In February 2024 Gmail and Yahoo started enforcing new bulk sender requirements, and Microsoft followed for Outlook.com in May 2025. Senders who ignore them see mail rejected or sent to spam. Even small businesses should follow the basic rules, because they apply partly to everyone who sends to these mailbox providers.
Before you start
- Access to your domain's DNS.
- A list of every system that sends mail as your domain, including newsletter and CRM tools.
Who counts as a bulk sender
Gmail and Microsoft define bulk senders as those sending about 5,000 or more messages a day to their users. Once you cross that line once, you are treated as a bulk sender permanently. Yahoo does not publish a fixed number. The baseline rules for all senders still apply below that volume.
Requirements for all senders
- SPF or DKIM authentication for your domain.
- Valid forward and reverse DNS (PTR) for sending IPs.
- TLS for transmitting email.
- Spam complaint rate below 0.3% in Google Postmaster Tools, ideally under 0.1%.
- Messages formatted according to RFC 5322, with no impersonation of Gmail From addresses.
Extra requirements for bulk senders
| Requirement | What it means |
|---|---|
| SPF and DKIM | Both must pass, not just one |
| DMARC | A DMARC record with at least p=none |
| Alignment | The From domain must align with the SPF or DKIM domain |
| One-click unsubscribe | List-Unsubscribe and List-Unsubscribe-Post headers (RFC 8058) on marketing mail |
| Honour unsubscribes | Process requests within 2 days |
| Visible unsubscribe link | A clear link in the message body |
How to check you comply
- Check SPF, DKIM and DMARC records for each sending domain, see SPF, DKIM and DMARC explained.
- Send a test to a Gmail address and open Show original: SPF, DKIM and DMARC should show PASS.
- Register the domain in Google Postmaster Tools and watch the spam rate and compliance status dashboard.
- Confirm your newsletter tool adds one-click unsubscribe headers and signs with DKIM using your own domain, not just its own.
Tip: Use a subdomain such as news.example.com for marketing mail. Its reputation stays separate from your main domain's everyday mail.
Troubleshooting
- 550 5.7.26 rejection from Gmail: the message failed authentication or DMARC. Check alignment between the From domain and the DKIM signature.
- Mail in spam despite passing checks: complaint rate or content. Clean your list and reduce sending to inactive recipients.
- Transactional mail affected: password resets and receipts do not need unsubscribe links but still need authentication.
Frequently asked questions
Do these rules apply to normal business email?
The baseline rules do. The bulk-only rules matter when you send newsletters or high volumes.
Is p=none enough for DMARC?
Yes for the current requirements, but moving to quarantine or reject gives real spoofing protection.
Should I send newsletters from my hosting server?
For larger lists, a dedicated email service provider is better: it handles unsubscribe headers, bounces and complaint feedback loops.