Google and Yahoo Bulk Sender Requirements Checklist

Google and Yahoo require bulk senders, roughly anyone sending 5,000 or more messages a day to their users, to authenticate with SPF and DKIM, publish a DMARC policy aligned with the From domain, keep the spam complaint rate below 0.3 percent, and offer one click unsubscribe. Here is the full checklist.

The rules took effect in February 2024 and enforcement has tightened since. What began as warnings and temporary deferrals has become outright rejection for mail that does not comply, and Microsoft introduced similar requirements for Outlook.com, Hotmail and Live addresses in 2025. If you send marketing, newsletters, cold outreach or even large volumes of transactional mail, these requirements decide whether your messages reach the inbox at all. The checklist below follows the order in which problems usually show up.

Who counts as a bulk sender

Google defines a bulk sender as one that sends close to 5,000 messages or more to personal Gmail accounts within 24 hours. The count is per primary domain, so mail from news.example.com and billing.example.com adds up under example.com. Once you cross the threshold, Google treats you as a bulk sender permanently, even if your volume drops later. Yahoo uses the same idea without publishing an exact number, and Microsoft uses the same 5,000 per day figure for its consumer domains.

Even if you are well below the threshold, most of the list still applies. All senders must authenticate with SPF or DKIM, have valid reverse DNS and keep complaints low. The bulk sender rules simply remove the flexibility.

Checklist item 1. SPF that passes and stays under 10 lookups

SPF lists the servers allowed to send for a domain. The record is a TXT record such as v=spf1 include:_spf.example-esp.net ip4:203.0.113.10 -all. Receivers check the domain in the envelope sender (the Return-Path), not the visible From address, which is why SPF on its own is not enough for alignment.

The most common SPF failure we see is not a missing record. It is a record that breaks the lookup limit. RFC 7208 caps SPF evaluation at 10 DNS lookups. Every include, a, mx, ptr, exists and redirect counts, and nested includes inside your providers' records count too. A domain that adds a CRM, a help desk, a billing tool and two marketing platforms can reach 12 or 14 lookups without anyone noticing. When it does, receivers return a permerror and SPF fails for every message, including the ones from your main mail server. The RFC also limits "void lookups", queries that return no records, to two.

Fixes, in order of preference:

Remove includes for services you no longer use. This alone fixes most records.
Move services that send marketing or support mail to a subdomain with its own SPF record, such as mail.example.com.
Replace an include with the provider's explicit ip4 and ip6 ranges only if the provider documents them as stable, and recheck them regularly.
Never publish two SPF records for the same name. Two records is an automatic permerror.

Our SPF checker counts the lookups including nested ones and writes the result as a plain sentence, for example "SPF uses 12 DNS lookups, the limit is 10", so you know where the problem sits.

Checklist item 2. DKIM on every message, with your own domain

DKIM signs each message with a private key, and receivers verify it against a public key at selector._domainkey.example.com. Google requires DKIM for bulk senders, and the key should be at least 1024 bits; 2048 bits is the sensible default today.

The detail that matters is which domain signs. Many ESPs sign with their own domain by default, for example d=esp-mail.net. That passes DKIM but does not align with your From domain, so it does not help DMARC. Set up custom DKIM in every platform that sends for you so the signature carries d=example.com or a subdomain of it. Then confirm with a DKIM checker that each selector resolves and the key is valid.

Checklist item 3. DMARC published and aligned

Bulk senders must publish a DMARC record at _dmarc.example.com. The minimum Google and Yahoo accept is v=DMARC1; p=none;, which tells receivers to take no action on failures but still evaluate them. A practical starting record is:

v=DMARC1; p=none; rua=mailto:[email protected]; adkim=r; aspf=r

Publishing the record is not the same as passing. Each message must pass DMARC, which means either SPF passes for a domain aligned with the From domain, or DKIM passes with an aligned d= domain. Relaxed alignment (the default) accepts subdomains, so mail.example.com aligns with example.com. Strict alignment requires an exact match.

The rua tag is where the real value lies. Receivers send daily aggregate reports listing every IP that sent mail using your domain and whether it passed. Reading them is how you discover the forgotten survey tool or the regional office server that fails alignment. Our guide on how to read a DMARC aggregate report goes through the XML line by line, and DMARC monitoring turns those files into a list of sources with pass rates. Once every legitimate source passes, move to p=quarantine and then p=reject.

