Gmail and Yahoo Bulk Sender Requirements: The Checklist

Gmail and Yahoo require bulk senders to authenticate with SPF and DKIM, publish a DMARC policy (at least p=none) with a From domain aligned to SPF or DKIM, support one-click unsubscribe per RFC 8058 on marketing mail and honor it within two days, and keep user-reported spam rates low: according to Google's sender guidelines, below 0.1% and never at 0.3% or above. These rules took effect in February 2024, and Google defines a bulk sender as one sending roughly 5,000 or more messages a day to personal Gmail accounts. Several baseline rules, like valid reverse DNS and TLS, apply to every sender regardless of volume.

Who the rules apply to

Google and Yahoo split their requirements into two tiers:

• All senders: anyone sending to personal @gmail.com, @googlemail.com or Yahoo mailboxes.
• Bulk senders: according to Google's sender guidelines, close to 5,000 or more messages in a 24-hour period to personal Gmail accounts. Google counts all mail from the same primary domain, so news.example.com and app.example.com add up. Once you qualify, you keep the status.

Yahoo does not publish a fixed number but applies equivalent rules to senders with significant volume. Microsoft announced comparable requirements for high-volume senders to Outlook.com consumer addresses in 2025, so treating this checklist as the industry baseline is the safe assumption.

Requirements for all senders

1. SPF or DKIM authentication

Every message must pass at least one of SPF (RFC 7208) or DKIM (RFC 6376). In practice, configure both.

2. Valid forward and reverse DNS

Your sending IP must have a PTR record, and that hostname must resolve back to the same IP (forward-confirmed reverse DNS):

$ dig +short -x 203.0.113.10
mta1.example.com.
$ dig +short A mta1.example.com
203.0.113.10

Generic PTRs such as 203-0-113-10.dynamic.example.net look like residential botnets and hurt reputation.

3. TLS for transmission

Connect with STARTTLS. Gmail marks messages received without TLS with a red open lock, and unencrypted delivery is a negative signal.

4. Low spam complaint rate

Keep user-reported spam below 0.1% in Google Postmaster Tools and never reach 0.3%. Note the denominator: Postmaster Tools calculates the rate against mail delivered to the inbox, not total mail sent, so a spam-foldered campaign can make the number look better than reality.

5. RFC 5322-compliant messages

Exactly one From, a valid Date, a Message-ID, correct MIME structure. Malformed headers are a common reason for 550 5.7.1 rejections from automated tools that build messages by string concatenation.

6. No impersonation of Gmail

Do not put @gmail.com in the From header of mail you send through your own infrastructure. Gmail publishes a DMARC p=quarantine policy, so it fails anyway.

7. ARC for forwarders

If you operate mailing lists or forwarding, add ARC headers (RFC 8617) so receivers can see the original authentication results.

Additional requirements for bulk senders

8. Both SPF and DKIM

Bulk senders must set up both, not one or the other.

9. DMARC with alignment

Publish a DMARC record with at least p=none:

_dmarc.example.com.  IN TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

And the From domain must align with either the SPF domain (Return-Path) or the DKIM d= domain. A message signed only with d=vendor.example.net while sent From: you@example.com fails this requirement even if DKIM itself passes. With relaxed alignment (the default), a return-path such as bounces.example.com aligns with a From address at example.com.

10. One-click unsubscribe

Marketing and subscribed messages must include both headers defined by RFC 8058, and the List-Unsubscribe header must be covered by the DKIM signature:

List-Unsubscribe: <https://example.com/u/7Qk2...>, <mailto:unsub-7Qk2@example.com>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

The HTTPS endpoint must accept a POST with body List-Unsubscribe=One-Click and unsubscribe the user without login or confirmation pages. Also include a visible unsubscribe link in the body.

11. Honor unsubscribes within two days

Both Google and Yahoo require processing within two days. Batch jobs that sync weekly from your ESP to your CRM are a common way to break this rule.

How enforcement shows up

Non-compliance does not always mean a hard rejection. You may see temporary errors, spam folder placement or outright rejections, depending on the failure and how strictly enforcement is being applied at the time. Typical Gmail SMTP replies look like this:

421 4.7.27 ... Your email has been rate limited because SPF authentication didn't pass ...
550 5.7.26 ... Unauthenticated email from example.com is not accepted due to domain's DMARC policy ...
550 5.7.1 ... Our system has detected an unusually high rate of unsolicited mail ...

Treat any 5.7.x from a mailbox provider as a policy signal to investigate, not as a bad address to suppress blindly.

Monitoring compliance

• Google Postmaster Tools: verify your domain to see spam rate, IP and domain reputation, authentication rates and a compliance status dashboard for the bulk sender requirements.
• Yahoo Sender Hub: Yahoo's portal for sender information and its complaint feedback loop.
• DMARC aggregate reports: confirm that every source passes aligned.
• Your own bounce logs: group by enhanced status code and receiving domain.

Common mistakes

• Counting only one subdomain. You may believe you send 2,000 messages a day, but marketing plus product plus notifications on the same organizational domain can exceed 5,000.
• List-Unsubscribe not signed by DKIM. If the header is added after signing, the one-click requirement is not met.
• Unsubscribe endpoint that requires a GET confirmation page. RFC 8058 requires the POST alone to complete the unsubscribe.
• Ignoring the 0.1% target because the hard line is 0.3%. Reputation degrades well before the threshold.
• Missing PTR records on a newly provisioned cloud IP.
• Transactional mail mixed with marketing on the same domain and IP, so a campaign complaint spike delays password resets.

The checklist

All senders:

• [ ] SPF or DKIM passes on every message (bulk: both)
• [ ] Forward-confirmed reverse DNS on every sending IP
• [ ] TLS on every connection
• [ ] Spam rate under 0.1%, never 0.3%
• [ ] RFC 5322-compliant headers
• [ ] No From addresses on domains you do not control

Bulk senders, additionally:

• [ ] DMARC published, at least p=none, with reporting
• [ ] From domain aligned with SPF or DKIM
• [ ] List-Unsubscribe and List-Unsubscribe-Post on marketing mail, DKIM-signed
• [ ] Unsubscribes processed within two days
• [ ] Postmaster Tools and DMARC reports reviewed weekly

Pidgely was built around this baseline: per-domain DKIM, an aligned return-path subdomain, RFC 8058 one-click unsubscribe and automatic suppression are on by default, and a reputation guard pauses sending when bounce or complaint rates cross safe thresholds instead of letting a bad send damage your domain.