Gmail and Yahoo require bulk senders to authenticate mail with SPF, DKIM, and DMARC, keep the user-reported spam rate below 0.3%, and offer one-click unsubscribe on marketing mail that gets honored within two days. Every sender, bulk or not, needs SPF or DKIM, valid forward and reverse DNS, TLS, and RFC-compliant messages. Both providers began enforcing these rules in February 2024, and Gmail has tightened enforcement since.

This guide explains what each requirement means in practice and then walks you through a self-audit you can run with nothing more than a test inbox and a DNS lookup. If you want the bigger picture of how all three major providers (including Microsoft) stand right now, read our 2026 state of play for Gmail, Yahoo and Microsoft sender rules. This post is the hands-on version: what to check, where to look, and what “passing” looks like.

Who counts as a bulk sender at Gmail and Yahoo

The two providers define “bulk” differently, and the difference matters.

Gmail defines a bulk sender as one that sends close to 5,000 or more messages to personal Gmail accounts within 24 hours. Messages from the same primary domain are counted together, so mail from news.example.com and billing.example.com adds up under example.com. Once you cross that line, the status is permanent. Google’s sender guidelines FAQ says bulk sender status doesn’t have an expiration date.

Yahoo won’t give you a number. Its sender FAQ says it will not specify a volume threshold and evaluates senders at the authenticated domain or From-header domain level using all available signals. In practice, if you send marketing mail at any real volume, treat yourself as a bulk sender at Yahoo.

Yahoo’s rules also cover AOL, because AOL mailboxes are hosted on the same platform.

The requirements side by side

Here is what each provider asks for, based on Google’s Email sender guidelines and Yahoo’s sender best practices.

Requirement	Gmail (all senders)	Gmail (bulk)	Yahoo (all senders)	Yahoo (bulk)
SPF / DKIM	SPF or DKIM	SPF and DKIM	SPF or DKIM	SPF and DKIM
DMARC	Not required	Required, `p=none` allowed	Not required	Required, at least `p=none`, must pass
From-domain alignment	Not required	Must align with SPF or DKIM domain	Not required	Must align with SPF or DKIM domain (relaxed is fine)
Forward and reverse DNS	Required	Required	Required	Required
TLS	Required	Required	Not listed as a requirement	Not listed as a requirement
Spam rate	Below 0.3%	Below 0.3%	Below 0.3%	Below 0.3%
One-click unsubscribe	Not required	Required for marketing and subscribed mail	Not required	Required for marketing and subscribed mail
Honor unsubscribes	—	Within 48 hours (recommended)	—	Within 2 days
RFC 5322 formatting	Required	Required	Required (RFC 5321 and 5322)	Required

A few details that trip people up:

DKIM key length. Google asks for at least 1024-bit keys and recommends 2048. Yahoo’s FAQ requires 1024 bits or more.
Spam rate targets. Google sets 0.3% as the line you must stay under, and recommends staying below 0.1%.
Unsubscribe method. Gmail’s FAQ says a mailto link or a landing-page link doesn’t satisfy the one-click requirement. You need the RFC 8058 headers. Yahoo calls the RFC 8058 POST method “highly recommended” and still accepts mailto.
Transactional mail. Both providers exempt transactional messages, such as password resets and order confirmations, from the one-click unsubscribe requirement.

Enforcement timeline for the Gmail and Yahoo rules

According to Google’s sender guidelines FAQ:

February 2024: Requirements took effect for senders of 5,000+ messages a day. Gmail stopped offering delivery-issue mitigation to senders who don’t meet the guidelines.
June 1, 2024: Deadline for senders who already had an unsubscribe link to add one-click unsubscribe to commercial and promotional mail.
June 2024: Bulk senders with a spam rate above 0.3% became ineligible for mitigation.
November 2025: Gmail began ramping up enforcement on non-compliant traffic.

