The short answer: Since February 2024, anyone sending more than 5,000 messages a day to Gmail must authenticate with SPF, DKIM and DMARC, make sure the From domain aligns with SPF or DKIM, support one-click unsubscribe (RFC 8058) for marketing mail, honour unsubscribes within two days, and keep the spam rate below 0.30%, ideally below 0.10%. Yahoo applies near-identical rules. Microsoft added its own in May 2025.
If you send newsletters, promotions, or product announcements from your own domain, these rules apply to you at volume, and they are sensible practice at any size. This guide lists each requirement, how to meet it, and how to verify it.
What Counts as a Bulk Sender?
Google defines a bulk sender as one who sends more than 5,000 messages in a day to Gmail accounts. Some details matter:
- The count covers all mail from your primary domain, including subdomains, added together. Splitting traffic across
news.example.comandmail.example.comdoes not reset the count. - It counts messages sent to personal Gmail addresses (
@gmail.comand@googlemail.com). Google Workspace recipients are not part of the bulk count, though good practice applies to them as well. - You only need to cross the threshold once. Google's documentation says that once a domain has been classed as a bulk sender, it is treated as one permanently. Do not assume you can drop back below 5,000 and relax.
- Yahoo and Microsoft use their own measurements but quote the same 5,000-a-day figure for their consumer domains.
Google also sets a baseline for all senders, including small ones: SPF or DKIM authentication, valid forward and reverse DNS for sending IPs, TLS, RFC 5322 message formatting, and a spam rate under 0.30%. Mail that fails these may be rejected or sent to spam even at low volume.
The Core Requirements
1. SPF, DKIM and DMARC
Bulk senders need all three. Yahoo's wording is that bulk senders must use both SPF and DKIM, and publish a DMARC policy of at least p=none. Google's is the same, noting that the DMARC policy can be none.
A minimal DMARC record:
_dmarc.example.com. IN TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"
You do not need quarantine or reject to comply, although those policies give real protection against spoofing. See the DMARC policy guide for how to progress.
2. Alignment
DMARC must pass, which means the domain in the visible From: address has to align with either the SPF domain (the envelope sender) or the DKIM signing domain (d=). This is where most third-party platforms fail: they sign with their own domain until you configure a custom one. Our DKIM signature failed article covers the common causes.
3. One-click unsubscribe
Marketing and subscribed messages must support one-click unsubscribe as defined in RFC 8058 and also contain a visible unsubscribe link in the body. Technically that means two headers:
List-Unsubscribe: <https://example.com/unsub/abc123>, <mailto:unsub@example.com?subject=unsubscribe>
List-Unsubscribe-Post: List-Unsubscribe=One-Click
The HTTPS endpoint must accept a POST and unsubscribe the recipient without a login or confirmation page. Transactional messages such as receipts and password resets are not subject to the one-click requirement. Both Google and Yahoo expect requests to be processed within two days.
4. Spam rate
Google says to keep the user-reported spam rate in Postmaster Tools below 0.10% and avoid ever reaching 0.30%. Yahoo says to keep spam complaints below 0.3%. At 0.10%, that is one complaint per 1,000 inbox deliveries. Google also notes that senders who go above 0.30% lose eligibility for mitigation until the rate falls back below that line for a sustained period.
5. Sending infrastructure
Google asks for TLS for transmission, valid forward and reverse DNS (PTR) records for sending IPs, and RFC 5322-compliant messages. Do not impersonate Gmail From headers, because gmail.com has its own DMARC policy. Forwarders and mailing lists should add ARC headers so authentication survives (see reading email headers for what ARC looks like).
What About Microsoft?
Microsoft announced requirements for high-volume senders to Outlook.com, Hotmail.com and Live.com, with enforcement beginning May 5, 2025. The reported threshold is again more than 5,000 emails a day. Requirements:
- SPF passes for the sending domain
- DKIM passes
- DMARC published with at least
p=none, and aligned with SPF or DKIM - Valid, working sender and reply addresses and a functional unsubscribe mechanism for marketing mail
Microsoft says non-compliant mail is rejected rather than simply junked. Check Microsoft's current sender documentation for exact error codes and enforcement detail, because those have been updated since announcement. Microsoft's rules apply to its consumer mail service. They are separate from Microsoft 365 tenant authentication.
What Happens If You Don't Comply?
Google began with temporary errors in 2024 and said it would escalate. Reporting on Google's November 2025 change describes enforcement moving to rejection of non-compliant mail, using temporary (4xx) failures that rate-limit traffic and permanent (5xx) failures that block it. Effects you may see:
- Messages landing in spam even with a good reputation
- Throttled sending, with deferrals during peak times
- Bounces mentioning authentication, DMARC or unsolicited mail policy
- Falling inbox placement without any changes on your side
Non-compliance rarely appears as a clean error. It appears as a slow decline in delivery, which is why checking proactively matters. If mail is already misbehaving, see why emails go to spam.
