Bulk Sender Requirements in 2026: Gmail, Yahoo and Outlook Rules

Each provider draws the line in a different place.

• Gmail treats you as a bulk sender if you send close to 5,000 messages or more to personal Gmail accounts within 24 hours. Messages from the same primary domain count together, which means a subdomain does not start a separate count, and once you qualify you are permanently considered a bulk sender. Google’s FAQ notes the guidelines apply to mail sent to personal Gmail accounts, not to Google Workspace accounts.
• Yahoo describes a bulk sender as one sending a significant volume of mail, and says it will not specify a threshold.
• Outlook applies its rules to domains sending more than 5,000 emails per day to its consumer service: outlook.com, hotmail.com and live.com addresses.

Staying under a threshold doesn’t clear you of everything. Gmail and Yahoo both ask every sender, whatever the volume, for SPF or DKIM, valid forward and reverse DNS, and a spam rate under 0.3%.

Google’s email sender guidelines set a floor for all senders: SPF or DKIM, valid forward and reverse DNS for sending domains or IPs, TLS for transmission, messages formatted to the RFC 5322 standard, no impersonation of Gmail From headers, and a spam rate reported in Postmaster Tools below 0.3%.

Bulk senders owe more. They need both SPF and DKIM, a published DMARC record (a policy of none is accepted), a From domain aligned with either the SPF or the DKIM domain, and one-click unsubscribe for marketing and subscribed messages through the List-Unsubscribe and List-Unsubscribe-Post headers. An unsubscribe link in the body, on its own, does not meet the one-click requirement.

The spam figure has two levels. Google asks senders to stay below 0.1% and never reach 0.3%. A bulk sender above 0.3%, according to Google’s FAQ, is not eligible for mitigation until the rate stays below 0.3% for seven consecutive days.

The requirements began in February 2024. Senders who already had an unsubscribe link were given until June 1, 2024 to add one-click unsubscribe. Google says that from November 2025 it is ramping up enforcement, and that non-compliant mail can see temporary and permanent rejections.

Yahoo’s sender best practices start with a baseline for everyone: at least SPF or DKIM, a spam rate below 0.3%, valid forward and reverse DNS for sending IPs, and compliance with RFC 5321 and RFC 5322.

On top of that, bulk senders must:

• Implement both SPF and DKIM
• Publish a valid DMARC policy of at least none, and pass DMARC
• Align the From domain with the SPF or DKIM domain (relaxed alignment is accepted)
• Support one-click unsubscribe through a List-Unsubscribe header, with the RFC 8058 method highly recommended
• Show a clearly visible unsubscribe link in the body
• Honor unsubscribes within two days

Yahoo began enforcing in February 2024, rolling out gradually. Enforcement of the unsubscribe requirement started in June 2024.

Microsoft’s announcement for high-volume senders requires three things to pass: SPF for the sending domain, DKIM, and DMARC with a policy of at least none, aligned with SPF or DKIM and preferably both. Enforcement began on May 5, 2025.

The post has been updated since it first went up. It describes routing non-compliant mail to Junk and rejecting it with the error 550 5.7.515, with further rejection to follow. Whichever stage applies on the day you send, mail that fails authentication does not reach the inbox.

Microsoft’s recommendations go past authentication: a From or Reply-To address that is valid and can receive replies, a working, visible unsubscribe link, regular removal of invalid addresses, accurate subject lines, and recipients who have agreed to hear from you.

Side by side, as each provider publishes them:

The overlap is large. All three expect SPF, DKIM and DMARC with alignment. All three expect an easy way to stop receiving mail, and two of the three publish a spam rate ceiling. Meet the strictest version of each row and you satisfy every provider at once, with no need to track where they differ.

You don’t need special tools for a first answer. With access to your DNS and a test inbox, most of the requirements can be confirmed in under an hour.

1. 1List every service that sends as your domain. Your mailbox provider, outreach tool, marketing platform, billing system and helpdesk often all send as yourcompany.com. Each one has to be covered by SPF and sign with DKIM, or it will fail alignment.
2. 2Look up the SPF, DKIM and DMARC TXT records for the domain and for every subdomain you send from. Keep a single SPF record per domain. Microsoft’s FAQ notes that an SPF record needing more than 10 DNS lookups may fail.
3. 3Send a test to a personal Gmail address and an Outlook.com address. In Gmail, the Show original view lists whether SPF, DKIM and DMARC passed for that message. Repeat it for each sending service: the helpdesk can fail while your main mailbox passes.
4. 4In the same view, confirm that List-Unsubscribe and List-Unsubscribe-Post are present. Then click unsubscribe and check that the address leaves every list.
5. 5After a week or two, read your DMARC aggregate reports. They show every source sending as your domain, and an unknown source is either a service you forgot or someone spoofing you.

Run the check again whenever a new tool starts sending for you. Most failures show up the week someone connects a new service and nobody updates the records.

A small team sending cold email may stay far below 5,000 messages a day. That is a thin reason to relax. Several rules apply to every sender, Gmail counts volume per primary domain across all your inboxes and subdomains, and its bulk status never expires once reached. Plan as if the full set applies to you.

Spam rate is the harder problem. Cold outreach goes to people who never signed up, which makes a spam report more likely than on a newsletter. Google states that recipients, not Google, decide whether a message is promotional, and Microsoft lists consent among its recommended practices. The approach that lasts is outreach a well-chosen recipient finds relevant: a tight target, a specific reason to write and an easy way out.

The rules also change how you run outreach from one week to the next:

• A tool that sends through your mailbox inherits its authentication. One that sends from its own servers needs its own SPF and DKIM entries.
• Ten inboxes on one domain keep each inbox’s volume modest, but every one of them adds to the same domain total.
• Reputation is shared across the domain. One teammate’s careless campaign affects everyone who sends from it, including the account manager writing to existing customers.

Provider rules sit alongside laws on commercial email and personal data, which differ by country. Those are separate obligations, and your own position is a question for counsel.

The day-to-day side of meeting the rules is covered in email deliverability for cold outreach. Complaints stay low when messages are relevant to the person reading them, which is the subject of personalized cold email.

Run this for every domain and subdomain you send from:

• SPF published and passing for every service that sends as the domain
• DKIM signing turned on and passing, with the key published in DNS
• DMARC record published with at least p=none and a reporting address
• From domain aligned with the SPF or DKIM domain
• Valid forward and reverse DNS for sending IPs (your mail provider usually handles this)
• Mail sent over TLS
• List-Unsubscribe and List-Unsubscribe-Post headers on every outreach email, plus a visible opt-out line
• Unsubscribes honored across every campaign within two days at most, ideally at once
• From and Reply-To addresses that are real and receive replies
• Spam rate checked in Google Postmaster Tools and kept below 0.1%
• Invalid addresses and repeat bounces removed from every list

A setup that passes today still needs watching. Bounce and complaint signals per inbox give the early warning, as set out in the outreach metrics that matter.