Non-compliant mail at Gmail can be deferred with temporary 4.7.x errors, blocked with 5.7.x errors, or sent to spam. Yahoo’s FAQ says its enforcement started in February 2024 and rolled out gradually, with List-Unsubscribe enforcement beginning in June 2024.

Microsoft followed with its own rules for senders of more than 5,000 messages a day to Outlook.com consumer addresses, effective May 5, 2025, per its sender policies page. Microsoft’s 550 5.7.515 support article describes non-compliant mail being rejected. Our post on how Microsoft now rejects non-compliant bulk mail outright covers that change in detail.

How to audit your compliance in 30 minutes

You don’t need a paid tool to check most of this. Work through these steps with a test Gmail account and a test Yahoo account.

Step 1: Send a real campaign to your test inboxes

Send the same campaign you would send to your list, through the same platform, from the same From address. A test from a different tool proves nothing.

Step 2: Read the Authentication-Results header

In Gmail, open the message, click the three-dot menu, and choose Show original. Gmail shows a summary at the top with SPF, DKIM, and DMARC results. The raw header looks like this:

Authentication-Results: mx.google.com;
       dkim=pass header.i=@example.com header.s=s1 header.b=AbC123;
       spf=pass (google.com: domain of bounce@mail.example.com designates 192.0.2.10 as permitted sender) smtp.mailfrom=bounce@mail.example.com;
       dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=example.com

What you’re checking:

dkim=pass and the header.i or d= domain is example.com or a subdomain of it.
spf=pass. The smtp.mailfrom domain can be a subdomain like mail.example.com.
dmarc=pass with header.from=example.com.

If DKIM passes but the signing domain is your email platform’s domain (something like d=sendgrid.net or d=mcsv.net) and SPF’s domain is also theirs, DMARC fails alignment even though “everything passes.” That’s the most common failure we see. Our post on DMARC alignment explains why.

Step 3: Check your DMARC record exists

Look up the TXT record at _dmarc.example.com. The minimum that satisfies Gmail and Yahoo:

_dmarc.example.com.  IN TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

Yahoo strongly recommends the rua tag during setup so you receive aggregate reports. p=none is enough to comply, but it gives your domain no protection against spoofing. Plan a move to quarantine or reject once your reports show every legitimate sender is aligned.

Step 4: Check SPF and DKIM DNS records

Your SPF record lives at the domain used in the envelope sender (Return-Path):

mail.example.com.  IN TXT  "v=spf1 include:_spf.your-esp.example ~all"

Your DKIM public key lives at selector._domainkey.example.com. Confirm the selector in the s= tag of the DKIM-Signature header matches a published key.

Step 5: Check the unsubscribe headers

In Show original, look for both headers:

List-Unsubscribe: <https://example.com/u/8f3a2c1d>, <mailto:unsub-8f3a2c1d@example.com>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

Then check the DKIM-Signature header’s h= tag. Both List-Unsubscribe and List-Unsubscribe-Post must be listed there, because RFC 8058 requires them to be covered by a valid DKIM signature. If they aren’t signed, mailbox providers shouldn’t offer the one-click button. Our one-click unsubscribe guide covers building the endpoint.

Also confirm there’s a visible unsubscribe link in the body. Both providers require it in addition to the header.

Step 6: Check reverse DNS and TLS

Gmail’s “Show original” view includes the Received: line from your sending server. Note the sending IP, then look up its PTR record. Google requires that the PTR hostname resolves back to the same IP with an A or AAAA record. If you use an email service provider, they handle this, but it’s worth confirming if you run your own MTA.

For TLS, look for version=TLS1_2 or TLS1_3 in the Received: header that Google added. If it’s missing, your server isn’t negotiating TLS.

Step 7: Check your spam rate in Postmaster Tools

Set up Google Postmaster Tools for your sending domain. The Compliance status dashboard shows whether you’re meeting each requirement, and the Spam Rate dashboard shows the daily user-reported rate. For Yahoo, enroll in the Complaint Feedback Loop in Yahoo Sender Hub.

