In 2024 Google and Yahoo began enforcing a set of requirements for anyone who sends email to their users, with stricter rules for those who send in volume. Microsoft later announced similar expectations for high-volume senders to its consumer mail services. The exact wording and dates have been updated by each company, and several details have changed since the first announcements, so always read the providers' own pages. What has stayed constant is the direction: authenticate your domain, make unsubscribing easy and keep complaints low. This guide explains in plain language what the requirements are for everyone and for bulk senders, what counts as a bulk sender, how to check whether you comply, the steps to fix the common gaps, what the spam rate thresholds mean and how to monitor your standing. It is not a promise of inbox placement, because meeting the requirements is the minimum, not the whole of good delivery.
Who counts as a bulk sender?
Google defines a bulk sender as a sender that sends close to 5,000 or more messages in a day to personal Gmail addresses. Once you have reached that level, Google continues to treat you as a bulk sender, even if your volume later drops. The count includes all mail from the same primary domain, whether it comes from one system or several. Yahoo uses similar language about large volumes. Microsoft has described a threshold for its consumer services too. Because definitions and thresholds can change, check each provider's current documentation. Many senders who think they are small are in fact over the line once all systems are added together: marketing platform, transactional mail, help desk and billing.
Requirements for all senders
- Authentication. Set up SPF or DKIM for your sending domain, and in practice both. See authenticating your sending domain.
- Valid DNS. Sending IP addresses should have forward and reverse DNS records that match.
- Encryption. Use a TLS connection for transmitting email. See email SSL, TLS and STARTTLS.
- Low spam rate. Keep the user-reported spam rate low. Google states a target of under 0.10 percent and says it should never reach 0.30 percent.
- Proper message format. Messages should follow the internet message format standard, and the from header should not impersonate Gmail addresses.
Additional requirements for bulk senders
- SPF and DKIM both, aligned with the domain in the visible From address as DMARC requires.
- A DMARC policy. Publish a DMARC record for your sending domain. A policy of none is the minimum accepted; moving to stricter policies is better for protecting your brand. See DMARC record syntax, alignment and moving to reject.
- Easy unsubscription for marketing and subscribed mail. Include the List-Unsubscribe and List-Unsubscribe-Post headers for one-click unsubscribe, plus a visible link in the message body. Honour requests within two days. See one-click unsubscribe.
- Domain alignment for your From address. Use a domain you control, not a free mailbox domain.
| Requirement | All senders | Bulk senders |
|---|---|---|
| SPF or DKIM | Yes | Both, aligned |
| DMARC record | Recommended | Required |
| One-click unsubscribe | No | Required for marketing and subscribed mail |
| TLS | Yes | Yes |
| Reverse DNS | Yes | Yes |
| Spam rate | Keep low | Keep under the published thresholds |
How to check whether you comply
- List every system that sends mail as your domain: marketing, transactional, support, billing, calendar, website forms.
- Check your DNS records with the free SPF, DKIM and DMARC checker.
- Send a test to a Gmail address and use "Show original" to see the SPF, DKIM and DMARC results. See how to read email headers.
- Check unsubscribe headers in the same view.
- Register the domain in Google Postmaster Tools to see spam rate, authentication and delivery errors. See Google Postmaster Tools setup.
- Review bounce text for rejections that mention authentication or policy.
How to fix common gaps
| Gap | Fix |
|---|---|
| No DMARC record | Publish a record with a monitoring policy and an address for aggregate reports, then tighten over time |
| DKIM signs with the platform's domain, not yours | Complete the custom domain setup in your sending platform and publish the DKIM records from your dashboard |
| SPF passes but does not align | Use a return-path domain that matches your From domain, or rely on aligned DKIM |
| Several SPF records | Combine into one record; see SPF record explained |
| Too many SPF lookups | Remove unused services; see the 10 lookup limit |
| No one-click unsubscribe headers | Enable them in your platform or add the headers in your message code |
| Marketing and transactional share one stream | Separate them; see separating the streams |
If several vendors send for your domain, see managing multiple vendors on one domain. For MigoSMTP, copy the SPF include and DKIM records from your dashboard domain settings; do not guess values.
Understanding the spam rate
The spam rate is the share of messages delivered to inboxes that recipients marked as spam. Providers measure it among active users, so small absolute numbers can look different from your own complaint counts. To keep it low: send only to people who asked, set honest expectations at sign-up, make unsubscribing easier than reporting spam, send at a rhythm people accept, segment so that content is relevant and remove people who never engage. See email list cleaning and email reputation.
A practical rollout plan
If you discover gaps, fix them in this order, because each step makes the next one easier. First, make sure every sending system signs with DKIM using your own domain, since that single step solves most alignment problems. Second, publish a DMARC record with a monitoring policy and an address that receives aggregate reports, and read the reports for a few weeks to find sources you forgot. Third, add the missing systems to your authentication and remove the ones you no longer use. Fourth, turn on one-click unsubscribe in your marketing tools and confirm that requests are processed within the time the providers expect. Fifth, review your complaint data in Postmaster Tools and fix the segments that generate it. Only after those steps should you consider tightening your DMARC policy to quarantine or reject.
Document who owns each step. Compliance fails most often not because the work is hard but because nobody is responsible for it after a marketing tool or a vendor changes. A short owner list and a quarterly check are enough for most teams.
Do the rules apply to transactional mail?
The authentication, encryption and complaint expectations apply to every message you send, including receipts and password resets. The one-click unsubscribe requirement targets marketing and subscribed mail, so genuine transactional messages are generally not expected to carry it. A password reset with an unsubscribe link would be odd, and a newsletter without one would not be acceptable. If a message mixes both purposes, treat it as marketing. Keeping the two streams on separate subdomains makes the distinction easier to defend and protects critical mail from campaign problems.
What these rules do not do
Compliance does not guarantee the inbox. Content, engagement and your history still matter, and providers may filter mail that meets every technical requirement. Treat the requirements as the floor and keep improving: relevant content, a clean list and steady sending. Rules also change, so schedule a review of the providers' documentation each quarter.
Check your authentication in a minute Run the free checker on your sending domain, then fix gaps using the records in your dashboard.
References and further reading
Frequently asked questions
Who is a bulk sender for Gmail?
Google treats a sender that sends close to 5,000 or more messages a day to personal Gmail addresses as a bulk sender, counting all mail from the same primary domain. Check Google's current documentation.
What do Gmail and Yahoo require from all senders?
Authentication with SPF or DKIM, valid forward and reverse DNS, TLS, correct message format and a low spam rate.
What extra is required of bulk senders?
Both SPF and DKIM aligned with the From domain, a DMARC record, one-click unsubscribe for marketing mail and honouring unsubscribes promptly.
What spam rate should I stay under?
Google states a target under 0.10 percent and says it should never reach 0.30 percent. Monitor it in Google Postmaster Tools.
Does meeting the requirements guarantee inbox placement?
No. They are the minimum. Content, engagement and reputation still affect delivery.