Gmail and Yahoo Bulk Sender Requirements: The 2026 Checklist
In February 2024 Google and Yahoo started enforcing a shared set of rules for anyone sending them significant volume. Two years on the rules have not changed much, but enforcement has tightened and the temporary failures that used to be warnings are now rejections. This is the complete list, what each item actually requires, and how to check it.
Who counts as a bulk sender
Google's line is about 5,000 messages a day to personal Gmail accounts, counted across the organisational domain including every subdomain, and once you have crossed it the rules apply permanently. Yahoo publishes no number and applies the same requirements to anyone it classifies as bulk based on behaviour. Microsoft announced matching rules for Outlook.com in 2025. In practice, if you send enough volume for authentication to matter at all, assume the rules apply.
The rules are also the sensible baseline for everyone else. A sender under the threshold that meets them gets better placement than one that does not, because each item is something Gmail scores regardless of volume.
Authentication: SPF and DKIM, both
Below the threshold, one of the two must pass. Above it, both must. "Pass" means pass on the domain in your From: address, not on your sending tool's domain — see alignment below. SPF must stay under ten DNS lookups or it returns permerror, which counts as no SPF at all. DKIM keys must be at least 1024 bits; 2048 is the sensible default. The SPF checker and DKIM checker cover both.
DMARC: published, any policy
A DMARC record must exist at _dmarc.yourdomain with a valid p= tag. p=none satisfies the requirement. It enforces nothing, but its presence means your domain has declared how it wants failures handled and, with a rua= address, receives the aggregate reports that tell you who is sending as you. The none-to-reject guide is the path from here to actual protection.
Alignment
This is where most technically-authenticated senders fail. The domain in the From: header must match the domain that SPF or DKIM passed for. A tool that signs with its own DKIM domain and sends from its own envelope domain will pass both checks and still fail alignment, and Gmail treats that as unauthenticated. The fix is a custom DKIM record on your domain, or a custom return-path on your domain, or ideally both. The header analyzer reads the receiver's verdict from a delivered message and shows exactly which domain each check passed on.
Reverse DNS on every sending IP
Each IP that connects to Gmail must have a PTR record, and the hostname in that record must resolve back to the same IP. Google Workspace, Microsoft 365 and the reputable ESPs handle this. Self-hosted MTAs and cheap SMTP relays frequently do not, and the failure shows up as 550 5.7.25. Check with the PTR lookup.
TLS
Messages must arrive over a TLS connection. Every mainstream provider does this by default and it is only worth checking if you run your own MTA. Note this is about the connection to Gmail, not MTA-STS, which is a separate and optional inbound protection.
One-click unsubscribe
Marketing and subscribed mail must carry two headers: List-Unsubscribe with an https URL (a mailto: can be included alongside), and List-Unsubscribe-Post: List-Unsubscribe=One-Click. The URL must accept a POST request and remove the address without a login or a confirmation page, and the removal must take effect within two days. A visible unsubscribe link in the body is also required.
The requirement does not apply to one-to-one transactional or personal correspondence. Cold email sent from individual mailboxes sits in a grey area: it is not subscribed mail, and adding one-click headers to a personal-looking message is odd. The practical approach is a plain opt-out sentence in the body and honouring every reply that asks to stop. Paste a sent message's headers into the bulk sender checker to see whether the headers are present and correctly formed.
Spam rate
Under 0.10% in Postmaster Tools as the working target, and never at or above 0.30%. The number is complaints as a share of inbox-delivered mail, so it rises fastest when volume is low and one recipient hits "report spam". This is the requirement with no DNS fix; it is a list-quality and volume-discipline problem. Add every sending domain to Postmaster Tools before it sends anything, and check it weekly.
The 0.30% figure is a ceiling, not a target. Domains that sit at 0.2% for a month are throttled long before they are rejected. Well-run cold email fleets sit under 0.05%.
What enforcement looks like
Gmail's enforcement is graduated. First, temporary failures with 4.7.28 or 5.7.26 on a percentage of traffic. Then a rising share of rejections. Then, for persistent offenders, near-total rejection of the domain. Yahoo moves faster and is less transparent. The bounce codes are decoded in the error codes post.
How this applies to a cold email fleet
A fleet of secondary domains, each with a handful of inboxes at thirty sends a day, never approaches 5,000 a day per organisational domain — that is a large part of why the architecture exists. The authentication, alignment and rDNS items apply anyway, because they are what reputation is built on. The unsubscribe headers do not apply to personal outreach. The spam-rate ceiling applies to everything, and on low-volume domains a single complaint can push a day's rate over 0.3%, which is why the list matters more than the copy.
Sources
- Email sender guidelines — Google Workspace Admin Help
- Sender best practices — Yahoo Sender Hub
- Email sender guidelines FAQ — Google Workspace Admin Help
Everything above is diagnosis. To confirm a fix worked you need placement data — seed accounts across the major providers, plus the DMARC aggregate reports read as a trend rather than a wall of XML. GlockApps is what I run for both.
See GlockApps →Affiliate link — it costs you nothing and help keep these tools free. Everything I use →Tools for this
SPF checkerValidate a record and see who it authorises.DKIM checkerFind signing keys without the selector.Header analyzerTrace hops and read the real verdicts.PTR lookupReverse DNS for any IP address.Frequently asked questions
Does the 5,000 threshold count per domain or per inbox?
Per organisational domain, including all subdomains, to personal Gmail addresses, on any single day. Workspace-to-Workspace mail is not counted.
Is p=none enough for the DMARC requirement?
Yes. The requirement is that a valid DMARC record exists. Moving to quarantine or reject is recommended but not required by the sender guidelines.
Do cold emails need one-click unsubscribe headers?
Not under the published rules, which target marketing and subscribed mail. A clear opt-out in the body and honouring replies is the appropriate approach for one-to-one outreach.
How do I check my spam rate?
Google Postmaster Tools, after verifying the domain with a DNS TXT record. Yahoo has no equivalent dashboard; its complaint feedback comes through a feedback loop you enrol in.
What happens if I fail one requirement?
Temporary failures at first, then rejections. Gmail names the failing requirement in the bounce text, so the fix is usually clear.