,000 emails a day on 2 April 2025, with enforcement from 5 May 2025 (Microsoft Tech Community). Miss a rule and mail does not bounce with a friendly explanation. It lands in spam or gets rejected, and the open rate falls for reasons nobody on the team can see.
The short version
- Google and Yahoo require every sender to publish SPF or DKIM, have valid forward and reverse DNS, and keep the spam complaint rate below 0.3%. Google adds TLS encryption to that list for all senders.
- Bulk senders to Gmail and Yahoo must publish both SPF and DKIM, a DMARC record of at least p=none, alignment with the From domain, and a one-click unsubscribe honoured within two days.
- Google defines a bulk sender as one sending close to 5,000 or more messages to personal Gmail accounts in 24 hours. It counts every subdomain under the same primary domain, and says the status is permanent once reached.
- Yahoo does not publish a volume threshold for bulk senders. Microsoft’s rules apply to domains sending more than 5,000 emails a day to its consumer inboxes.
- Google asks senders to keep the spam rate below 0.10% and never reach 0.30%. Since June 2024, bulk senders above 0.3% are ineligible for delivery help until they stay under it for seven consecutive days.
- Google’s rules cover personal Gmail accounts only. They do not apply to mail sent to Google Workspace business accounts.
What do Gmail, Yahoo and Outlook require from every sender?
Every sender to Gmail and Yahoo, whatever the volume, needs at least one authentication method, valid DNS for the sending server and a low complaint rate. Microsoft’s published rules target high-volume domains, and it describes the same practices as worth following at any volume.
| Requirement | Gmail (all senders) | Yahoo (all senders) | Outlook.com |
|---|---|---|---|
| SPF or DKIM | Required | Required | Required above 5,000 a day (both must pass) |
| Valid forward and reverse DNS | Required | Required | Not listed |
| TLS on the connection | Required | Not listed | Not listed |
| Spam complaint rate | Below 0.3% | Below 0.3% | Not published as a number |
| Messages formatted to RFC 5322 | Required | Required, plus RFC 5321 | Not listed |
| No impersonating the provider’s own From domain | Required | Not listed | Not listed |
Sources for each column: Google, Yahoo and Microsoft. Microsoft’s post says that “while enforcement first targets large senders, all senders benefit” from authentication, so a small sender should treat its list as advice rather than something to skip.
What counts as a bulk sender?
Google counts a bulk sender as anyone sending close to 5,000 or more messages to personal Gmail accounts within 24 hours. The count covers the whole primary domain, so 2,500 messages from yourdomain.com and 2,500 from news.yourdomain.com make 5,000 (Google, Email sender guidelines FAQ).
Two details in that FAQ catch people out. The status is permanent: Google says senders who meet the criteria once “are permanently considered bulk senders”, and changing how you send afterwards does not remove it. And it applies to personal Gmail accounts only, not to Google Workspace business accounts.
Yahoo takes a different line. Its FAQ says a bulk sender is one sending “a significant volume of mail” and states that it “will not specify a volume threshold” (Yahoo Sender Hub FAQ). Microsoft’s rules apply to domains sending more than 5,000 emails a day to Outlook.com, Hotmail and Live addresses.
| Provider | Who counts as bulk | Counted how | Source |
|---|---|---|---|
| Gmail | Close to 5,000 or more messages in 24 hours to personal Gmail accounts | All mail from the same primary domain, including subdomains. Permanent once reached | Google FAQ |
| Yahoo | “A significant volume of mail” | At the authenticated domain or From domain. No number published | Yahoo FAQ |
| Outlook.com | More than 5,000 emails a day | Per sending domain, to hotmail.com, live.com and outlook.com addresses | Microsoft |
What do bulk senders have to add?
