Gmail and Yahoo Bulk Sender Requirements: What Changed and How to Comply

In February 2024 Google and Yahoo started enforcing a common set of rules for anyone sending email to their users. Microsoft followed with similar requirements for Outlook.com in 2025. Enforcement has tightened steadily since: messages that fail the rules are increasingly rejected outright instead of just landing in spam. If you send marketing or transactional email at any real volume, these rules now define the baseline.

Who counts as a bulk sender?

Google defines a bulk sender as anyone who has sent close to 5,000 or more messages per day to personal Gmail accounts. Messages sent from all subdomains of your primary domain count together, and once you are classified as a bulk sender the status is permanent. Yahoo uses a similar, less precisely defined threshold. The safest approach is to meet the bulk requirements regardless of your volume.

Requirements for all senders

• Set up SPF or DKIM authentication for your sending domain
• Make sure sending IPs have valid forward and reverse DNS (PTR) records
• Use a TLS connection when transmitting email
• Keep the spam complaint rate reported in Google Postmaster Tools below 0.3%
• Format messages according to RFC 5322 and do not impersonate Gmail From: headers

Additional requirements for bulk senders

• Authenticate with both SPF and DKIM
• Publish a DMARC record for your sending domain — p=none is the minimum accepted policy
• Ensure DMARC alignment: the domain in the From: header must match either the SPF domain or the DKIM signing domain
• Include one-click unsubscribe (RFC 8058 List-Unsubscribe and List-Unsubscribe-Post headers) in marketing and subscribed messages, plus a visible unsubscribe link in the body
• Process unsubscribe requests within 2 days

What a minimal compliant DNS setup looks like

For a domain that sends through Google Workspace and a marketing platform, the records typically look like this (replace the includes and DKIM selectors with the ones your providers give you):

example.com.              TXT  "v=spf1 include:_spf.google.com include:sendgrid.net ~all"
google._domainkey         TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkq..."
s1._domainkey             CNAME s1.domainkey.u123456.wl.sendgrid.net.
_dmarc.example.com.       TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

The spam rate is the hardest part

Authentication is a one-time setup, but the complaint rate depends on your list and your content every single day. Google recommends staying below 0.1% and treats anything at or above 0.3% as a serious problem. Only send to people who explicitly opted in, remove inactive subscribers regularly, make unsubscribing easier than clicking "Report spam", and register your domain in Google Postmaster Tools to see the rate Google actually measures.

Compliance checklist

• SPF record exists, is valid and stays under 10 DNS lookups
• DKIM signing is enabled for every service that sends as your domain
• DMARC record is published with a rua address so you receive reports
• From: domain aligns with SPF or DKIM for every sending source
• One-click unsubscribe headers are present in marketing mail
• Sending IPs have matching PTR records and are not on major blacklists
• Spam rate in Postmaster Tools is consistently below 0.1%

Our domain checker verifies the DNS side of this list — SPF, DKIM, DMARC, reverse DNS and blacklist status — in a single run, so you can confirm your setup before the mailbox providers do it for you.