If your domain sends more than roughly 5,000 messages a day to Gmail accounts, the mailbox providers treat you differently.
Since February 2024, "best practice" became a requirement. Gmail and Yahoo now enforce authentication, one-click unsubscribe and a spam-complaint ceiling. Microsoft followed in 2025. If you miss them, your mail gets throttled, routed to spam, or rejected — often without a clear error.
This guide gives you the real thresholds, a clean checklist, and a self-audit you can run in a few minutes.
Who Counts as a Bulk Sender?
The definition is the first thing to get right, because it decides which rules apply to you.
- Google treats you as a bulk sender when you send about 5,000 or more messages per day to personal Gmail accounts, counted across your whole domain within a 24-hour period — not per IP, and not per sending tool.
- Yahoo deliberately does not publish a fixed volume threshold. It classifies a sender as bulk based on "a significant volume of mail," and applies its rules that way.
Two details catch people out:
- The count is to Gmail specifically. A domain sending 4,000 to Gmail and 20,000 elsewhere is below Google's line for now.
- Once you cross the threshold, the stricter requirements stay in force even on a quieter day. Providers do not relax them because you had a slow week.
If you are anywhere near 5,000 a day, the safe move is to treat yourself as a bulk sender and meet every requirement now, rather than wait for the first bounce to tell you that you qualified.
The Requirements, Side by Side
Not every rule applies to every sender. Here is what changes at the bulk threshold.
| Requirement |
All senders |
Bulk senders |
| SPF |
SPF or DKIM |
SPF and DKIM |
| DKIM |
SPF or DKIM |
SPF and DKIM |
| DMARC |
Recommended |
Required (min. policy p=none) |
| From alignment |
— |
Aligned with SPF or DKIM domain |
| Valid forward + reverse DNS (PTR) |
Yes |
Yes |
| TLS connection for sending |
Yes |
Yes |
| Keep spam complaint rate below 0.3% |
Yes |
Yes (stay under 0.1%) |
| One-click unsubscribe (marketing mail) |
Recommended |
Required |
| Honour unsubscribe within 2 days |
Yes |
Yes |
| RFC 5322 message format |
Yes |
Yes |
The core message: everyone needs SPF or DKIM plus a healthy spam rate. Bulk senders additionally need both SPF and DKIM, a published and aligned DMARC record, and working one-click unsubscribe.
For the mechanics behind these records — SPF mechanisms, DKIM selectors and key rotation, DMARC alignment — see our full guide to every email authentication method explained.
The Numbers That Actually Matter
The Spam Complaint Rate: 0.1% vs 0.3%
This is the ceiling most teams trip over, because Google gives you two numbers.
- Target: below 0.1% — about one spam complaint per 1,000 delivered messages.
- Ceiling: never reach 0.3% — about three complaints per 1,000 delivered.
Cross 0.3% and you become ineligible for delivery support, and your mail is more likely to be throttled or spam-foldered. You become eligible again once your rate stays below 0.3% for seven consecutive days. Yahoo uses the same 0.3% ceiling.
The important point: authentication will not save a list people keep reporting. This is a relevance and consent problem, and it is the requirement most likely to creep up on you over time. Track it with a spam complaint rate calculator.
One-Click Unsubscribe: RFC 8058
For bulk senders, a visible unsubscribe link in the footer is not enough. The requirement is a one-click unsubscribe implemented with two message headers:
List-Unsubscribe — an HTTPS link (or a mailto) the reader can act on.List-Unsubscribe-Post — a header that lets the mailbox provider complete the request with a single POST, no landing page and no confirmation.
A common error is adding a List-Unsubscribe header without a publicly resolvable HTTPS URL or without the Post header. If the provider cannot perform the request, it does not count. Honouring the request within two days is also required. We dig into the specifics in our guide to RFC 8058 and the one-click unsubscribe header.
DMARC Alignment
Bulk senders must publish a DMARC record with at least p=none and the domain in the From header must align with either the SPF domain or the DKIM domain.
Relaxed alignment is acceptable, but alignment must exist. Missing DMARC — or a DMARC record that does not align — is a common cause of Gmail's throttling errors even when SPF and DKIM both pass. See our guide to DMARC alignment for the details.
