Gmail and Yahoo sender requirements
Since February 2024, Gmail and Yahoo expect every sender to authenticate their mail with SPF or DKIM, to send from servers with valid forward and reverse DNS, and to keep the spam rate their users report below 0.3%. Bulk senders must do more: publish SPF and DKIM and a DMARC policy, align the From: domain with one of them, and offer one-click unsubscribe in marketing mail. Mail that misses a requirement can be deferred, rejected or filed as spam.
Who counts as a bulk sender
Google defines it with a number. Its sender guidelines FAQ calls you a bulk sender once you send close to 5,000 messages or more within 24 hours to personal Gmail accounts. Messages from the same primary domain are added together, subdomains included, so 2,500 from example.com and 2,500 from news.example.com on the same day reach the mark. The status is permanent: a sender who has crossed the line once stays a bulk sender even if its volume drops later.
Yahoo's sender best practices list separate requirements for bulk senders but publish no volume threshold. If you send marketing or newsletters at any real scale, plan to meet the bulk rules at both providers.
Google's rules cover mail to personal Gmail accounts. The FAQ says they do not apply to mail sent to Google Workspace accounts, although they do apply to mail sent from Workspace to personal Gmail addresses.
Requirements for every sender
Both providers ask the same baseline of anyone who sends to their users, whatever the volume:
- SPF or DKIM. At least one of the two must authenticate the message. Unauthenticated mail to Gmail may be refused with 550 5.7.26.
- Valid forward and reverse DNS. The sending IP address needs a PTR record that resolves to a host name, and that host name must resolve back to the same IP. Google spells out this round trip in its email sender guidelines; Yahoo also recommends that PTR names be meaningful, reflect your domain and not look like dynamically assigned addresses. A missing PTR record is the usual cause of 550 5.7.25 (reverse DNS for mail servers).
- A spam rate below 0.3%. Google measures it in Postmaster Tools; Yahoo computes it from mail that was delivered to the inbox, so your own complaint figures may not match theirs exactly.
- Standard messages. Messages must follow RFC 5322 (the message format), and Yahoo also names RFC 5321 (the SMTP conversation).
- TLS for the connection, at Gmail. Google added this requirement in December 2023. For mail coming in to your own domain, MTA-STS asks other senders to use TLS too.
- No impersonation of gmail.com in the From: header.
Extra requirements for bulk senders
| Requirement | Gmail | Yahoo |
|---|---|---|
| Authentication | SPF and DKIM | SPF and DKIM |
| DMARC | A published policy; p=none is enough | A policy of at least p=none, and DMARC must pass |
| Alignment | From: domain matches the SPF or the DKIM domain | The same; relaxed alignment is accepted |
| Unsubscribe | One-click for marketing and subscribed mail, plus a visible link in the body | One-click header, a visible link in the body, honored within 2 days |
| Spam rate | Below 0.3% (recommended: below 0.1%) | Below 0.3% |
Authentication and alignment
DMARC passes when SPF or DKIM passes and the domain it authenticated matches the domain in the visible From: header. If your newsletter platform signs with its own domain and uses its own bounce domain, both checks can pass while neither aligns with your From: domain, and the bulk requirement is still not met. The fix is to let the platform sign with a DKIM key on your domain, or to use a return-path (bounce) domain under your own domain.
Google asks for DKIM keys of at least 1024 bits for mail to personal Gmail accounts and recommends 2048 bits where your system supports it (DKIM selectors and key rotation). Yahoo also asks for 1024 bits or more and recommends that anyone who forwards mail adds ARC headers (RFC 8617). Google's FAQ notes that alignment is not required for forwarded and mailing-list mail.
Check what you publish with the SPF checker, the DKIM checker and the DMARC checker. If you have no DMARC record yet, the DMARC generator writes a p=none record with a reporting address (rua). Both providers accept p=none, and Yahoo strongly recommends the reporting address: the reports show which of your services send mail as your domain before you tighten the policy (how to read DMARC aggregate reports).
One-click unsubscribe
RFC 8058 defines one-click unsubscribe with two headers:
List-Unsubscribe: <https://example.com/unsubscribe?u=…>
List-Unsubscribe-Post: List-Unsubscribe=One-ClickWhen a user clicks unsubscribe in the mail app, the mailbox provider sends an HTTPS POST to that address, and your server must remove the person without asking them to log in or confirm anything. The RFC requires both headers to be covered by a valid DKIM signature.
