Gmail & Yahoo Bulk Sender Requirements 2026

In February 2024, Gmail and Yahoo began enforcing a shared set of rules for anyone sending mail to their users. The rules were not new ideas. They formalized practices good senders already followed. What changed is that mail which does not meet them can now be sent to spam or rejected outright, and enforcement has tightened since.

This checklist covers what the requirements are as of 2026, which ones apply to every sender and which apply to bulk senders, and how to meet each one. Providers update these pages, so always confirm details against the official sources: Google's email sender guidelines and Yahoo's sender best practices.

Who counts as a bulk sender

Google defines a bulk sender as one that sends close to 5,000 or more messages to personal Gmail accounts within a 24-hour period. A few details matter:

Messages sent from the same primary domain are counted together, even if they come from different subdomains or services.
Google has stated that once you reach this threshold, you are treated as a bulk sender going forward, even if volume drops later.
Yahoo does not publish a single numeric threshold in the same way, but applies similar requirements to bulk senders.

If you send newsletters or promotions to a list of any real size, the safest assumption is that the bulk requirements apply to you.

Requirements for all senders

These apply even if you send small volumes.

Requirement	What it means in practice
SPF or DKIM	At minimum, authenticate your mail with one of them. Doing both is strongly recommended.
Valid forward and reverse DNS	Sending IPs need a PTR (reverse DNS) record, and that hostname must resolve back to the same IP.
TLS	Use a TLS connection when transmitting mail.
Low spam rate	Keep the user-reported spam rate in Google Postmaster Tools below 0.3%.
Proper formatting	Messages must follow the Internet Message Format standard (RFC 5322).
No impersonation	Do not put a gmail.com address (or another provider's domain) in your From header when sending through your own infrastructure.

Requirements for bulk senders

Bulk senders need everything above, plus the following.

1. Both SPF and DKIM

Not one or the other. Both should pass for your sending domain. If you are not sure how they work, read SPF, DKIM and DMARC explained.

2. A DMARC record, at least p=none

Publish a DMARC record for your sending domain. The minimum accepted policy is p=none, which does not change delivery but proves you are participating. A typical starter record looks like this:

_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

3. From-domain alignment

The domain in your visible From address must align with the domain that passes SPF or the domain that signs DKIM. This is the item that catches the most people. If your platform signs with its own domain, DKIM passes for the platform, not for you, and DMARC alignment fails.

4. One-click unsubscribe for marketing mail

Marketing and subscribed messages must support one-click unsubscribe as defined in RFC 8058. That means two headers:

List-Unsubscribe: <https://track.example.com/u/abc123>, <mailto:unsubscribe@example.com>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

This powers the Unsubscribe button that Gmail and Yahoo show next to the sender name. You also need a clearly visible unsubscribe link in the body. Transactional messages such as password resets and receipts are not required to have one-click unsubscribe.

5. Honor unsubscribes within 2 days

Both providers expect unsubscribe requests to be processed within two days. In practice, automated suppression should make it immediate.

6. Keep spam complaints low

The ceiling is a user-reported spam rate of 0.3% as measured in Google Postmaster Tools. Google recommends staying below 0.1%. Treat 0.3% as the line you must never reach, not a target. Yahoo applies a similar complaint expectation.

To see your rate, register your domain in Google Postmaster Tools. It only shows data once you send enough daily volume to Gmail users.

What about Microsoft?

In 2025, Microsoft announced similar requirements for high-volume senders to Outlook.com consumer addresses, including Hotmail and Live. As announced, domains sending large volumes to those addresses need SPF, DKIM and DMARC with at least p=none, aligned with SPF or DKIM, and non-compliant mail may be sent to junk or rejected. Microsoft also recommends working unsubscribe links, list hygiene and valid sender addresses. Details and thresholds can change, so check Microsoft's official sender guidance before relying on specifics.

The practical point is simple: if you meet the Gmail and Yahoo checklist, you are already most of the way there for Outlook.com.

The full checklist

Use this before your next campaign.

SPF record published and passing, with a single SPF record per domain.
DKIM signing enabled with your own domain.
DMARC record published at _dmarc, at least p=none, with a reporting address.
From domain aligned with SPF or DKIM.
Sending IPs have valid forward and reverse DNS.
Mail sent over TLS.
RFC 8058 one-click unsubscribe headers on all marketing mail.
Visible unsubscribe link in the message body.
Unsubscribes processed within 2 days, ideally instantly.
Spam rate below 0.3% in Postmaster Tools, aiming for below 0.1%.
Messages formatted to RFC 5322.
Sending only to people who opted in, with invalid addresses removed.

You can check items 1 and 3 in seconds with the free SPF checker and DMARC checker.

How InboxRoads handles each item

Most of this checklist is infrastructure. Here is what is handled for you and what stays in your hands.

Requirement	How it is handled in InboxRoads
SPF, DKIM, DMARC	When you add a sending domain, InboxRoads generates the records, including a custom Return-Path where the sending provider supports it. Click Verify DNS; only verified domains can be used for senders.
Alignment	Because DKIM and the Return-Path use your own domain, your mail can align with your From address.
Reverse DNS and TLS	Mail goes out through managed sending providers operated by the platform, so you do not run your own mail servers or IPs.
One-click unsubscribe	Every marketing email includes an unsubscribe link and RFC 8058 List-Unsubscribe and List-Unsubscribe-Post headers.
Honoring unsubscribes	Unsubscribes go to your suppression list automatically, along with hard bounces and complaints.
Complaint and bounce control	Campaigns auto-pause if bounce or complaint rates cross set thresholds, so a bad list does not keep sending.

What stays with you: consent, content, and list quality. Verifying imported lists before sending with email verification keeps bounces down, and relevant, expected mail keeps complaints down.

FAQ

I send fewer than 5,000 emails a day. Do these rules apply to me?

The all-sender rules do. The bulk rules technically apply above the threshold, but meeting them anyway is the best protection for your deliverability, and it is free.

Is p=none really enough?

It meets the minimum requirement as of 2026. It does not protect your domain from spoofing. Plan to move toward quarantine or reject once your reports look clean.

Do transactional emails need one-click unsubscribe?

No. The one-click requirement covers marketing and subscribed messages. Transactional mail still needs authentication and alignment.

My spam rate is 0.2%. Am I safe?

You are under the ceiling, but above Google's recommended 0.1%. Review how contacts were collected, remove unengaged subscribers, and make unsubscribing easy. Our guide on how to improve email deliverability covers the next steps.

Gmail and Yahoo bulk sender requirements, a practical checklist