The Enforcement Timeline
The rules did not arrive all at once. Here is what happened and when.
| Date |
What changed |
| Feb 1, 2024 |
Gmail and Yahoo bulk sender requirements take effect; enforcement begins. |
| June 2024 |
One-click unsubscribe (RFC 8058) enforcement begins for bulk senders. |
| May 5, 2025 |
Microsoft requires authentication for senders delivering over 5,000 messages a day to Outlook, Hotmail and Live. |
By 2026, the big mailbox providers (Gmail, Yahoo, Outlook) all enforce baseline authentication. If you have been treating these as "best practices to get to eventually," the time to act is now — before peak season, not during it.
How to Run a Compliance Self-Audit
You can check most of this in a few minutes. Work through each step.
1. Confirm Your Domain Is Authenticated
Check that your sending domain has:
- An SPF record that includes every sender for that domain.
- A DKIM signature with a key of at least 1024 bits (2048 recommended).
- A DMARC record with a published policy, aligned to your SPF or DKIM domain.
An email authentication health check tells you in one pass which of these are missing. If DMARC is absent, generate the right record with our DMARC record generator.
2. Look Up Your Spam Complaint Rate
Pull your user-reported spam rate from Google Postmaster Tools, or from your ESP's deliverability dashboard.
- Below 0.1%: healthy.
- 0.1% to 0.3%: danger zone; find the source of the complaints.
- Above 0.3%: fix list quality before you send more.
A spam complaint rate calculator converts complaints into the rate and shows your position against the threshold.
3. Verify One-Click Unsubscribe on Marketing Mail
Send yourself a test marketing email, or inspect your raw message headers. Confirm both List-Unsubscribe and List-Unsubscribe-Post are present, the link resolves over HTTPS, and your automation actually removes the subscriber within two days.
4. Check Sender Reputation and Inbox Placement
Reputation is the thing authentication does not fix. Use a sender reputation checker and a deliverability calculator to see where your mail is landing and whether your sending IPs or domains are flagged.
5. Fix the Most Common Failures
If you fail an audit, the usual suspects are:
- Missing one-click unsubscribe headers, or a
List-Unsubscribe URL that does not resolve.
- A stale or unengaged list pushing your spam complaint rate toward 0.3%.
- DMARC alignment failing because the From domain does not match SPF or DKIM.
- No PTR / reverse DNS record on the sending IP.
- SPF that omits a third-party sending tool, so some legit mail fails.
For a broader rundown of what lands mail in spam, see why your emails are going to spam and the deliverability metrics explained guide.
What Happens If You Don't Comply
The consequences are not abstract. Expect one or more of the following:
- Throttling — your sending rate is reduced, so campaigns are delayed.
- Spam foldering — mail is delivered to the Junk folder instead of the inbox.
- Rejection — retry failures with Gmail error codes, including
4.7.27 (SPF did not pass), 4.7.30 (DKIM did not pass) and 4.7.31 (no valid DMARC policy).
- Loss of delivery support — above 0.3% spam rate, providers may withhold mitigation.
A single compliant domain with a clean list avoids all of it. The cost of non-compliance compounds with every send, and it is hardest to undo during high-volume periods. That is why our Black Friday deliverability checklist prioritises authentication and list hygiene ahead of the seasonal ramp.
Keep It Compliant Over Time
Compliance is not a one-time setup. It needs monitoring, because lists age and sending patterns change.
- Check your spam complaint rate weekly, especially after a list cleanup or a big campaign.
- Audit authentication quarterly, and re-verify after any domain or ESP change.
- Re-permission or remove subscribers who stop engaging, because an inactive list is the fastest route to a high complaint rate.
- Keep unsubscribe easy. A friction-free unsubscribe lowers complaints and protects your sending reputation — a win on both counts. See our guide to one-click unsubscribe.
The pattern is the same across all of the 2026 email marketing laws and rules: a clean, consented list, properly authenticated, is the foundation of deliverability.
Key Takeaways
- A bulk sender is roughly 5,000+ messages a day to Gmail; Yahoo uses no fixed number.
- Bulk senders need SPF and DKIM, a published and aligned DMARC record, and one-click unsubscribe.
- Keep your spam complaint rate under 0.1% and never let it reach 0.3%.
- The rules took effect in February 2024, one-click enforcement in June 2024, and Microsoft joined in May 2025.
- The most common failure is not authentication but list quality — a stale list that people keep reporting.
- Audit your authentication, spam rate, unsubscribe headers and reputation before peak volume, not during it.
Related Articles
Related tools: Check your domain with the email authentication health check, generate a record with the DMARC record generator, and monitor the thresholds with the spam complaint rate calculator.