The providers differ in the details. Google's FAQ says a mailto: address or a link to a landing page does not meet its requirement, and that transactional messages such as password resets are exempt. Yahoo highly recommends the POST method but also accepts mailto: (one-click unsubscribe, step by step). Both want a clearly visible unsubscribe link in the body as well; it may lead to a preference page. Yahoo asks you to honor an unsubscribe within 2 days; Google recommends doing it within 48 hours.
Spam rate
The spam rate is the share of delivered messages that users mark as spam. Google calculates it daily, recommends staying below 0.1% and asks senders never to reach 0.3%. According to its FAQ, since June 2024 a bulk sender above 0.3% cannot get mitigation help from Gmail, and it needs seven days in a row below 0.3% to qualify again.
You can watch your rate in Google's Postmaster Tools. At Yahoo, sign your mail with DKIM and enroll in its Complaint Feedback Loop, which sends you a copy of each complaint so you can remove the person. Complaints usually come from people who no longer expect your mail, so the practical levers are consent, a frequency people signed up for, and an easy way out.
How enforcement works
Both providers began in February 2024 and describe enforcement as gradual. Gmail's FAQ says that from November 2025 it is ramping up enforcement on non-compliant traffic, and that a message which misses a requirement may be rejected, temporarily or permanently, or delivered to the spam folder. New domains, which Google defines as domains that have not sent more than 5,000 messages a day to personal Gmail accounts since 1 January 2024, are on a faster timetable. Google's FAQ also lists failures, such as a high spam rate, a missing DMARC policy or missing one-click unsubscribe, that cost you Gmail's delivery support and mitigation.
The bounce code tells you which requirement failed. Common ones from Gmail:
- 550 5.7.26: the message was not authenticated, or DMARC failed.
- 550 5.7.27 and 550 5.7.30: SPF or DKIM failed for a bulk sender.
- 5.7.32: the From: domain is not aligned with SPF or DKIM.
- 550 5.7.40: a bulk sender without a DMARC policy.
- 550 5.7.29: no TLS.
- 421 4.7.28: Gmail is rate limiting your mail.
Where list quality comes in
Neither provider publishes a bounce-rate limit, but both describe consent and list care as part of the rules. Google asks senders to email only people who want the mail, to confirm each address before subscribing it, and to avoid pre-checked opt-in boxes. Yahoo asks senders to remove invalid recipients promptly, to monitor hard and soft bounces, and recommends double opt-in. Mailing addresses that no longer exist also wastes the reputation you build with authentication, and old lists are where recycled spam traps hide.
Verifying a list before a large send removes the addresses that would hard-bounce today; see how to clean an email list.
Questions
Do these rules apply if I send fewer than 5,000 messages a day?
Yes, the baseline does: SPF or DKIM, valid forward and reverse DNS, TLS at Gmail, standard message format and a spam rate below 0.3%. The bulk rules add DMARC, alignment and one-click unsubscribe. Meeting them anyway costs little and protects you if your volume grows.
Is p=none really enough?
For these requirements, yes: both providers accept a DMARC policy of p=none. It tells receivers to take no action on failing mail and to send you reports. A stricter policy (quarantine or reject) adds protection against people forging your domain, and it is what BIMI needs before a logo shows, but move to it only once the reports show that all your legitimate mail passes (moving DMARC from p=none to p=reject).
Do transactional emails need one-click unsubscribe?
Not at Gmail: its FAQ limits the requirement to marketing and promotional messages, and names password resets and reservation confirmations as exempt. Yahoo applies it to marketing and subscribed messages (transactional vs marketing email).
Do Outlook.com and Hotmail have the same rules?
Similar, but not identical. Microsoft announced its own requirements for high-volume senders in 2025; see Outlook sender requirements.
Try it
Check your domain's records with the DNS tools, look up a bounce in the bounce code dictionary, and clean your list with bulk email verification before your next campaign.
Related
- Glossary: SPF, DKIM and DMARC and sender reputation.
- The valid status: why complaints hurt.
Related guides
- Outlook.com requirements for high-volume senders
- Email warm-up for new IPs and domains
- Reduce your email bounce rate
- Spam traps explained
- Double opt-in (confirmed opt-in)
- All guides
Sources
- Google: Email sender guidelines.
- Google: Email sender guidelines FAQ: bulk sender definition, enforcement, spam rate and unsubscribe details.
- Yahoo: Sender best practices.
- RFC 8058, Signaling One-Click Functionality for List Email Headers.
- RFC 8617, The Authenticated Received Chain (ARC) Protocol.
How we wrote this: drafted by the email-validation.org team with the help of AI writing tools, from our product documentation and the sources linked in the text.