KoltrixGmail and Yahoo bulk sender rules: the full checklist
What Gmail and Yahoo require from senders of roughly 5,000 messages a day: SPF and DKIM, DMARC, alignment, one-click unsubscribe and spam rates.
On this page(8 sections)
- Who counts as a bulk sender
- Requirements for all senders
- Additional requirements for bulk senders
- 1. Both SPF and DKIM
- 2. DMARC
- 3. Alignment
- 4. One-click unsubscribe for marketing and subscribed mail
- 5. Honor unsubscribes within two days
- 6. Spam rate below 0.3%
- Transactional mail
- Enforcement timeline
- How to verify compliance
- A compliance checklist
- Key takeaways
Since February 2024, Gmail and Yahoo have enforced a common set of requirements on anyone sending large volumes to their users. Enforcement has tightened since, with Gmail moving to temporary and permanent rejections of non-compliant traffic from November 2025.
This checklist collects what both providers require, who counts as a bulk sender, and how to verify each item.
Who counts as a bulk sender
Gmail defines a bulk sender as one that sends close to 5,000 messages or more to personal Gmail accounts within a 24-hour period. Three details are easy to miss:
- The count is per primary domain. Mail from
example.comandnews.example.comis added together. - Status is permanent. Google states that once a sender is classified as a bulk sender, the classification does not expire, even if volume later drops.
- It counts personal accounts. The rules target mail to consumer Gmail addresses; Google Workspace accounts are handled separately.
Yahoo uses similar language about bulk senders without publishing an exact number in the same way. In practice, if you approach 5,000 messages a day to either provider, treat yourself as bulk.
Requirements for all senders
Both providers apply a baseline to everyone, regardless of volume:
| Requirement | Gmail | Yahoo |
|---|---|---|
| SPF or DKIM authentication | Required | Required |
| Valid forward and reverse DNS for sending IPs | Required | Required |
| TLS for transmission | Required | Not listed separately; strongly advisable |
| Spam rate below 0.3% | Required | Required |
| Messages formatted per RFC 5322 | Required | Required (RFCs 5321 and 5322) |
Gmail also asks all senders not to impersonate Gmail From headers and recommends keeping spam rates below 0.1%, with 0.3% as a line to never reach.
Additional requirements for bulk senders
Bulk senders must meet everything above plus:
1. Both SPF and DKIM
Not one or the other: both mechanisms must be set up for the sending domain. Most email service providers support custom-domain DKIM and custom bounce domains for SPF; enable both.
2. DMARC
Publish a DMARC record for the sending domain. Both providers accept p=none. Yahoo adds that DMARC must pass for the messages you send.
_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:[email protected]"p=none meets the requirement but does not stop spoofing. Treat it as the starting point of a rollout, not the destination.
3. Alignment
The domain in the From header must align with either the SPF domain or the DKIM signing domain. Relaxed alignment, the default, allows subdomains: a From address at example.com aligns with DKIM d=mail.example.com or an envelope sender at bounce.example.com.
This is where many senders fail. A vendor that signs with its own domain and uses its own bounce domain passes SPF and DKIM for itself, but neither aligns with your From domain.
4. One-click unsubscribe for marketing and subscribed mail
Marketing and subscribed messages must support one-click unsubscribe as defined in RFC 8058, plus a clearly visible unsubscribe link in the body:
List-Unsubscribe: <https://example.com/u/7f3a9c>, <mailto:[email protected]?subject=7f3a9c>
List-Unsubscribe-Post: List-Unsubscribe=One-ClickBoth headers must be covered by a valid DKIM signature. The HTTPS endpoint must accept a POST and unsubscribe the recipient without requiring a login or further interaction.
5. Honor unsubscribes within two days
Gmail asks senders to process unsubscribe requests within 48 hours; Yahoo says within 2 days. Build the suppression into the request handler rather than a nightly batch.
6. Spam rate below 0.3%
The same threshold as for all senders, but with consequences. Since June 2024, Gmail has said that bulk senders with a user-reported spam rate above 0.3% are ineligible for mitigation, meaning Google will not help resolve delivery problems until the rate has stayed below 0.3% for seven consecutive days.
Transactional mail
Password resets, receipts and security alerts are not marketing, so one-click unsubscribe is not required for them. Every other bulk requirement, including authentication, alignment and spam rates, applies to all your mail, because the classification is per domain rather than per message type. That is a strong argument for separating transactional and marketing streams, a topic we cover separately.
Enforcement timeline
| Date | What changed |
|---|---|
| February 2024 | Requirements take effect; gradual enforcement begins |
| June 2024 | Gmail: senders above 0.3% spam rate ineligible for mitigation |
| November 2025 | Gmail ramps up enforcement with temporary and permanent rejections of non-compliant mail |
Microsoft announced comparable requirements for Outlook.com consumer mailboxes, effective from May 2025, for domains sending over 5,000 messages a day. If you comply with the Gmail and Yahoo rules, you are most of the way there.
How to verify compliance
- Authenticate a test message. Send to a personal Gmail account and use "Show original." Confirm SPF, DKIM and DMARC all show PASS, and that the DKIM domain or SPF domain matches your From domain.
- Check DNS. Confirm one SPF record, a DKIM key at each selector your systems use, and a DMARC record.
- Check reverse DNS for any IPs you operate.
- Inspect a marketing message for both List-Unsubscribe headers, and test the HTTPS endpoint with a POST.
- Register for Google Postmaster Tools. It reports your user-reported spam rate and shows compliance status for the requirements.
- Monitor Yahoo complaints through Yahoo's feedback loop program.
A compliance checklist
- SPF and DKIM configured for every sending domain and subdomain.
- DMARC published, at least
p=none, with reports going somewhere you read. - From domain aligned with SPF or DKIM on every stream, including vendors.
- Valid PTR records and forward DNS for sending IPs.
- TLS on all outbound connections.
- One-click unsubscribe headers, DKIM-signed, on marketing and subscribed mail.
- Unsubscribes processed within two days, ideally immediately.
- Spam rate tracked in Postmaster Tools, kept under 0.1% where possible.
Key takeaways
- Bulk sender status starts at roughly 5,000 messages a day to personal Gmail accounts, counts subdomains together, and never expires.
- All senders need SPF or DKIM, valid reverse DNS, TLS and a spam rate below 0.3%.
- Bulk senders also need SPF and DKIM, DMARC, alignment, one-click unsubscribe and two-day unsubscribe processing.
- Gmail began rejecting non-compliant mail in November 2025, so gaps now cost delivery, not just placement.
Start with Koltrix
Your domain, one inbox, and an API that sends.
A team inbox where AI sorts and drafts (nothing is sent without your click), plus the transactional API and SMTP relay your product sends with. 7 days free, no card.
