Gmail & Yahoo Bulk Sender Requirements Checklist

Quick answer

If you send marketing email to Gmail or Yahoo at volume you need, as of the providers' own pages: SPF and DKIM both passing, a DMARC record (at least p=none) with the From domain aligned to SPF or DKIM, one-click unsubscribe (RFC 8058) plus a visible link honoured within 48 hours (Gmail) or 2 days (Yahoo), and a spam rate under 0.3% (Gmail: aim for under 0.1%). Gmail's bulk threshold is close to 5,000 messages a day to personal Gmail accounts and, once reached, is permanent. Gmail has been rejecting non-compliant traffic more aggressively since November 2025.

Google and Yahoo announced their sender requirements in October 2023 and began applying them on February 1, 2024. Since then the enforcement has moved from warnings to disruption: Google's FAQ states that starting November 2025 Gmail is ramping up enforcement and that non-compliant messages "will experience disruptions, including temporary and permanent rejections". This page is the checklist version: what each provider actually asks for, how to verify each item yourself, and what to fix when one fails. Every requirement below is taken from the providers' own pages, read in October 2026; they change, so re-check the sources linked at the end.

Who the rules apply to

All senders to Gmail must meet the baseline: SPF or DKIM, valid forward and reverse DNS, TLS, RFC 5322 formatting and a spam rate under 0.3%.
Bulk senders are those sending close to 5,000 messages or more to personal Gmail accounts within a 24-hour period. Messages from the same primary domain are counted together: 2,500 from example.com plus 2,500 from promo.example.com make a bulk sender. Once the threshold is reached, Google states that bulk-sender status is permanent.
Yahoo uses the term "bulk senders" without publishing a numeric definition, and treats the authentication and unsubscribe rules the same way.

Plan for compliance before you reach the threshold, not after. Google also says new domains (those that have not sent more than 5,000 a day since January 1, 2024) face an accelerated timetable.

The requirements at a glance

Requirement	Gmail	Yahoo	How to verify
SPF and DKIM	SPF or DKIM for everyone; both for bulk	SPF or DKIM minimum; both for bulk	Checker + message headers
DKIM key length	At least 1024 bits, 2048 recommended	At least 1024 bits	The `p=` value of the DKIM record
DMARC record	Required for bulk; `p=none` is enough	Required for bulk; at least `p=none` and passing	DNS lookup of `_dmarc.yourdomain`
Alignment	From domain aligns with SPF or DKIM domain	Same; relaxed alignment accepted	`Authentication-Results` header
Valid forward and reverse DNS (PTR)	Required	Required	`dig -x <ip>` and back
TLS	Required	Not mentioned on its requirements page	`with ESMTPS` in `Received`
Spam rate	Below 0.30%; keep below 0.10%	Below 0.3% (of mail delivered to inbox)	Postmaster Tools / complaint feedback loop
One-click unsubscribe	Required for marketing mail; mailto alone is not enough	Required; RFC 8058 POST highly recommended	Headers + test unsubscribe
Visible unsubscribe link	Required	Required	Message body
Honour unsubscribe	Within 48 hours	Within 2 days	Process audit
Message format (RFC 5322)	Required	RFCs 5321 and 5322	Header analyzer

1. Authenticate with SPF and DKIM

SPF authorises the servers allowed to send for your domain; DKIM signs each message so providers can detect tampering. Bulk senders need both. If you use several platforms (your mailbox provider, a newsletter tool, a CRM), each one must be covered by SPF and sign with DKIM. Start with a check of the domain:

SPF, DKIM & DMARC CheckerRecursive SPF with the 10-lookup limit, DKIM keys and DMARC policyOpen the tool →

Watch for the two most common SPF failures: more than 10 DNS lookups (a permerror) and multiple SPF records on one domain. Both are explained in our SPF lookup limit guide, and building one correct record for several providers is covered in SPF record for multiple providers.

2. Publish a DMARC record and align the From domain

A minimal record satisfies the requirement and starts collecting reports:

_dmarc.example.com.  IN  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

Alignment is the part people miss. For direct mail, the organizational domain in the visible From address must align with the SPF domain or the DKIM domain; only one has to align, though Google recommends aligning both and says full alignment will likely become a requirement. Forwarded and mailing-list mail (indirect mail) is exempt from the alignment check. If a platform signs with its own domain, set up a custom DKIM domain for it. Once your reports show only legitimate sources, move to p=quarantine and then p=reject gradually. See the practical SPF, DKIM and DMARC guide.

3. Add one-click unsubscribe

Marketing and subscribed messages need the List-Unsubscribe and List-Unsubscribe-Post headers, plus a visible link in the body, and requests must be honoured quickly. Google specifies that mailto links and plain URL links do not satisfy the requirement. Senders that already had unsubscribe links were given until June 1, 2024 to implement one-click. Our walkthrough covers the endpoint and DKIM signing details: List-Unsubscribe header: one-click setup.

