Gmail and Yahoo Bulk Sender Requirements: A Plain Checklist

Gmail and Yahoo expect every sender to authenticate mail and use valid DNS and TLS. Senders near 5,000 messages a day to Gmail accounts count as bulk senders and must also use SPF and DKIM together, publish a DMARC policy, align the From domain, offer one-click unsubscribe and keep spam complaints under 0.3%.

Who counts as a bulk sender

Google treats a sender as bulk at close to 5,000 messages within 24 hours sent to personal Gmail accounts. BusinessMCP’s summary of the rules adds two details worth remembering: the count is per primary domain, so subdomain volume rolls up into it, and once you have been classed as bulk the status is not something you can simply shed. Yahoo mirrors the same framework. These requirements have been enforced since early 2024, and BusinessMCP marks its summary as verified in August 2026.

If you are below the threshold, treat the bulk rules as your target anyway. Providers check authentication for everyone, and growth tends to cross the line sooner than expected.

The requirements side by side

Requirement	All senders	Bulk senders
SPF or DKIM	Required	Both required
DMARC policy published	Not required	Required (p=none accepted)
From-domain alignment	Recommended	Required
TLS in transit	Required	Required
Valid forward and reverse DNS (PTR)	Required	Required
Spam rate below 0.3%	Expected	Required
One-click unsubscribe (RFC 8058)	Not applicable to transactional	Required on marketing and subscribed mail
Honour opt-outs within 2 days	-	Required

The table follows Google’s sender guidelines as summarised by BusinessMCP’s Google and Yahoo requirements guide. Provider pages are authoritative; check them for changes.

Authentication in practice

1. Publish SPF and DKIM for every service that sends as your domain.
2. Publish a DMARC record. p=none with a rua= reporting address meets the minimum, per the summary above.
3. Make sure the domain that passes SPF or DKIM matches your visible From domain. This alignment is the part most often missed; see the DKIM selector article and the setup guide.
4. Check forward and reverse DNS on any dedicated sending IP. Shared platforms usually handle this for you.

You can run the first three through BusinessMCP’s free email deliverability checker, which grades MX, SPF, DKIM and DMARC. It cannot check PTR records or alignment on real messages, so confirm those through headers, as described in our deliverability test walkthrough.

Key takeaway: meeting the authentication rules is table stakes. Staying under the spam-rate line is the requirement that takes continuing effort.

The 0.3% spam rate

Google’s rule is to keep user-reported spam below 0.3% in Google Postmaster Tools, with a recommendation to stay below 0.1%. BusinessMCP’s summary adds that at or above 0.3% a sender loses eligibility for mitigation support until the rate stays under 0.3% for seven consecutive days.

The arithmetic is unforgiving at small volumes. Three reports per 1,000 delivered messages is 0.3%. At 200 emails a day, about four reports in a week approaches the line. That is why list quality and easy unsubscribing matter so much.

Postmaster Tools only reports once enough volume reaches Gmail, so small senders may see nothing. Track complaints through your sending platform, and watch bounces too.

One-click unsubscribe

For marketing and subscribed mail, bulk senders need:

• A List-Unsubscribe header containing a URL.
• A List-Unsubscribe-Post header set to List-Unsubscribe=One-Click, per RFC 8058.
• A visible unsubscribe link in the message body.
• Opt-outs honoured within two days. BusinessMCP recommends suppressing immediately rather than using the full window.

Transactional mail, such as password resets and receipts, is a different category, but keep it on a separate stream so a marketing complaint spike does not drag it down.

Practical separation of streams

• Send cold or promotional mail from a separate domain so reputation is tracked apart from business mail. See sending domain vs subdomain.
• Remember Google counts bulk volume across a primary domain and its subdomains, so a subdomain does not hide volume.
• Keep volume steady and ramp new domains gradually.

Compliance checklist

• [ ] SPF and DKIM pass for every sender
• [ ] DMARC published with a working report address
• [ ] From domain aligns with the passing domain
• [ ] TLS on, valid PTR on dedicated IPs
• [ ] One-click unsubscribe headers on marketing mail
• [ ] Opt-outs suppressed immediately
• [ ] Complaint rate monitored, target below 0.1%
• [ ] Bounces kept low through list verification

Caveats

Rules change, enforcement details evolve and thresholds are stated by the providers, not by us. Treat this as a map and the provider documentation, linked above, as the territory. Cold outreach carries additional legal duties that vary by country; BusinessMCP’s cold email deliverability and compliance guide discusses them, and a lawyer can advise on yours.

Common misreadings of the rules

A few misunderstandings keep circulating, so they are worth correcting.

• “I am under 5,000 so none of this applies.” SPF or DKIM, TLS and valid DNS apply to everyone, and providers can still filter an unauthenticated sender.
• “A subdomain keeps my volume separate.” Google counts bulk volume across the primary domain and its subdomains, as BusinessMCP’s summary notes.
• “DMARC must be p=reject.” Per the same summary, p=none is accepted for the requirement. Enforcement is a separate security choice, covered in DMARC none, quarantine or reject.
• “Transactional mail needs a marketing unsubscribe.” One-click unsubscribe targets marketing and subscribed mail. Keep the streams separate so you can treat them differently.
• “Passing the rules guarantees the inbox.” It does not. The rules set a floor; reputation does the rest.

What the rules mean for each sender size

Sender	Practical stance
Under a few hundred messages a day	Authenticate fully and keep complaints near zero. Postmaster data may not populate.
A few thousand a day	Treat yourself as approaching bulk: DMARC, alignment, one-click unsubscribe, complaint tracking.
Above the threshold	Follow every item in the table, monitor Postmaster Tools weekly and keep a documented response plan for spikes.

Checking compliance in practice

Start with DNS. The free BusinessMCP email deliverability checker grades the four records in one pass. Then check one real message per sending service for authentication results and alignment. Then confirm the unsubscribe headers are present in a marketing test message. Finally, set up Postmaster Tools if your volume is high enough to populate it. BusinessMCP’s own Google and Yahoo sender requirements guide is dated and worth reading alongside the providers’ pages, because enforcement details are the part most likely to change.