Gmail and Yahoo sender requirements, with the real thresholds

Most posts about the Gmail and Yahoo rules repeat the same three bullets: authenticate, offer one-click unsubscribe, keep spam complaints low. The numbers behind them get lost. Is the line 5,000 emails or 5,000 subscribers? Is the spam ceiling 0.1% or 0.3%? Does any of this apply if you send 800 emails a week?

We went back to Google's sender guidelines and FAQ, Google's announcement post, Yahoo's sender best practices and RFC 8058, and wrote down what each one says. Where a document is silent, we say so. If you have not set up your records yet, start with our SPF, DKIM and DMARC setup guide and come back.

Who counts as a bulk sender

Google defines a bulk sender as anyone who sends close to 5,000 messages or more to personal Gmail accounts within a 24-hour period. Three details matter more than the number itself.

What every sender has to do

The baseline applies to everyone who sends to Gmail, whatever the volume. Google asks you to set up SPF or DKIM for your sending domains, use a TLS connection, and make sure sending domains and IPs have valid forward and reverse DNS records (PTR). Messages must follow the Internet Message Format, RFC 5322, including a valid Message-ID header, and you must not impersonate Gmail From headers. Spam rate in Postmaster Tools stays below 0.3%.

Google also says messages that are not authenticated might be marked as spam or rejected. And if you send to personal Gmail accounts, the DKIM key should be 1024 bits or longer.

Yahoo's baseline is very similar: SPF or DKIM at a minimum, valid forward and reverse DNS for sending IPs (Yahoo wants the reverse record to be meaningful and non-generic and to reflect your domain), compliance with RFC 5321 and 5322, and a spam rate under 0.3%. The Yahoo page we read does not mention TLS, so we have not attributed that rule to Yahoo.

What bulk senders add: DMARC and alignment

Above the line you need both SPF and DKIM, and a published DMARC record for the sending domain. A policy of none is accepted by both Google and Yahoo, so you do not have to move to quarantine or reject to comply. Yahoo strongly recommends a rua tag so you receive reports, and says relaxed alignment is acceptable.

Alignment is the part people trip over. Google says the domain in the From header must be aligned with either the SPF domain or the DKIM domain. That means one of the two checks has to pass for the domain people see, not just for a bounce domain or a shared sending domain belonging to your provider. This is why a custom sending domain with its own DKIM key matters, and why you should send from a domain you own rather than a free mailbox address.

One relief: Google states DMARC alignment is not required for forwarded or mailing list messages, which it calls indirect messages. For the full walk through, see the setup guide, and once reports start arriving, how to read a DMARC aggregate report.

One-click unsubscribe, in practice

Bulk senders must support one-click unsubscribe for marketing and subscribed messages, and must also keep a clearly visible unsubscribe link in the body. The header mechanism is defined in RFC 8058. A message needs two headers: List-Unsubscribe containing at least one HTTPS URI, and List-Unsubscribe-Post with the exact value List-Unsubscribe=One-Click. The receiver then sends an HTTPS POST to your URI with that key and value in the body. Both headers must be covered by a valid DKIM signature.

Yahoo describes the Post method as highly recommended and accepts mailto as an alternative. Google says to ask your email provider whether you can add these headers if you use a third party. Our short explainer, one-click unsubscribe and List-Unsubscribe headers explained, covers the details and the common mistakes.

The two day rule

The unsubscribe processing window is two days. Google's announcement says senders must process unsubscription requests within two days, and Yahoo's page says to honour unsubscribes within 2 days. You will sometimes see this written as 48 hours; the primary sources say two days, and the practical advice is the same: do not wait for a weekly batch job. Suppress the address immediately.

Spam rate: 0.10% and 0.30%

Two numbers, two jobs. Google tells bulk senders to keep the spam rate reported in Postmaster Tools below 0.10% and avoid ever reaching 0.30% or higher. Yahoo says to keep it below 0.3%. Treat 0.10% as your working target and 0.30% as the point where help stops.

That last part comes from Google's FAQ: a sender above 0.3% is not eligible for delivery support or mitigation, and becomes eligible again only after keeping the rate below 0.3% for 7 consecutive days. It is measured by Google on mail to its own users, and you read it in Google Postmaster Tools, not in your own platform's report.

What happens when you fail: the error codes

Google began enforcement in February 2024 and, from November 2025, escalated to temporary and permanent rejections of non-compliant traffic, according to its FAQ. Domains that were not already sending 5,000 a day since 1 January 2024 are on an accelerated timetable. When a message is refused, the SMTP response carries a code. The ones the FAQ lists are below.

The pattern is useful: 4.7.x codes are temporary, so the sending server retries and you may see delays. The 5.7.x codes are permanent and the message bounces. The DMARC and alignment codes, 4.7.31 and 4.7.32, have no permanent 5.7.x counterpart in the FAQ list, so check the exact wording in your own bounce log.

Where a small sender still gets judged

If you send 800 emails a week, you are below the bulk line, but you are not exempt. Google's baseline still applies: authentication with SPF or DKIM, TLS, PTR records and a spam rate under 0.3% are all stated for all senders, and unauthenticated mail might be marked as spam or rejected. Yahoo's baseline is the same in spirit.

Two practical consequences. First, DMARC is not formally required below the line, but it is a very cheap thing to publish and it is what you need to see who else is sending as you. Second, the line is permanent once you cross it, and a growing list or a seasonal peak can cross it faster than you plan. Build to the bulk rules from the start. If you are new and just starting out, warming up a new sending domain keeps volume and complaints in a range receivers trust, and the 30-day small business plan shows where this fits in the larger picture.

Transactional mail is not exempt either. Receipts and password resets are still messages from your domain, so the authentication rules apply, even though the unsubscribe rule is aimed at marketing and subscribed messages. We cover the boundary in transactional and marketing email: where the line is.

A readiness check you can run today

Send a test message to a Gmail address you control, open Show original, and check that SPF and DKIM show PASS, DMARC shows PASS, and the unsubscribe headers are present. Then work through the list below. In Mailnaptic the Domains page shows SPF, DKIM and DMARC record status and lets you set the DMARC policy, and the Google Postmaster dashboard (Pro plan) draws the 0.10% and 0.30% markers on the spam rate meter.

Before any campaign, our nine pre-send checks cover the sending side. If a logo in the inbox is on your wishlist, note that BIMI sits on top of enforced DMARC; BIMI for a small sender explains whether it is worth it.