Inboxpass All guides

Guides

Google and Yahoo bulk sender requirements

21 October 2026

Gmail and Yahoo ask every sender for SPF or DKIM, valid forward and reverse DNS, standards-compliant messages, and a spam rate under 0.3%. Bulk senders also need both SPF and DKIM, a DMARC record that passes with the From domain aligned, and one-click unsubscribe on marketing mail. Most of it is DNS you can check today. The rest is how you run your list.

Who counts as a bulk sender

Google’s line is a number. Its email sender guidelines apply the bulk rules to senders who send more than 5,000 messages a day to personal Gmail accounts. The sender guidelines FAQ fills in three details that catch people out:

Yahoo’s Sender Best Practices page does not publish a number. It describes bulk senders by volume and leaves it there. If you send newsletters or promotions to more than a handful of people, plan to meet the bulk list. It is not much more work than the basic list, and it covers you at both providers.

Microsoft joined in 2025. Its Outlook.com postmaster policies say that from 5 May 2025, domains sending more than 5,000 emails a day to Outlook.com accounts must pass SPF, pass DKIM, and publish DMARC of at least p=none, aligned with SPF or DKIM. Mail that falls short goes to junk at first and can later be rejected with 550; 5.7.515.

What every sender needs

These apply even if you send a few hundred messages a month.

Google also requires DKIM keys of at least 1024 bits for mail to personal Gmail accounts, and recommends 2048 bits where your DNS host allows it.

What bulk senders need on top

Yahoo strongly recommends adding an rua address to the DMARC record so you get aggregate reports while you set things up. It also asks senders that forward mail to add ARC headers.

Transactional mail and forwarded mail

One-click unsubscribe is for marketing and promotional messages. Google’s FAQ lists password resets, reservation confirmations, and form confirmations as examples that do not need it. They still need the authentication.

Google also says DMARC alignment is not required for indirect mail, meaning messages that were forwarded or sent through a mailing list. That matters because forwarding often breaks SPF, and lists that edit the subject or footer break DKIM. You cannot fix those breaks from your own DNS, and the rule does not expect you to.

What happens if you do not comply

Google started in February 2024 and has tightened over time. Its FAQ gives the milestones:

The FAQ lists the error codes Gmail returns, which makes a bounce easier to diagnose:

Yahoo announced enforcement starting in February 2024, rolled out gradually through the first half of that year.

How to comply, in order

1. List everything that sends as your domain

Your mailbox provider (Google Workspace, Microsoft 365), your newsletter tool, your store platform, your help desk, your invoicing app, and anything a developer wired up years ago. Each one needs to pass SPF or DKIM as your domain. Most people find one they forgot. Your first DMARC reports will show you the rest.

2. Publish one SPF record

One TXT record at the domain, starting with v=spf1, with an include for each service that sends with your domain in the envelope sender. Two SPF records at the same name is an error, not a backup. Keep it under the ten DNS lookup limit.

v=spf1 include:spf.provider-one.example include:spf.provider-two.example ~all

The include names are placeholders. Copy the exact include each provider documents for your account.

3. Turn on DKIM for each service, on your domain

Most services sign with their own domain until you set up your own. That signature passes DKIM but does not align with your From domain, so it does not count for DMARC. Each service has a DNS step, usually one or more CNAME or TXT records at a selector such as s1._domainkey.example.com. Publish them, then turn signing on in the service.

4. Publish a DMARC record at p=none

_dmarc.example.com  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

That meets the bulk requirement at both providers. DMARC was defined in RFC 7489, which RFC 9989 replaced in May 2026 with the same basic record. p=none asks receivers to take no action on failures. The rua address gets daily aggregate reports, which you can learn to read with our guide to DMARC reports. Nothing here requires quarantine or reject. Moving there later is still worth doing, once the reports show only your own mail passing.

5. Send a test and read the headers

Send a real campaign or message to a Gmail address you control. Open it, click the three-dot More menu next to Reply, and choose Show original (Google documents this in its full headers help). Look for the Authentication-Results header, defined in RFC 8601. You want spf=pass or dkim=pass on your own domain, and a DMARC pass. If DKIM passes but header.d= shows the provider’s domain, step 3 is not finished for that service.

6. Add one-click unsubscribe

If you send through an email marketing platform, check its help pages for one-click unsubscribe before you build anything. If you send from your own code, RFC 8058 spells out what is needed:

List-Unsubscribe: <https://example.com/unsub?u=8f3a2c>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

Keep the visible unsubscribe link in the footer too.

7. Watch your spam rate

Sign up for Google Postmaster Tools and verify your domain. It shows the user-reported spam rate Google measures against the 0.3% line. The fixes for a high rate are not in DNS: stop mailing people who never opted in, remove addresses that have not opened in a long time, and make the unsubscribe easy to find.

What the rules do not promise

Meeting every item does not guarantee the inbox. Google says authenticated messages are less likely to be rejected or marked as spam by Gmail. Less likely is the promise. Content, complaints, and sending history still count. What the rules do is remove an easy reason to block you. Missing DNS is the most common one, and the cheapest to fix.

Sources