Checklist item 4. Valid forward and reverse DNS for every sending IP

Each IP that connects to Gmail must have a PTR record that resolves to a hostname, and that hostname must resolve back to the same IP. This is called forward confirmed reverse DNS. ESPs handle this for their shared pools, but dedicated IPs and self hosted servers often miss it. Generic PTR names that look like residential connections, such as 203-0-113-10.dynamic.isp.example, also hurt reputation and attract blacklist listings.

Checklist item 5. TLS for transmission

Gmail requires a TLS connection for bulk mail. Every modern mail server and ESP supports it, but older on premise appliances and some scripts that send through a local relay still deliver in plain text. Check the received headers of a test message: Gmail shows the TLS version used.

Checklist item 6. Spam rate under 0.3 percent, ideally under 0.1 percent

This is the requirement that catches the most senders, because it is about behaviour rather than configuration. Google measures the share of your messages that Gmail users mark as spam, and reports it in Postmaster Tools. Google recommends staying below 0.1 percent and says senders must never reach 0.3 percent. At 0.3 percent and above, mitigation is no longer available and delivery suffers quickly.

To put that in numbers: on 100,000 delivered messages, 300 spam reports puts you at the limit. A single campaign to an old segment can do it. Keep consent explicit, send what people signed up for, suppress inactive contacts and make the unsubscribe link easy to find. If you see the rate climb above 0.1 percent, slow down before it reaches 0.3. Spam rate alerts in our email deliverability monitoring flag exactly that, for example "Google spam rate 0.27 percent, above the 0.1 percent recommendation, close to the 0.3 percent bulk sender limit".

Checklist item 7. One click unsubscribe

Marketing and subscription messages must support one click unsubscribe as defined in RFC 8058. That means two headers:

List-Unsubscribe: <https://example.com/unsubscribe?u=abc123>, <mailto:[email protected]?subject=abc123>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

The HTTPS URL must accept a POST request and unsubscribe the recipient without asking them to log in or confirm anything. You also need a visible unsubscribe link in the body, and unsubscribes must be honoured within two days. Transactional messages such as receipts and password resets are exempt from the header requirement.

Checklist item 8. Do not impersonate Gmail

Google's guidelines forbid bulk mail that impersonates Gmail in the From header. A message with a @gmail.com From address sent through any server other than Gmail itself cannot pass DMARC alignment, and Gmail treats it as impersonation. The same applies to Yahoo, whose yahoo.com domain publishes p=reject, so such mail is simply refused. Always send from your own domain.

Yahoo and Microsoft differences

Yahoo's requirements mirror Google's: SPF and DKIM, DMARC with at least p=none, aligned From, a spam rate below 0.3 percent, one click unsubscribe honoured within two days, and valid reverse DNS. Yahoo publishes complaint data through its feedback loop rather than a dashboard like Postmaster Tools, so you need the feedback loop set up to see complaint trends.

Microsoft's rules for Outlook.com, Hotmail.com and Live.com cover high volume senders of more than 5,000 messages a day. SPF must pass, DKIM must pass, and DMARC must be published with at least p=none and aligned with SPF or DKIM. Non compliant mail is rejected with an error that points to the authentication level. Microsoft also recommends working unsubscribe links and list hygiene, and its Smart Network Data Services portal shows complaint and trap data per IP.

How to check compliance in ten minutes

Send a test message to a Gmail address and open "Show original". SPF, DKIM and DMARC should each read PASS, and the DKIM domain should be yours.
Run your domain through a DMARC checker to confirm the record syntax and the reporting address.
Count SPF lookups including nested includes.
Look up the PTR of every sending IP and confirm it resolves back.
Check the List-Unsubscribe and List-Unsubscribe-Post headers on a marketing message.
Open Postmaster Tools and check the spam rate trend for the last 30 days.
Check the sending IPs and domain against public blacklists with an email blacklist check, because a listing will undo all of the above.

Doing this once is easy. Doing it every week across many domains, ESPs and client accounts is where things slip, usually when someone adds a new sending tool without telling anyone. That is why we monitor SPF, DKIM, DMARC, reverse DNS, blacklists and spam rate continuously for every domain on the account and alert the moment one of them changes. You can see what each plan includes on the pricing page.