Gmail and Yahoo Bulk Sender Requirements, Explained Side by Side

Gmail and Yahoo require bulk senders to authenticate with SPF and DKIM, publish a DMARC record (p=none is enough), align the From domain with SPF or DKIM, support one-click unsubscribe on marketing mail, honour unsubscribes within two days, and keep the user-reported spam rate below 0.3%. Google adds a 0.1% target and a concrete volume threshold.

Most summaries of these rules were written in late 2023 and repeat each other. We went back to the two primary sources on 1 October 2026, Google's Email sender guidelines with its FAQ, and Yahoo's Sender Requirements with its FAQ, and lined them up. The differences matter more than the overlap.

The requirements side by side

Both providers split their rules into "all senders" and "bulk senders". This table covers the bulk tier, which includes everything in the lower tier.

Requirement	Gmail	Yahoo
Who counts as bulk	Close to 5,000+ messages a day to personal Gmail accounts	"A significant volume of mail". No number given
SPF and DKIM	Both required	Both required
DMARC	Record required; p=none is acceptable	"Valid DMARC policy with at least p=none", and DMARC must pass
Alignment	From domain aligned with SPF or DKIM domain	Same; relaxed alignment acceptable
One-click unsubscribe	Required for marketing and subscribed mail, via RFC 8058 headers	Required; RFC 8058 POST "highly recommended", mailto "acceptable"
Unsubscribe deadline	48 hours (FAQ)	2 days
Visible unsubscribe link in body	Required	Required (may go to a preference page)
Spam rate	Below 0.3%; aim for below 0.1%	Below 0.3%
Forward and reverse DNS (PTR)	Required	Required
TLS	Required	Not listed as a requirement
Message format	RFC 5322	RFCs 5321 and 5322

If you only fix one thing, fix DMARC alignment. It is the requirement most often missing on accounts that send through a third-party platform without a custom sending domain. You can check SPF, DKIM and DMARC for any domain with our deliverability audit.

How Gmail counts to 5,000

Google's threshold is per primary domain, not per subdomain or per IP. The FAQ gives the example directly: 2,500 messages a day from solarmora.com plus 2,500 from promotions.solarmora.com makes you a bulk sender, because both roll up to solarmora.com.

Three details in the FAQ are easy to miss:

• It is permanent. "Senders who meet the above criteria at least once are permanently considered bulk senders." A single big send is enough, and sending less afterwards does not reset it.
• It only counts personal Gmail. Mail to Google Workspace accounts is not counted, and the requirements and enforcement "apply only when sending email to personal Gmail accounts."
• New domains get less patience. Google defines a new domain as one that hasn't sent more than 5,000 a day to personal Gmail since 1 January 2024, and says enforcement on new domains runs "on an accelerated timetable."

Yahoo does not count this way. Its FAQ says a sender is viewed "at the authenticated domain or From header domain level", but that it "will use all of the information available (content, IP, etc.) to review sender compliance." Spoofed mail using your domain also counts towards what Yahoo looks at, which is a reason to move DMARC beyond p=none eventually (see moving DMARC from p=none to p=reject).

The 0.3% line, and the 0.1% one

The spam rate is the requirement people misread most often, because the numbers sound tiny and the denominator is not what they assume.

Both providers measure complaints against mail that reached the inbox. Yahoo says so on its requirements page: the spam rate "is calculated in our system based on mail delivered to the inbox". Google's Postmaster Tools documentation defines it as the percentage of messages delivered to the inbox and then marked as spam. Mail that went straight to the spam folder is not in the denominator.

A worked example makes the scale clear. Suppose 20,000 of your messages land in Gmail inboxes on a given day:

Spam rate	Complaints from 20,000 inboxed messages	What Google says about it
0.05%	10	Healthy
0.10%	20	Google's target ceiling; above this already "has a negative impact on email inbox delivery for bulk senders"
0.30%	60	The line not to reach

Sixty clicks on "Report spam" out of twenty thousand. That is why the rate is driven far more by who is on your list than by your copy.

Google's FAQ adds the consequence: since June 2024, bulk senders above 0.3% are ineligible for mitigation (Google's term for delivery support when you ask for help), and become eligible again "when their spam rates remain below 0.3% for 7 consecutive days." Spam rate is calculated daily.

