Gmail, Yahoo and Microsoft bulk sender requirements

Gmail and Yahoo started enforcing bulk sender requirements in February 2024, and Microsoft followed for Outlook.com on May 5, 2025. Since November 2025, Gmail has been ramping up enforcement on non-compliant traffic, including temporary and permanent rejections. The three lists overlap heavily, so one setup covers all of them.

Who counts as a bulk sender

Each provider draws the line in a different place:

• Gmail counts you as a bulk sender once you send close to 5,000 messages or more to personal Gmail accounts (addresses ending in @gmail.com or @googlemail.com) within 24 hours. Messages from every subdomain of the same primary domain count together, and the status is permanent once you reach it.
• Microsoft applies its rules to domains sending more than 5,000 emails per day to Outlook.com accounts, which its support article says includes Hotmail, Live.com and MSN.
• Yahoo's FAQ says it will not specify a volume threshold.

Treat the bulk rules as the baseline whatever your volume. Gmail's guidelines also tell senders to avoid sudden volume spikes without a history of large sends, and a few hundred messages from a new domain can be throttled long before you get near 5,000 a day. See how to warm up a new sending domain.

SPF and DKIM, both of them

All three providers ask bulk senders to set up both SPF and DKIM. SPF lists the servers allowed to send for the envelope (return-path) domain. DKIM signs each message with a key published in your DNS. Microsoft's policy page says both must pass. Gmail requires a DKIM key of 1024 bits or longer for personal Gmail accounts and recommends 2048 bits, and Yahoo also asks for a minimum of 1024 bits.

When you send through an email provider, both records point at the provider's servers but should carry your domain: the return-path should be a subdomain of yours, and the DKIM signature's d= domain should be yours. That is what makes alignment possible. If either check fails, see SPF record not found and DKIM verification failing.

A DMARC record, starting at p=none

Gmail, Yahoo and Microsoft all require a DMARC record from bulk senders and all accept p=none as the minimum policy. Microsoft recommends p=reject. The record is a TXT at _dmarc under your From domain:

_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

The rua tag asks receivers to send you aggregate reports listing which servers sent mail as your domain and whether it passed. Yahoo strongly recommends it while you set things up. Check the record the way a receiver sees it:

dig TXT _dmarc.example.com +short

A p=none policy only asks for reports. It doesn't tell receivers to reject spoofed mail, so plan to move to p=quarantine and then p=reject once the reports look clean.

DMARC alignment

DMARC passes only when SPF or DKIM passes for a domain that matches the one in the visible From: header. All three providers accept alignment through either SPF or DKIM, and Microsoft prefers both. Relaxed alignment, the default, compares organizational domains, so a From address at news.example.com aligns with a DKIM signature for example.com. Yahoo states that relaxed alignment is acceptable.

The common failure is SPF and DKIM both passing for the provider's domain: a shared return-path such as bounces.provider.net and a DKIM signature with d=provider.net. Every check looks green except DMARC. To confirm, send a message to a Gmail address, open Show original, and read the Authentication-Results header. A passing, aligned message looks roughly like this (trimmed):

dkim=pass header.i=@example.com
spf=pass smtp.mailfrom=send.example.com
dmarc=pass (p=NONE) header.from=example.com

Gmail's FAQ notes that the alignment requirement doesn't apply to forwarded or mailing list messages.

One-click unsubscribe

Gmail requires marketing and subscribed messages to support one-click unsubscribe and to include a clearly visible unsubscribe link in the body. Yahoo requires a list-unsubscribe header supporting one-click for the same mail and highly recommends the POST method from RFC 8058. The two headers:

List-Unsubscribe: <https://example.com/unsubscribe/opaque-token>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

RFC 8058 adds conditions that are easy to miss:

• List-Unsubscribe must contain one HTTPS URI.
• Both headers must be covered by a valid DKIM signature, which means listing them in the signature's h= tag.
• The inbox sends a POST with List-Unsubscribe=One-Click in the body and no cookies, and your endpoint must not answer with a redirect.
• Since the POST carries no other context, the URL itself has to identify the subscriber and the list.

Process unsubscribes quickly. Google recommends fulfilling them within 48 hours, and Yahoo requires it within 2 days.

Transactional mail is exempt. Gmail's FAQ gives password resets, reservation confirmations and form submission confirmations as examples. A digest or a product announcement is subscribed or marketing mail and needs the headers even if your application sends it.

Spam rate below 0.3%

Gmail requires bulk senders to keep the spam rate reported in Postmaster Tools below 0.3%, and its guidelines tell all senders to keep it below 0.1%. Yahoo's line is also 0.3%, calculated on mail delivered to the inbox. Microsoft publishes no number.

The rate counts recipients who click Report spam, and small sends make it move fast: 3 complaints on 1,000 delivered messages is already 0.3%. A Gmail bulk sender above 0.3% is ineligible for mitigation (Google's delivery support won't step in) and becomes eligible again once the rate stays below 0.3% for 7 consecutive days. Postmaster Tools updates the figure daily and has a compliance status dashboard that shows which requirements your domain meets.

The usual sources of complaints are mail people don't remember signing up for and mail that arrives more often than they expected. See email list hygiene and how often to send marketing email.

Infrastructure requirements

Gmail also requires every sender to use TLS, to have valid forward and reverse DNS (PTR) records for sending IPs, to format messages according to RFC 5322, and not to impersonate Gmail in the From: header. Yahoo requires valid forward and reverse DNS and compliance with RFC 5321 and RFC 5322. If you send through an email provider, these are the provider's job. If you run your own mail server, they are yours.

What happens when you miss a requirement

Gmail answers with codes that name the requirement, listed in its SMTP error reference:

• 421 4.7.27 or 550 5.7.27: SPF didn't pass.
• 421 4.7.30 or 550 5.7.30: DKIM didn't pass.
• 421 4.7.32: the From: header isn't aligned with the SPF or DKIM domain.
• 421 4.7.40 or 550 5.7.40: the sending domain has no DMARC record or policy.
• 550 5.7.26: the message is unauthenticated or fails the From domain's DMARC policy.

Microsoft sends non-compliant mail from high-volume senders to the junk folder first. If the problem stays unresolved, it may reject with 550 5.7.515 Access denied, which says the sending domain doesn't meet the required authentication level. Yahoo says non-compliant mail may go to spam or be rejected. For what each reply means and what to do about it, see email bounce codes explained.

How Unitpost covers these requirements

When you add a sending domain, Unitpost generates the DNS records: DKIM so your mail is signed with your domain, and a custom MAIL FROM subdomain so SPF aligns. It keeps re-checking them after verification. The domain page also shows a DMARC record to add; p=none is enough to start. Unitpost doesn't require DMARC to send, but Gmail and Yahoo require it for bulk senders, so add it before your first campaign (DMARC in the docs).

Marketing campaigns always carry one-click List-Unsubscribe headers (RFC 8058) and an unsubscribe footer, and subscription topics let people leave one kind of mail and keep the rest. For lifecycle mail you render yourself, you can set your own unsubscribe headers on any send so Gmail shows its Unsubscribe button. Addresses that hard-bounce or complain are suppressed automatically, and a campaign whose bounces or complaints climb past a safe line pauses itself and tells you why.