On top of the rules for everyone, bulk senders to Gmail and Yahoo must authenticate with both SPF and DKIM, publish a DMARC record, align the From domain, and support one-click unsubscribe. Microsoft requires the same three authentication records for its high-volume senders.
| Requirement | Gmail | Yahoo | Outlook.com |
|---|---|---|---|
| SPF and DKIM, both | Required | Required | Required, both must pass |
| DMARC record | Required, p=none is accepted | Required, at least p=none, and DMARC must pass | Required, at least p=none |
| From domain aligned with SPF or DKIM | Required | Required, relaxed alignment accepted | Required, preferably both |
| One-click unsubscribe (RFC 8058 header) | Required on marketing and subscribed mail | Required, the POST method “highly recommended” | Recommended as a functional unsubscribe link |
| Visible unsubscribe link in the body | Required | Required, may lead to a preference page | Recommended |
| Unsubscribe honoured within | 48 hours | 2 days | Not published |
| Spam complaint rate | Below 0.30% | Below 0.3% | Not published as a number |
The Gmail column comes from Google’s sender guidelines and its FAQ, which lists unsubscribe requests not honoured within 48 hours as a failure. Yahoo’s column is from its requirements page. The one-click mechanism itself is defined in RFC 8058, published by the IETF in 2017.
When did each rule take effect?
The dates matter because a lot of advice written about these rules predates enforcement, and some of it describes rules that have since changed.
| Date | What changed | Provider | Source |
|---|---|---|---|
| December 2023 | TLS added to the requirements for all senders | ||
| 1 February 2024 | Requirements for all senders and for senders of 5,000 or more a day take effect | ||
| February 2024 | Enforcement begins, rolled out gradually through the first half of the year | Yahoo | Yahoo |
| 1 June 2024 | Deadline for senders who already had an unsubscribe link to add one-click unsubscribe | Google FAQ | |
| June 2024 | Bulk senders above 0.3% spam rate become ineligible for mitigation | Google FAQ | |
| 2 April 2025 | Requirements for domains sending over 5,000 a day announced | Microsoft | Microsoft |
| 5 May 2025 | Enforcement begins. An update to the post on 29 April 2025 says failing mail is rejected with error 550 5.7.515 | Microsoft | Microsoft |
| November 2025 | Gmail ramps up enforcement, including temporary and permanent rejections of non-compliant mail | Google FAQ |
Microsoft’s post first said failing mail would be routed to Junk and rejected at a later date. The 29 April update changed that to rejection. Both paragraphs are still on the page, so read the update note at the top before relying on either.
The three records, in order
SPF is a DNS record listing which servers are permitted to send mail as your domain. It is the oldest and the easiest, and it breaks when a business adds a new sending tool and nobody updates the record.
DKIM signs each message cryptographically so the receiving server can confirm it was not altered and did come from you. Your email platform generates the keys and you publish them in DNS.
DMARC sits on top and tells receiving servers what to do when the first two fail. It also generates reports listing everything sending as your domain, which for many businesses is the most useful thing about it. Yahoo strongly recommends a “rua” reporting address for exactly that reason (Yahoo).
Do them in that order. A DMARC record published over broken SPF and DKIM tells receivers to distrust your own mail.
Photo: cottonbro studio on Pexels.
Why does DMARC fail when SPF and DKIM pass?
Because the domain the recipient sees in the From line has to match the domain that was authenticated. Google puts it plainly: the From domain “must be aligned with either the SPF domain or the DKIM domain” to pass DMARC (Google).
This is where mail sent through a third-party platform fails. The platform authenticates its own domain, everything technically passes, and DMARC still fails because the visible sender is you and the authenticated sender is them.
The fix is to authenticate your own domain inside the platform. The platforms we work with all support it, and on several of them it is not the default.
What does the unsubscribe rule actually require?
Two separate things. A List-Unsubscribe header that supports one-click unsubscribe, and a clearly visible unsubscribe link in the body of the message (Google).
The one-click header, defined in RFC 8058, lets the inbox show an unsubscribe control at the top of the message. Google says mailto and plain URL links do not meet its one-click requirement (Google FAQ). Yahoo accepts the mailto method but “highly” recommends the POST method from RFC 8058.
The link in the body is the ordinary one. Yahoo says the process should be obvious and visible and should not require the recipient to log in (Yahoo). A preference centre behind a sign-in fails that test, and in our experience a recipient who cannot leave easily presses the spam button instead.
