Bulk Sender Compliance

🛡 Deliverability & security

Check whether your domain meets the Gmail, Yahoo and Outlook rules for high-volume senders.

No sign-up required Runs on our own infrastructure Also available via API
Try:

Runs on our diagnostic API. We don’t attach your input to an account for these free tools; short-lived rate-limit/security logs may exist, and requests are rate-limited per IP.

In February 2024, Gmail and Yahoo stopped treating email authentication as a nice-to-have. If you send a meaningful volume of mail to their users, a specific set of requirements now decides whether your messages reach the inbox, get filtered to spam, or are rejected outright at the SMTP handshake. The rules aren’t exotic — most are things a well-run sending program should already be doing — but the enforcement is new, and a lot of senders discovered the hard way that “it worked last year” is no longer a plan. This page walks through each requirement, who it applies to, and how to actually meet it.

Who these rules apply to

The headline threshold is roughly 5,000 messages per day sent to Gmail addresses (Google counts across a domain) or to Yahoo-family addresses. Cross that line even once and Google treats you as a bulk sender going forward. But don’t anchor too hard on the number: a portion of the requirements — valid authentication, not spamming people — applies to every sender regardless of volume, and both providers have been tightening the baseline for smaller senders too. The honest read is that 5,000/day is when the rules become strictly enforced, not when they start mattering. Read them straight from the source: Google’s sender guidelines and Yahoo’s sender best practices.

Requirement 1: SPF, DKIM and DMARC — all three, aligned

This is the part that trips up the most senders, because for years you could get away with one of the three. Not anymore. Bulk senders need all of the following:

  • SPF that authorises the servers sending on your behalf. Publish a single v=spf1 TXT record listing your sources and ending in ~all or -all. Verify it with the SPF checker and watch the 10-lookup limit.
  • DKIM signing on your outbound mail, with a healthy key (2048-bit RSA is the modern norm). The signature is what proves the message wasn’t altered and genuinely came from a domain holding the private key. Confirm your published key with the DKIM checker.
  • DMARC published at _dmarc.yourdomain.com, at minimum p=none. That’s the floor — see below on why you shouldn’t stay there. Check it with the DMARC checker.

The word that matters most here is alignment. DMARC doesn’t just want SPF or DKIM to pass — it wants at least one of them to pass and match your visible From: domain. A common failure mode is mail that authenticates perfectly against your ESP’s domain but not yours, so DMARC fails even though SPF and DKIM both say “pass.” If your provider signs and returns bounces as their own domain, you need to configure them to sign and send as your domain (usually via CNAMEs and a custom return-path). The mechanism is defined in RFC 7489.

Requirement 2: one-click unsubscribe honored within two days

For marketing and promotional mail, you must include a working one-click unsubscribe in the headers. Concretely, that’s a List-Unsubscribe header with an HTTPS URL, paired with List-Unsubscribe-Post: List-Unsubscribe=One-Click, as specified in RFC 8058. When set up correctly, Gmail and Yahoo render a native “Unsubscribe” control next to your sender name, and clicking it sends a single POST to your endpoint — no login, no confirmation page, no “are you sure?” interstitial.

Two operational rules go with it: the unsubscribe must actually be honored within two days, and a visible unsubscribe link in the message body is still expected on top of the header. Verify your headers on a real sent message with the List-Unsubscribe checker — this is a message-level requirement, so it can’t be confirmed from DNS alone.

Requirement 3: keep spam complaints under 0.3%

Both providers require you to stay below a 0.3% spam complaint rate, and both are explicit that you should aim well under it — treat 0.1% as your working ceiling and 0.3% as the point where deliverability starts collapsing. Complaints are measured as the fraction of delivered messages that recipients mark as spam. The only way to see your Gmail number is Google Postmaster Tools — set it up and watch the spam-rate dashboard, because you are flying blind without it. High complaint rates usually trace back to poor list hygiene, buying or scraping addresses, unclear opt-in, or emailing people who forgot they signed up. Cleaning your list and honoring unsubscribes fast is how you keep the number down.

Requirement 4: the plumbing — PTR, TLS and a clean HELO

The remaining requirements are infrastructure hygiene that most established senders already meet:

  • Valid reverse DNS (PTR / FCrDNS). Your sending IP must have a PTR record whose hostname resolves back to that same IP. Receivers use this to distinguish real mail servers from random hosts. Confirm it with the reverse DNS checker.
  • TLS for transmission. Connections that carry your mail should use TLS. Any competent mail server or ESP does this by default now.
  • A valid, consistent HELO/EHLO name that matches your PTR, plus a properly formatted message that isn’t trying to impersonate Gmail or Yahoo in the From line.

What this checker can and can’t see

Scanning a domain confirms the DNS-side requirements — SPF, DKIM where a selector is discoverable, and DMARC with its policy. It can’t see the message-side ones: real SPF/DKIM alignment against your actual From:, the one-click unsubscribe headers, your sending IP’s PTR, or your complaint rate. Those need a real message and your Postmaster Tools data. Pair this with the List-Unsubscribe checker, the deliverability test, and the broader email health check for the full picture. If you’re here because a newsletter suddenly stopped landing, the guide to why bulk emails fail and the deliverability cheat sheet walk through the fixes in order.

Frequently asked questions

Do the Gmail and Yahoo bulk-sender rules apply to me?
The strict thresholds hit senders of ~5,000+ messages/day to Gmail or Yahoo users, but SPF/DKIM/DMARC and low complaints are expected of everyone. 5,000/day is when it’s strictly enforced, not when it starts mattering.
Is p=none enough for DMARC compliance?
It satisfies the rule, which only requires a published DMARC record — but p=none is monitor-only and stops no spoofing. Use it to collect reports, then move to quarantine and reject. See the spoofing risk check.
What spam complaint rate do Gmail and Yahoo require?
Under 0.3%, and both providers say aim well below it — treat 0.1% as your ceiling. Watch it in Google Postmaster Tools, which is the only way to see your Gmail number.
Why can’t you confirm one-click unsubscribe from my domain?
It lives in the message headers (List-Unsubscribe and List-Unsubscribe-Post), not DNS, so it needs a real sent message. Confirm it with the List-Unsubscribe checker.