Gmail, Yahoo & Microsoft bulk sender requirements (2026)

Google and Yahoo introduced these requirements in February 2024, and Microsoft has since rolled out comparable rules for high-volume mail to Outlook.com and Hotmail. The thresholds and mechanics differ slightly between providers, but the core is now identical across all three: authenticate everything, make unsubscribing trivial, and keep complaints low. The requirements are specific and every one of them is checkable before you hit send.

Who counts as a bulk sender

The line is roughly 5,000 messages per day sent to a single provider’s users, counted by your From domain. A few things to understand about that number:

• It’s per provider, per day — 5,000 to Gmail addresses, separately 5,000 to Yahoo, and so on.
• Once you cross it even once, providers treat your domain as a bulk sender going forward — it is not a rolling exemption you drop out of on a quiet day.
• The baseline hygiene requirements (valid auth, working unsubscribe, low complaints) are enforced for all senders to varying degrees; crossing the threshold makes the full checklist mandatory and strictly enforced.

If you’re unsure whether your domain passes the full checklist, run the Bulk Sender Compliance Check first — it flags each requirement below against your live domain.

The requirements, by provider

Google (Gmail)

• SPF and DKIM both set up and passing.
• DMARC published — p=none is the minimum accepted policy.
• Alignment — the message must pass DMARC, meaning SPF or DKIM aligns with the visible From domain.
• One-click unsubscribe — a List-Unsubscribe header with List-Unsubscribe-Post: List-Unsubscribe=One-Click (RFC 8058, built on the RFC 2369 header), honoured within 2 days.
• Valid forward and reverse DNS (PTR / FCrDNS) on your sending IPs.
• Spam-complaint rate below 0.3%, ideally under 0.1%, monitored in Postmaster Tools.
• Format to the standards — valid RFC 5322 messages, and don’t impersonate Gmail From headers.

Enforcement: non-compliant bulk mail is throttled or filtered, and messages that fail authentication are rejected — the classic error is 5.7.26 (“message not authenticated”). Google’s Email sender guidelines are the canonical reference.

Yahoo

Yahoo’s requirements mirror Google’s almost exactly: SPF and DKIM, DMARC at p=none or stronger with alignment, one-click List-Unsubscribe honoured within a couple of days, and a low complaint rate. Yahoo publishes its expectations in its sender best practices. Because the two providers coordinated the rollout, a domain that satisfies Gmail generally satisfies Yahoo.

Microsoft (Outlook.com / Hotmail)

• SPF, DKIM and DMARC all required for high-volume senders (the threshold is likewise around 5,000/day).
• Alignment — DMARC must pass against the From domain.
• Functional one-click unsubscribe and general list-hygiene expectations.
• Valid PTR / reverse DNS and mail sent over TLS.

Enforcement: Microsoft rejects non-compliant bulk mail with 550 5.7.515 (“Access denied, sending domain does not meet the required authentication level”). Initially such mail was routed to Junk; the enforcement phase moves it to outright rejection.

The requirements that apply everywhere

Strip away the per-provider labels and the same short list is doing the work:

• SPF AND DKIM AND DMARC, aligned. Not one, not two — all three, with DMARC passing against your visible From. This is the foundation; the full mechanics are in the SPF, DKIM & DMARC guide. Verify each with the SPF Checker, DKIM Checker and DMARC Checker.
• One-click List-Unsubscribe (RFC 8058), honoured within ~2 days. The header must process the unsubscribe on a single POST — no login, no confirmation page — and you must actually stop sending within about two days. Keep a visible link in the body too; it’s still expected and often legally required. Test a real message with the List-Unsubscribe Checker.
• Valid PTR / FCrDNS. Your sending IP must have a reverse DNS record that forward-resolves back to it.
• TLS in transit. Connections must be encrypted.
• Spam-complaint rate under 0.3% — ideally below 0.1%. Above 0.3% you’ll be filtered even with flawless authentication. Track it in Google Postmaster Tools, which is the only place you see Gmail complaint rates directly.

How complaint rate is measured — and why it sinks senders

The complaint rate is the share of your delivered mail that recipients mark as spam. Google measures it on delivered volume, and the 0.3% ceiling is unforgiving: at 100,000 messages, just 300 “report spam” clicks puts you at the limit. The levers that keep it down are all upstream of the send — permission-based lists, obvious unsubscribe options, relevant content, and not mailing people who never engage. A dirty list drives complaints and bounces together, so verify before you send with the Email Verifier, and if bounces are your problem start with reducing your bounce rate.

What enforcement actually looks like

• Throttling / rate limits (421). The provider is slowing you down — usually a reputation or volume signal. Warm up and reduce speed.
• Filtered to spam. You may be passing auth but failing on complaints, engagement or content.
• Rejected — Gmail 5.7.26. Authentication or alignment is broken. Fix SPF/DKIM/DMARC alignment.
• Rejected — Microsoft 550 5.7.515. The domain doesn’t meet the required authentication level. Same fix, then confirm PTR and TLS.

See why newsletters go to spam for the alignment trap that causes most of these, and how to check and repair sender reputation when the problem is trust rather than configuration.

Verify compliance before your next send

Run the Bulk Sender Compliance Check for the full checklist against your domain, the Email Health Check for the underlying DNS and authentication, and the Email Deliverability Test to see what a real message does end-to-end. Keep DMARC monitoring running so a newly broken sender shows up in a report — not in a rejection wave. The authoritative rules are Google’s sender guidelines and Yahoo’s best practices; treat both as the source of truth over any third-party summary.