Bulk Sender Requirements for Gmail and Yahoo

In 2024, Gmail and Yahoo began enforcing stricter rules for anyone sending email to their users, with the toughest requirements reserved for high-volume senders. Messages from senders who ignore them are more likely to be rejected or sent to spam. For B2B teams running newsletters, product updates or outreach, understanding these bulk sender requirements is now a basic part of email operations. This guide explains what Google and Yahoo require of all senders and of bulk senders, how authentication, unsubscribe and spam rate rules fit together, and how to check your own set-up. It is based on the providers' published guidance, which can change, so always confirm against the current pages.

Who the rules apply to

Both providers set baseline requirements for everyone who sends to their users, plus extra requirements for bulk senders:

• Google applies its stricter requirements to senders who send more than 5,000 messages per day to Gmail accounts (Google email sender guidelines)
• Yahoo publishes separate requirements for all senders and for bulk senders (Yahoo sender best practices)

Even if you send far less, meeting the bulk standards is sensible: they reflect good practice, volumes can grow quickly, and campaign spikes can push you over thresholds.

Requirements for all senders

According to the published guidance, all senders to Gmail must, among other things:

• Set up SPF or DKIM authentication for sending domains
• Have valid forward and reverse DNS records for sending IP addresses
• Use a TLS connection for transmitting email
• Keep spam rates reported in Postmaster Tools below 0.3%
• Format messages according to RFC 5322

Google also recommends keeping spam rates below 0.10% and avoiding ever reaching 0.30%. Yahoo's requirements for all senders similarly include SPF or DKIM, a spam rate below 0.3%, valid forward and reverse DNS and compliance with RFCs 5321 and 5322.

Bulk sender requirements in detail

For bulk senders, both providers add further requirements. Google's include:

• Both SPF and DKIM authentication
• A DMARC record for the sending domain, where the enforcement policy can be set to none
• Alignment between the domain in the From header and either the SPF or DKIM domain
• One-click unsubscribe for marketing and subscribed messages, plus a clearly visible unsubscribe link in the message body

Yahoo's bulk requirements include both SPF and DKIM, a valid DMARC policy of at least p=none that passes, a functioning list-unsubscribe header supporting one-click unsubscribe, with the POST method from RFC 8058 highly recommended, a visible unsubscribe link in the body and honouring unsubscribes within 2 days.

Worked example: a bulk sender requirements checklist

The table below summarises the main points from the two providers' pages at the time of writing. Check the current pages before relying on it.

RequirementGoogle, all sendersGoogle, over 5,000 per dayYahoo, all sendersYahoo, bulk sendersSPF or DKIMRequired, eitherBoth requiredRequired, eitherBoth requiredDMARCNot requiredRequired; policy can be noneNot requiredRequired, at least p=none, must passFrom domain aligned with SPF or DKIMNot stated as requiredRequiredNot stated as requiredRequired for DMARC alignmentForward and reverse DNSRequiredRequiredRequiredRequiredSpam rateBelow 0.3%Below 0.3%Below 0.3%Below 0.3%One-click unsubscribeNot stated as requiredRequired for marketing and subscribed messagesNot stated as requiredRequired; RFC 8058 POST highly recommendedVisible unsubscribe linkNot stated as requiredRequiredNot stated as requiredRequiredUnsubscribe processingNot specified on this pageNot specified on this pageNot specified on this pageHonour within 2 days

The direction is clear: authenticated, aligned mail from a domain with a DMARC record, easy unsubscribes and low complaint rates.

Authentication: SPF, DKIM and DMARC

The three authentication standards work together:

• SPF lists the servers allowed to send mail for your domain
• DKIM adds a cryptographic signature that receivers verify using a public key published in DNS
• DMARC tells receivers what to do when messages fail checks and requires alignment with the visible From domain

Start DMARC with a policy of none and aggregate reporting, review reports to find every legitimate sender, then consider moving to stricter policies once everything authenticates correctly.

Unsubscribe requirements

One-click unsubscribe lets recipients leave a list without logging in or confirming on a web page. It is implemented through list-unsubscribe headers, and RFC 8058 defines the one-click POST method. Make sure:

• Every marketing and subscribed message includes the headers and a visible link
• Unsubscribe requests are processed quickly, within Yahoo's 2-day expectation
• Your suppression list is applied across all sending tools

Keep spam rates low

Spam rates depend on recipients' reactions. To keep them low:

• Send only to people who expect your messages
• Make it easy to unsubscribe, so people do not mark mail as spam instead
• Remove inactive recipients regularly
• Monitor Google Postmaster Tools and Yahoo's sender tools
• Warm up new domains gradually

Our guide to email domain warming explains how to build sending reputation on new domains safely.

What this means for cold outreach

Cold outreach is not exempt from authentication or spam rate rules. Low volumes per domain do not remove the need for SPF, DKIM, DMARC, accurate DNS and low complaint rates. Including a simple way to opt out is also expected under many laws and reduces spam complaints. Our guide to cold emails going to spam covers common deliverability problems and fixes.

Check your own set-up

A quick review should cover:

1. Look up SPF, DKIM and DMARC records for each sending domain
2. Send test messages and inspect authentication results in the headers
3. Confirm the From domain aligns with SPF or DKIM
4. Check forward and reverse DNS for sending IPs, or confirm your provider handles them
5. Verify list-unsubscribe headers and visible links in marketing messages
6. Review spam rates in Postmaster Tools

Repeat after changing email providers or adding new sending tools.

Stay up to date

Providers update their guidance over time. Google's page, for example, notes that Gmail will begin using a DMARC quarantine enforcement policy, which affects anyone impersonating Gmail From addresses. Assign someone to review the official pages periodically, and record the date of each review alongside any changes you made to your set-up, so you can show what was checked and when.

Frequently Asked Questions

What are the Gmail and Yahoo bulk sender requirements?

Bulk senders need SPF and DKIM, a DMARC record, From alignment, one-click unsubscribe with a visible link, valid DNS and a spam rate below 0.3%.

Who counts as a bulk sender for Gmail?

Google applies its stricter requirements to senders who send more than 5,000 messages per day to Gmail accounts.

Does my DMARC policy need to be reject?

No. Google says the policy can be set to none, and Yahoo requires at least p=none. Stricter policies can follow once authentication is reliable.

How quickly must unsubscribes be processed?

Yahoo's guidance says to honour unsubscribes within 2 days. Fast processing also reduces complaints with any provider.

Meet sender requirements with confidence

We review authentication, DNS, unsubscribe handling and sending practices so your email meets provider requirements. See our cold outreach and deliverability service, or talk to us about bulk sender requirements.

About the Author

Manav Sharma is the founder of Insyrge and a CRM solutions architect. He works across Zoho, Salesforce, HubSpot, Odoo and more, designing the CRM setups, integrations and automations that keep sales and operations teams working from the same data.