What these rules don’t say (but you still need)

The written requirements are the floor. Both providers also filter on signals they don’t publish thresholds for:

Bounces. Repeatedly mailing addresses that don’t exist tells providers you aren’t maintaining your list. Yahoo’s best practices tell senders to remove invalid recipients promptly.
Spam traps. Old, purchased, or scraped lists contain trap addresses. See spam traps and how they got on your list.
Engagement. Yahoo’s guidance talks about reaching “an active and engaged audience” and matching send frequency to what subscribers signed up for.
Consent. Both providers say not to send unsolicited mail. Buying lists is the fastest way to break this rule.

A simple first defense is to screen addresses before they reach your list. Our free email verifier checks syntax, confirms the domain has working MX records, flags disposable and role-based addresses, detects free-provider domains, and catches common typos like gmial.com. It doesn’t connect to the recipient’s mailbox, so it can’t confirm a specific inbox exists, but it removes the obvious junk that drives up bounces.

Common compliance failures and fixes

Symptom	Likely cause	Fix
`dmarc=fail` while SPF and DKIM pass	Neither passing domain aligns with the From domain	Set up custom DKIM signing with your own domain in your ESP
Gmail shows no Unsubscribe link next to the sender	Missing `List-Unsubscribe-Post`, headers not DKIM-signed, or low sender trust	Add both headers and include them in the DKIM `h=` tag
4.7.x deferrals from Gmail	Authentication or rate problems	Read the full error text; it names the failing check
Compliance status shows “Needs work”	One requirement failing on a rolling average	Fix the issue; Google says status can take up to 7 days to update
Spam rate creeping toward 0.3%	Unengaged or unexpected recipients	Segment by engagement, tighten sign-up consent, sunset inactives

A maintenance routine that keeps you compliant

Weekly: Check Postmaster Tools spam rate and compliance status.
Per new sending tool: Before a CRM, help desk, or billing platform sends as your domain, set up custom DKIM for it. Every new tool is a new chance to break alignment.
Monthly: Review DMARC aggregate reports for unknown senders using your domain.
At every list import: Screen the file with an email verifier and remove duplicates, typos, and dead domains.
Quarterly: Test your unsubscribe flow end to end at Gmail and Yahoo and confirm opt-outs land in your suppression list within two days.

FAQ

Do the Gmail and Yahoo requirements apply if I send fewer than 5,000 emails a day?

Yes, partly. Every sender must have SPF or DKIM, valid forward and reverse DNS, a spam rate below 0.3%, and properly formatted messages, and Gmail also requires TLS. The DMARC, alignment, and one-click unsubscribe rules are the bulk-sender additions, and Yahoo doesn’t publish a fixed volume cutoff, so it’s safer to meet all of them.

Is p=none really enough for DMARC?

For compliance, yes. Both Gmail and Yahoo accept p=none, as long as DMARC passes. It doesn’t stop anyone from spoofing your domain, though, so treat it as a starting point and move toward quarantine or reject once your reports show all legitimate senders are aligned.

Do transactional emails need one-click unsubscribe?

No. Google’s FAQ says one-click unsubscribe is required only for marketing and promotional messages, and Yahoo exempts transactional mail like password resets and order confirmations. Keep marketing content out of your receipts, though, or the message may be treated as promotional.

How fast do I have to process unsubscribes?

Yahoo says requests not honored within 2 days don’t meet its requirement, and Google recommends 48 hours. US law under CAN-SPAM allows up to 10 business days, but the mailbox-provider rules are stricter, so build for two days or less.

Will meeting these requirements guarantee inbox placement?

No. The requirements are a minimum bar for getting your mail considered at all. Inbox placement still depends on your reputation, which comes from complaints, engagement, bounces, and list quality.

Gmail and Yahoo Bulk Sender Requirements Explained (With a Self-Audit)