Transactional messages are outside the one-click requirement. Google gives password resets, reservation confirmations and form submission confirmations as examples (Google FAQ).
How low does the spam complaint rate have to be?
Google tells senders to keep the rate reported in Postmaster Tools below 0.10% and to avoid ever reaching 0.30% (Google). Yahoo sets 0.3% for everyone and says its rate is calculated on mail delivered to the inbox (Yahoo).
| Complaint rate | Google’s status | What it means in practice |
|---|---|---|
| Below 0.10% | The level Google asks you to stay under | One complaint per thousand messages or fewer |
| 0.10% to 0.30% | Above the recommended level | Google says rates above 0.1% already hurt inbox delivery for bulk senders |
| 0.30% and above | Above the requirement | Bulk senders lose eligibility for mitigation until seven consecutive days back below 0.3% |
The middle and bottom rows come from Google’s FAQ, which also says spam rate is calculated daily. “Mitigation” there means Google’s delivery support for senders with problems.
Those numbers are smaller than they look. At 0.3%, three people in a thousand pressing report spam is enough. On a list of twenty thousand, that is sixty people.
The rate is visible in Google Postmaster Tools, which is free and needs only a DNS verification. If you send any volume to Gmail and have not set it up, start there. It is the one direct view you have of the number Gmail uses.
Photo: Field Engineer on Pexels.
How to use these numbers
- Check your own records first rather than assuming your platform handles it. Many platforms authenticate their own sending domain by default, and mail sent as your domain without your own records is the failure we see most often.
- Set DMARC to a policy of none first and read the reports for a month before tightening it. Microsoft advises the same gradual path, none to quarantine to reject (Microsoft). Going straight to reject without looking is how businesses discover their invoicing system was also sending as their domain.
- Watch the complaint rate in Google Postmaster Tools rather than inferring it from open rates. It is the number Google publishes a limit for, and the only one of these you can see directly.
- Count every subdomain toward the Gmail threshold. Google adds them all to the primary domain, so splitting marketing onto a subdomain does not keep you under 5,000.
- Treat a sudden drop in engagement as a deliverability question before treating it as a content question. Rewriting subject lines will not fix mail that is not arriving.
Where the figures come from
Every row is a published requirement from the mailbox provider itself: Google’s sender guidelines and FAQ, Yahoo’s Sender Hub, and Microsoft’s announcement on its Tech Community blog. Nothing here is measured, estimated or averaged by us.
Where a provider states a requirement without a number, the table says so rather than inventing one. Where the three differ, each is listed separately rather than merged into a single figure. These are rules each provider applies to mail arriving at its own inboxes, so they describe policy rather than any population of senders.
What these requirements do not tell you
- Meeting every requirement gets you past the gate. It does not get you into the inbox, which also depends on engagement, list quality and complaint history.
- The providers enforce at their own pace and do not publish enforcement data. The practical consequence of missing one rule varies, and nobody outside those companies can quantify it.
- These rules have changed several times since 2023 and will change again. Yahoo says its requirements “are subject to change”. Recheck the source pages before relying on any row here.
- Google’s rules apply to personal Gmail accounts, not to Google Workspace business accounts. Business inboxes run filtering of their own that is not published.
Last checked against the sources on 30 September 2026.
The bottom line
The rules are public, specific and checkable, which makes them the cheapest part of deliverability to get right. Authenticate your own domain, align it with the From address, make leaving easy, and watch the one complaint number Google shows you. Everything else in email works better once those four are true.
Questions people ask about this
Do these rules apply if I only send a few hundred emails a month?
The rules for all senders apply to everyone who mails Gmail or Yahoo: SPF or DKIM, valid DNS, a spam rate below 0.3%, and TLS for Gmail. The bulk rules start near 5,000 messages a day to Gmail, and Yahoo does not publish its threshold. A small sender should set all of them up anyway, because the work is the same one afternoon either way. Crossing the threshold during a campaign without the records in place is a bad way to find out.
Is DMARC alone enough?