Requirement, How to Meet It, How to Verify It
| Requirement | How to meet it | How to verify |
|---|---|---|
| SPF published and passing | One SPF record listing every sender, under 10 lookups, ending ~all or -all |
SPF checker; spf=pass in message headers |
| DKIM signing | Enable DKIM in each sending platform with a custom domain, publish the selector key | DKIM checker; dkim=pass header.d= your domain |
| DMARC published | Add _dmarc TXT, at least p=none, with a rua address |
DMARC checker |
| Alignment | Custom DKIM domain or a custom return-path/envelope domain on your own domain | dmarc=pass in headers; DMARC reports |
| One-click unsubscribe | Add List-Unsubscribe and List-Unsubscribe-Post, with a working POST endpoint |
Inspect a sent message in the header analyzer |
| Unsubscribes honoured in 2 days | Suppress automatically on request | Test unsubscribe, then confirm no further mail |
| Spam rate under 0.10% | Send to engaged, consenting recipients; clean the list; warm up new domains | Google Postmaster Tools |
| TLS, PTR, RFC 5322 | Use a reputable provider or set rDNS on your own IPs | Provider docs; TLS in the Received line |
How the Free Bulk Sender Compliance Checker Works
The bulk sender compliance checker takes a domain and reports against these requirements, using three checks it can verify from public DNS:
- SPF published and authenticating (it flags a record that is missing or weak)
- DKIM signing key published (it looks for known selectors, so a custom selector it does not know may be missed)
- DMARC record published and its policy
It then lists three items as manual checks, because DNS cannot prove them:
- DMARC alignment on real mail: confirmed from aggregate reports or a sent message
- One-click unsubscribe headers: paste a sample message into the email header analyzer
- Spam complaint rate: visible only in Google Postmaster Tools and Microsoft's SNDS
The tool's verdict reflects the automated DNS checks only. A pass does not mean full compliance, only that the DNS foundation is in place. If DKIM shows as missing, test your platform's actual selector with the DKIM checker before concluding that signing is absent.
Common Compliance Mistakes
| Symptom | Likely cause | Fix |
|---|---|---|
dmarc=fail although SPF passes |
SPF passes for the platform's bounce domain, not yours | Configure a custom return-path domain, or enable custom-domain DKIM |
dkim=pass but header.d= is the platform's domain |
Default shared signing key in use | Publish the platform's CNAME or TXT records for your own domain |
Unsubscribe link works, but no List-Unsubscribe-Post header |
Link-only unsubscribe in the footer | Enable one-click or header-based unsubscribe in the platform, or add the headers in your MTA |
SPF permerror |
More than 10 lookups or two SPF records | Flatten or prune; see too many DNS lookups |
| Compliant DNS but rising spam rate | Old or unengaged list, no consent trail | Suppress inactive contacts, send more slowly |
| Postmaster Tools shows no data | Too little Gmail volume or domain not verified | Verify the exact sending domain; low volume is normal |
Check each sending source separately. A company often has a marketing platform, a CRM, a billing system and a help desk all sending as the same domain. One unauthenticated source is enough to produce failures, and DMARC aggregate reports show exactly which source it is.
A Practical Rollout Order
- Inventory every system that sends as your domain. Aggregate reports from a
p=nonerecord reveal ones you forgot. - Fix SPF so it includes every legitimate source without exceeding the lookup limit.
- Enable custom DKIM on each platform and confirm the signing domain is yours.
- Publish DMARC at
p=nonewith reporting, wait for a couple of weeks of data and confirm alignment for every source. - Add one-click unsubscribe to all marketing streams and test it with a real message.
- Watch Postmaster Tools weekly. Act when the spam rate approaches 0.10%, not 0.30%.
- Move toward enforcement once reports are clean, using the DMARC generator to build each step of the record.
Frequently Asked Questions
Do the Google and Yahoo requirements apply if I send fewer than 5,000 emails a day?
The stricter bulk requirements formally apply above 5,000 messages a day to Gmail. Google's baseline rules (authentication, TLS, formatting, spam rate) apply to everyone, and mail without authentication is increasingly filtered at any volume.
Do I need p=reject or p=quarantine for Google and Yahoo?
No. A DMARC policy of p=none meets the requirement, provided DMARC passes through alignment. Enforcement policies are still worthwhile for stopping spoofing.
Does transactional email need one-click unsubscribe?
Google and Yahoo's one-click rule targets marketing and subscribed messages. Transactional mail such as receipts, password resets and account alerts is not expected to carry it, though adding it does no harm.
How do I check my spam rate?
Add your sending domain to Google Postmaster Tools. It reports the user-reported spam rate for mail delivered to Gmail, but only shows data once you send enough volume to Gmail users.
What is RFC 8058?
It is the standard that defines one-click unsubscribe over HTTPS. A sender adds List-Unsubscribe-Post: List-Unsubscribe=One-Click, and the mail client can then POST to the URL in List-Unsubscribe with no further interaction.
What is the penalty for failing the requirements?
Throttling, spam-folder placement or rejection by Gmail, Yahoo and Outlook.com, with no fine involved. The effect is lost delivery rather than a formal sanction.
Next step: Run your domain through the bulk sender compliance checker, then confirm the manual items with a real message. If you would like it set up correctly, the email security setup service covers SPF, DKIM and DMARC end to end, or start with the free email audit.