List-Unsubscribe GeneratorOne-click unsubscribe headers per RFC 2369 and RFC 8058 with Gmail and Yahoo requirementsOpen the tool →

4. Keep spam complaints under 0.3% (target under 0.1%)

Gmail's spam rate is the share of messages users mark as spam, calculated daily in Google Postmaster Tools. Google recommends staying under 0.10% and never reaching 0.30%. Since June 2024, a bulk sender above 0.30% becomes ineligible for mitigation, and eligibility returns only after the rate stays below 0.30% for 7 consecutive days. Yahoo calculates its rate only from mail delivered to the inbox, so your own numbers need the same denominator. To reduce complaints:

Send only to people who opted in, and remove inactive contacts after a re-engagement attempt.
Make unsubscribing easier than reporting spam.
Match content and frequency to what people signed up for.
Clean lists before large sends (see the email validation guide).

Track your own complaint and bounce rates alongside the provider dashboards:

Email Metrics CalculatorDelivery, open, click, bounce and complaint rates with 95% confidence intervals and consistency warningsOpen the tool →

5. Check the infrastructure basics

Reverse DNS (PTR): the sending IP must have a PTR record whose hostname resolves back to the same IP (forward-confirmed reverse DNS). Yahoo adds that the name should be meaningful and non-generic, not an auto-generated pattern.
TLS: use TLS for SMTP transport. Check with ESMTPS in Received headers.
Do not impersonate gmail.com in your From address; use your own domain.
Format messages according to RFC 5322 with a valid Date, Message-ID and a single From.
Segregate streams (Yahoo): do not mix bulk marketing with transactional mail on the same IPs or DKIM domains.

What failure looks like

Gmail returns specific SMTP codes and reasons, which also appear in Postmaster Tools. Temporary failures use codes in the 4.7.x family (4.7.23, 4.7.27, 4.7.29, 4.7.30, 4.7.31, 4.7.32) and rejections use 5.7.25, 5.7.27, 5.7.29 and 5.7.30. Authentication, alignment, TLS, formatting and DNS failures lead to temporary or permanent failures or spam foldering; spam-rate, DMARC and unsubscribe failures make delivery support or mitigation unavailable. A bounce containing one of these codes is your cue to check the matching row of the table above first.

What about Outlook and Microsoft?

Microsoft announced similar requirements for senders of more than 5,000 emails a day to its consumer addresses (outlook.com, hotmail.com, live.com), with enforcement beginning on May 5, 2025: SPF, DKIM and a DMARC policy of at least p=none, with non-compliant mail first routed to Junk. Secondary reports describe rejection at SMTP for continued non-compliance. Microsoft's announcement was revised after publication, so confirm the current behaviour on Microsoft's own sender pages. The practical conclusion is the same: authenticate everything and treat these requirements as the industry baseline, not a Gmail-only rule.

A 15-minute self-audit

Run your domain through an SPF/DKIM/DMARC checker and fix any permerror or missing record.
Send a test to Gmail, open Show original and confirm SPF, DKIM and DMARC all say pass with your From domain (see how to read email headers).
Confirm the unsubscribe headers are present and DKIM-signed.
Open Postmaster Tools and check domain reputation and spam rate.
Review last month's complaint rate and bounce rate per platform.

Frequently asked questions

When did the Gmail and Yahoo sender requirements start?

They were announced in October 2023 and applied from February 1, 2024. Google says it has been ramping up enforcement on non-compliant traffic since November 2025, with temporary and permanent rejections.

Do the requirements apply if I send fewer than 5,000 emails a day?

The strictest rules (DMARC, one-click unsubscribe) formally apply to bulk senders, but authentication, valid DNS, TLS and a low spam rate apply to every sender and are strongly recommended.

Is p=none enough for DMARC?

Yes. Google states the policy can be set to none, and Yahoo requires a policy of at least p=none that passes. Moving to quarantine or reject improves protection against spoofing.

Does using a third-party email service provider exempt me?

No. The requirements apply to the sending domain, so you must configure SPF, DKIM, DMARC and unsubscribe in your ESP so that they align with your From domain.

How do I check my spam complaint rate?

Use Google Postmaster Tools for Gmail. For Yahoo, use its complaint feedback loop and compare with the rates your ESP reports, remembering that Yahoo counts only mail delivered to the inbox.

References & further reading

Written and reviewed by the Axvoid Tools team. We test every tool and cite the standards we rely on; corrections are welcome at admin@axvoid.com. Editorial & Accuracy Policy.