No. DMARC is a policy that tells receiving servers what to do when SPF and DKIM fail, so it does nothing on its own. The order is SPF and DKIM first, verified as passing and aligned with your visible From domain, then DMARC to state the policy. A DMARC record published over broken authentication makes things worse rather than better.
What counts as a complaint?
Somebody pressing the report spam button in their inbox. Unsubscribes do not count, which is why making the unsubscribe easy to find is a deliverability measure rather than a courtesy. A recipient who cannot find the unsubscribe link may use the spam button instead, and a complaint costs you far more than losing the subscriber.
Does this apply to transactional email like receipts and password resets?
The authentication requirements apply to all mail. Google’s FAQ says one-click unsubscribe is required only for marketing and promotional messages, and names password resets, reservation confirmations and form submission confirmations as transactional examples. Yahoo recommends keeping marketing mail on separate IPs or DKIM domains from transactional mail, so a bad campaign does not drag down your receipts.
How do I check whether my domain is authenticated?
Send a message from your platform to a Gmail address you control, open it, and choose show original from the menu. The header summary shows SPF, DKIM and DMARC with a pass or fail beside each, plus the domain each one checked. If the DKIM domain is your platform’s rather than yours, alignment is failing. Repeat the test for each tool that sends as your domain, including invoicing and support software.
Which DMARC policy should I start with?
Start with none, which changes nothing about delivery and only switches on reporting. Read the reports for a month to see every service sending as your domain, then fix the ones failing alignment. Move to quarantine once the legitimate senders all pass, and to reject only after a further clean period. Microsoft recommends the same gradual path. Jumping straight to reject is how a business silently loses its own receipts and password resets.
How do I set up Google Postmaster Tools?
Sign in with a Google account, add your sending domain, and publish the DNS verification record it gives you. Data appears once you send enough Gmail volume for Google to report on it, so a very small sender may see empty dashboards. The spam rate panel is the one to check weekly, since Google calculates it daily. If you send from a subdomain, check that its data appears and add it if it does not.
What happens if my complaint rate goes above the limit?
Google says rates above 0.1% already hurt inbox delivery for bulk senders, and above 0.3% you lose eligibility for mitigation until the rate stays below 0.3% for seven consecutive days. Stop non-essential sending, find the segment that generated the complaints, and remove it. Then send only to your most engaged contacts until Postmaster Tools shows the rate back under the target. Google warns that improvements can take time to show up in how your mail is classified.
Do I need a separate domain for marketing email?
A separate subdomain is the sensible middle ground. Marketing from a subdomain such as news.yourdomain.com keeps its sending reputation apart from the main domain that carries your invoices, quotes and replies. It does not keep you under Gmail’s bulk threshold, because Google counts subdomains toward the primary domain. Each subdomain needs its own SPF record and DKIM signing, and inherits the main domain’s DMARC policy unless you publish one for it.
Will my email platform handle all of this for me?
Only part of it. Many platforms authenticate their own shared domain by default, which passes SPF and DKIM but fails alignment with your From address. You have to add your own domain inside the platform and publish the records it generates. The platform can add the one-click unsubscribe header, but honouring requests within two days and keeping complaints low is still on you and your list.
How do I know if I count as a bulk sender?
Add up messages sent to personal Gmail addresses on your busiest day, across every tool and subdomain sending as your domain. If that total gets close to 5,000, Google treats you as a bulk sender, and it says the status is permanent once reached. Microsoft uses more than 5,000 a day to its consumer inboxes, and Yahoo publishes no number. Since the setup is identical either way, the safer choice is to meet the bulk rules regardless of volume.
Can I send marketing email from a Gmail or Outlook address?
Not as your From address on a marketing platform. Google tells senders not to impersonate Gmail From headers and says Gmail applies a DMARC quarantine enforcement policy, so mail claiming to come from gmail.com but sent from elsewhere is treated as spoofing. Use your own domain. If you do not have one, registering one and connecting it to your platform is a small job and the only route that passes the checks.
Free review
Want this looked at on your own site?
Send the address. A person reads it and writes back with the two or three things that would move your enquiry number first. Free, and yours to keep whether you hire us or not.
