Since February 2024, Gmail and Yahoo require bulk senders to authenticate with SPF and DKIM, publish a DMARC record that passes with alignment, offer one-click unsubscribe and keep spam complaints below 0.3%. Every sender, bulk or not, also needs SPF or DKIM, valid reverse DNS and a low spam rate, and Gmail requires an encrypted (TLS) connection.
Who counts as a bulk sender
Gmail defines a bulk sender as anyone who sends close to 5,000 messages or more to personal Gmail accounts within 24 hours. Three details catch people out:
- Google counts all email from the same main domain. 2,500 emails from yourbusiness.com and 2,500 from news.yourbusiness.com add up to 5,000.
- The status is permanent. Google says bulk sender status has no expiry date, even if your volume drops later.
- The count is for personal Gmail accounts. Google says the requirements and enforcement apply only to email sent to personal Gmail accounts, not to Google Workspace accounts.
Yahoo doesn't give a number. Its FAQ describes a bulk sender as one sending "a significant volume of mail" and says it won't specify a threshold.
If you send a newsletter, promotions or regular campaigns, assume the bulk rules apply to you.
Rules for every sender
| Requirement | Gmail | Yahoo |
|---|---|---|
| SPF or DKIM passes | Required | Required |
| Valid forward and reverse DNS (PTR) for sending servers | Required | Required |
| Spam rate below 0.3% | Required, and Google recommends below 0.1% | Required |
| Encrypted (TLS) connection | Required | Not listed |
| Correctly formatted messages (RFC 5322) | Required | Required, with RFC 5321 |
Reverse DNS means the sending server's address points back to a proper hostname, and that name points to the same address. Your email service handles this and TLS, so you rarely need to act. If you run your own mail server, check both.
Extra rules for bulk senders
| Requirement | Gmail | Yahoo |
|---|---|---|
| SPF and DKIM both set up | Required | Required |
| A DMARC record, p=none or stronger | Required | Required |
| DMARC passes, with your From domain aligned with SPF or DKIM | Required | Required |
| One-click unsubscribe on marketing email | Required | Required |
| Visible unsubscribe link in the message | Required | Required |
| Unsubscribes honored within 2 days | Recommended within 48 hours | Required within 2 days |
Authentication and alignment
SPF is a DNS record listing the servers allowed to send for your domain. DKIM is a digital signature proving the email came from your domain. DMARC is a DNS record that tells mailboxes what to do when those checks fail.
Alignment means SPF or DKIM must pass for the same domain as your From address. This is the rule most small businesses miss. If Mailchimp, HubSpot or Shopify signs your email with its own domain, DKIM passes but doesn't align, and DMARC fails. Authenticating your domain in each service fixes it.
A DMARC record of p=none is enough for both providers:
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourbusiness.com
Change the rua address to a mailbox you read. Once reports show all your genuine email passing, move to p=quarantine.
One-click unsubscribe (RFC 8058)
One-click unsubscribe lets someone leave your list from the unsubscribe button Gmail or Yahoo shows, without visiting a page or logging in. Gmail asks for both of these headers in marketing email:
List-Unsubscribe: <https://…>List-Unsubscribe-Post: List-Unsubscribe=One-Click
RFC 8058 also says the email's DKIM signature must cover both headers, which is one more reason DKIM matters. Yahoo calls the Post method from RFC 8058 "highly recommended" and accepts the mailto method too. Both also want a clearly visible unsubscribe link in the body.
The rule covers marketing and subscribed messages. Gmail says transactional messages, such as receipts and password resets, are excluded.
Yahoo requires unsubscribes to be honored within 2 days. Google recommends 48 hours, and senders who miss it lose access to Google's delivery support. Most email marketing platforms add these headers for you, but check with yours.
Spam complaint rate
Gmail measures the share of your email that recipients mark as spam, shown in Google Postmaster Tools. Keep it below 0.1% and never let it reach 0.3%. Since June 2024, bulk senders above 0.3% can't get help from Google's delivery support. Yahoo also asks for a spam rate below 0.3%.
When it was enforced
- February 2024: Gmail and Yahoo began enforcing the authentication rules.
- June 2024: one-click unsubscribe became mandatory for Gmail and Yahoo, and Gmail stopped offering help to bulk senders above 0.3%.
- November 2025: Gmail stepped up enforcement. Email that fails the requirements now faces disruption, including temporary and permanent rejections. A bounce such as 550 5.7.26, which means Gmail couldn't authenticate the email, is a common sign.
What we check, and what we don't
One test email shows whether you meet the technical rules: SPF, DKIM, DMARC and alignment, and reverse DNS. You get a verdict for Gmail, Google Workspace, Outlook.com, Microsoft 365 and Yahoo, including whether you're ready for bulk sending, with the exact record to fix.
Your spam complaint rate and how quickly you remove unsubscribes depend on your list and your sending platform, not on one message. Encryption (TLS) is handled by your email service's servers, so check it with them. Check spam rate in Google Postmaster Tools, and check unsubscribe handling with your platform.
Checked against: Google Workspace Admin Help, Email sender guidelines · Google Workspace Admin Help, Email sender guidelines FAQ · Yahoo Sender Hub, Sender best practices · Yahoo Sender Hub, FAQs · RFC 8058, Signaling One-Click Functionality for List Email Headers.