Gmail & Yahoo Bulk Sender Requirements: Complete 2026 Compliance Guide

In February 2024 Gmail and Yahoo rolled out the most significant change to email sending requirements in over a decade. By November 2025 enforcement escalated from warnings to outright rejection. If you send more than 5,000 messages per day to Gmail or Yahoo and you're not compliant, your mail is being rejected at SMTP — full stop.

Here's exactly what's required in 2026, what counts as "bulk," and how to verify compliance.

Who Counts as a Bulk Sender?

Both Gmail and Yahoo define bulk sender as: sending 5,000+ messages per day to that provider from the same primary domain.

• The 5,000 is per provider, not total. 4,000 to Gmail + 4,000 to Yahoo = not bulk for either.
• Counted across all subdomains that share the primary domain (e.g. mail.example.com + news.example.com + example.com aggregate).
• Once you cross 5,000 in a single day, the rules apply — even if you drop below the next day.

If you're under 5,000/day you should still comply: the requirements are objectively good practice, and Gmail/Yahoo are gradually applying the same rules to smaller senders.

Requirement 1: SPF AND DKIM (Not OR)

Every message must:

• Pass SPF with the sending IP authorized in your SPF record, AND
• Pass DKIM with a 1024-bit or stronger key.

Previously you could rely on just one. Now both are required for bulk senders. Verify with our SPF Lookup and DKIM Lookup.

Requirement 2: DMARC Published

A DMARC record must exist at _dmarc.yourdomain.com. The minimum policy is:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

p=none is sufficient. You do not need to enforce (p=quarantine or p=reject) to satisfy the requirement — but you should plan to move there once your DMARC reports are clean.

Generate one with our DMARC Generator.

Requirement 3: Domain Alignment

The From header domain must align with either the SPF-authenticated domain (Return-Path) or the DKIM-signing domain. This is the trap most senders fall into.

Example of misalignment:

• From: hello@yourdomain.com
• Return-Path: bounces.esp.com (SPF passes for esp.com, not yourdomain.com)
• DKIM signature: d=esp.com (passes for esp.com, not yourdomain.com)

Result: SPF and DKIM both pass, but DMARC fails because nothing aligns with the visible From. Mail rejected with 550 5.7.26.

Fix: enable custom-domain DKIM (sometimes called "branded DKIM" or "sending domain authentication") in your ESP. Every major platform supports it.

Requirement 4: One-Click Unsubscribe (RFC 8058)

Marketing and promotional bulk mail must include both:

List-Unsubscribe: <mailto:unsub@yourdomain.com>, <https://yourdomain.com/u?id=abc>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

The HTTPS URL must process the unsubscribe with a single POST request — no login, no confirmation page, no captcha. The user clicks "Unsubscribe" in Gmail/Yahoo, Gmail sends one POST to your URL, and the user is gone.

Processing must complete within 2 days. Most failures we see are sites that 302-redirect to a confirmation page or require the user to log in — both will fail Gmail/Yahoo's compliance checks.

Requirement 5: Spam Rate Below 0.3%

This is the only outcome-based requirement. Your spam rate measured in Google Postmaster Tools must stay below 0.3% — ideally below 0.1%.

What counts:

• Numerator: messages that landed in the inbox and were marked spam by the recipient.
• Denominator: messages that landed in the inbox.

Messages Gmail itself filtered to spam don't enter the calculation, so the 0.3% is harder to hit than it sounds — you have to make people who received you in inbox actively complain.

Sustained breaches lead to: increased filtering, then rejections, then domain-wide blocks.

Requirement 6: Proper Forward-Confirmed Reverse DNS (FCrDNS)

Your sending IP must have a PTR record that resolves back to a hostname that resolves forward to the same IP. Check yours with our PTR Lookup.

This is usually set by your ESP or hosting provider on shared/dedicated IPs. If you run your own MTA, file a request with your IP provider to set the PTR.

Requirement 7: TLS for Connections

All connections to Gmail and Yahoo must use TLS. Plaintext SMTP is rejected. Any modern MTA does this automatically; if you're running anything older than ~2018, audit your TLS config.

Yahoo-Specific Notes

Yahoo's requirements mirror Gmail's, with a few additions worth knowing:

• Yahoo enforces the CFBL (Complaint Feedback Loop) more aggressively — register at postmaster.yahooinc.com.
• Yahoo's spam-rate threshold is the same 0.3%, measured similarly.
• Yahoo includes AOL, Verizon.net, and several legacy domains under the same filtering infrastructure.

Compliance Checklist

Before your next campaign:

• SPF record exists, includes every sending source, under 10 DNS lookups
• DKIM is enabled and aligned with the From domain (2048-bit recommended)
• DMARC record exists with at least p=none and rua= reporting
• DMARC aggregate reports show >99% pass rate over 14 days
• One-click unsubscribe (List-Unsubscribe + List-Unsubscribe-Post) on every promotional message
• Unsubscribe URL processes a single POST — no login, no captcha
• Postmaster Tools verified for every From domain you use
• Spam rate in Postmaster Tools below 0.1% over 30 days
• PTR record set on every sending IP and forward-confirms
• TLS enabled and forced on all outbound SMTP

What Happens If You Don't Comply?

Enforcement is graduated:

1. Filtering — messages route to spam folder at higher rates.
2. Temporary rejections (421) — Gmail/Yahoo throttle volume.
3. Permanent rejections (550 5.7.26) — messages bounced at SMTP.
4. Domain-level reputation block — even compliant subdomains affected.

Recovery from stage 3 or 4 takes weeks of clean sending — much harder than getting compliant in the first place.

FAQ

Does the 5,000/day threshold apply per IP or per domain? Per From-header domain, aggregated across all subdomains and IPs.

Do transactional emails (password resets, receipts) count toward the 5,000? Yes — Gmail counts all mail from a domain. But transactional mail rarely triggers spam complaints, so it usually helps your spam rate average rather than hurting it.

What if I use multiple ESPs? Do I need separate DKIM for each? Yes. Each sending source needs its own DKIM key (different selectors) — and all must align with the From domain.

Stay Compliant Automatically

Compliance isn't a one-time project — DNS records drift, new sending tools get added without proper auth, and spam rates spike when a campaign goes wrong. MailVitals monitors every requirement on this page continuously and alerts you the moment something breaks..