Gmail, Yahoo and Outlook Bulk Sender Requirements: A Compliance Checklist

Gmail, Yahoo and Outlook.com bulk sender requirements are the minimum rules these mailbox providers apply to anyone who sends email in volume. They ask for three things: authenticate your mail with SPF, DKIM and DMARC, make unsubscribing easy with a one-click header, and keep spam complaints low. This guide puts the three sets of rules side by side and gives you a checklist you can work through in about a month.

The short version

1. Authenticate everything. SPF and DKIM on your sending domain, plus a DMARC record. At least one of SPF or DKIM must align with the visible From domain.
2. Make unsubscribing one click. Add List-Unsubscribe and List-Unsubscribe-Post headers to marketing mail and process requests within two days.
3. Keep complaints under 0.10%. Send only to people who asked for your mail and remove anyone who stops engaging.
4. Get the basics right. Matching forward and reverse DNS, TLS in transit and a correctly formatted message.
5. Monitor. Use Google Postmaster Tools and check bounce and complaint rates every week.

Who counts as a bulk sender?

Google treats a sender as a bulk sender when it sends close to 5,000 or more messages in a day to personal Gmail addresses. The count covers every message from your primary domain, including all subdomains and all sending systems, and the classification does not expire once you have crossed the line. Yahoo and Microsoft use similar volume thresholds for their consumer mail services.

Two things are easy to miss. First, the count is per provider, so a large list with a strong Gmail share can cross the threshold sooner than you expect. Second, the basic authentication and spam-rate expectations apply to all senders, not only to bulk senders. If you are growing, build to the bulk standard now.

Requirements side by side

1. Authenticate: SPF, DKIM and DMARC

Authentication proves that a message really comes from your domain. For bulk senders all three layers are expected, and the From domain must align with the domain that passed SPF or DKIM. If you have not set these up yet, follow the step-by-step guide to authenticate a sending domain, then come back to this checklist.

How to verify in one minute

Send a test message to a Gmail address, open the message, choose Show original and look at the summary at the top. You want to see PASS next to SPF, DKIM and DMARC. Repeat the test for an Outlook.com and a Yahoo address, because each provider evaluates alignment on its own.

Authentication-Results: mx.google.com;
  dkim=pass header.i=@mail.example.com;
  spf=pass smtp.mailfrom=bounce.example.com;
  dmarc=pass (p=NONE) header.from=example.com

2. Make unsubscribing easy

For marketing and other subscribed mail, bulk senders must support one-click unsubscribe. That means two message headers, List-Unsubscribe and List-Unsubscribe-Post, plus a visible unsubscribe link in the body. Requests must be honoured within two days, and the safest policy is to apply them immediately. The full header format, an endpoint example and the common mistakes are in the guide to one-click unsubscribe and the List-Unsubscribe header.

• Marketing and subscribed mail: one-click header required.
• Transactional mail: password resets, receipts and security alerts are not required to carry it.
• Mixed messages: if a message is mostly promotional, treat it as marketing.

3. Keep spam complaints low

The spam rate is the share of messages that recipients mark as spam, as reported by the mailbox provider. Google measures it in Postmaster Tools for messages delivered to the inbox. The numbers are small, so a few complaints matter:

A spam rate that reaches 0.30 percent is the point at which Google says it can no longer qualify a sender for mitigation, so treat 0.10 percent as the line to defend.

What lowers complaints

• Consent: send only to people who signed up, preferably with double opt-in.
• Expectation: say at sign-up what you will send and how often, then do exactly that.
• A visible, working unsubscribe: people mark mail as spam when they cannot find the unsubscribe link.
• Sunset policy: stop mailing contacts who have not opened or clicked for several months.
• Segmentation: send relevant mail to the segment that wants it, not to the whole list.
• Warm-up: raise volume gradually with a warm-up plan.

4. The technical basics

5. Monitor and respond

1. Add Google Postmaster Tools. Verify your sending domain, then review the spam rate, authentication and compliance dashboards every week.
2. Watch the numbers inside MigoSMTP. Track hard bounce rate, complaint rate and deferrals by recipient domain in your delivery reports.
3. Join the provider programmes. Register for Microsoft sender support and Yahoo sender tools so you receive complaint data and can ask for help.
4. Set alerts. Alert when complaints pass 0.05 percent or when hard bounces pass 2 percent, so you can react before a provider does.
5. Act on the first sign. Pause the affected stream, find the cause and resume gradually. The bounce code guide explains what the error text means.

Error messages you may see

A 30-day plan to comply

Further reading and sources

• Google: Email sender guidelines
• Google: Email sender guidelines FAQ
• Yahoo: Sender best practices
• Microsoft: Outlook.com postmaster and sender support
• RFC 8058: Signaling One-Click Functionality for List Email Headers
• RFC 7489: DMARC
• Related guides: Authenticate a sending domain, One-click unsubscribe and Email warm-up guide.