There is a trap in the denominator. If Gmail is already sending most of your mail to spam, very few people see it in the inbox, so very few report it, and your measured spam rate can look excellent. A low rate alongside falling opens and replies is a warning, not a reassurance. We go through that pattern in reading Google Postmaster Tools.

One-click unsubscribe: where Gmail and Yahoo disagree

Both require it for marketing and subscribed messages, and both exclude transactional mail such as password resets and order confirmations. They differ on what counts.

• Gmail requires the two RFC 8058 headers, List-Unsubscribe with an HTTPS URL and List-Unsubscribe-Post: List-Unsubscribe=One-Click. Its FAQ is explicit that "mailto and URL unsubscribe links, don't meet our one-click unsubscribe requirement," and that Gmail does not look in the message body for one.
• Yahoo requires "a functioning list-unsubscribe header" that supports one-click, calls the RFC 8058 POST method "highly recommended", and calls the mailto method "acceptable".

So a mailto-only header can satisfy Yahoo and fail Gmail. Since you are sending to both, implement RFC 8058. The exact headers, the POST request Gmail sends and the mistakes that break it are in our guide to implementing one-click unsubscribe.

On timing, Google recommends processing requests within 48 hours and lists "Unsubscribe requests aren't honored within 48 hours" in its enforcement table. Yahoo's FAQ says if an unsubscribe "is not honored in 2 days, then it would not meet the requirement."

What enforcement actually looks like

Enforcement has escalated in stages rather than arriving on one date.

When	What changed	Source
February 2024	Gmail and Yahoo requirements take effect, enforced gradually	Google guidelines; Yahoo FAQ
June 2024	Yahoo begins enforcing one-click unsubscribe; Gmail bulk senders above 0.3% lose mitigation eligibility	Yahoo FAQ; Google FAQ
November 2025	Gmail "ramping up its enforcement on non-compliant traffic", including "temporary and permanent rejections"	Google FAQ

Google's enforcement table splits the requirements into two groups. Missing authentication, misalignment, missing PTR records, no TLS and malformed messages lead to "Temporary or Permanent Failure codes, or spam foldering." A spam rate over 0.3%, a missing DMARC record, missing one-click unsubscribe and slow unsubscribes lead to "Delivery support or mitigations unavailable."

When Gmail rejects or defers for these reasons, the SMTP response tells you which rule you broke. These are the codes Google lists:

Code	Meaning (paraphrased from Google's FAQ)
4.7.23 / 5.7.25	Sending IP has no PTR record, or the PTR does not resolve back to the IP
4.7.27 / 5.7.27	SPF did not pass
4.7.29 / 5.7.29	Not sent over TLS
4.7.30 / 5.7.30	DKIM did not pass
4.7.31	No DMARC record, or no policy in it
4.7.32	From domain not aligned with the SPF or DKIM domain
5.7.26	Unauthenticated message, referenced in the main guidelines

The 4.x.x codes are temporary: Gmail is rate limiting you and expects a retry. The 5.x.x codes are permanent rejections. If your platform only shows "bounced", ask it for the full SMTP response, because the code is the diagnosis.

Yahoo says non-compliant mail "may be sent to the spam folder or rejected" and that rejections come with a specific error code, documented on its error codes page.

A checklist you can work through today

1. SPF passes for the domain your platform uses in the envelope sender. Watch for the 10-lookup limit.
2. DKIM signs with your own domain, not only the platform's. Use a 1024-bit key at minimum; both providers recommend 2048.
3. DMARC record published at _dmarc.yourdomain.com with at least p=none and a rua address so you can read reports. Our DMARC checker shows what is live.
4. Alignment: the From domain matches the DKIM d= domain (or the SPF domain) at the organisational level.
5. RFC 8058 headers on every marketing message, with an endpoint that processes the POST within 48 hours.
6. Visible unsubscribe link in the body as well.
7. Spam rate monitored in Google Postmaster Tools and Yahoo's Complaint Feedback Loop. Treat 0.1% as your ceiling, not 0.3%.
8. PTR and TLS confirmed with your sending platform. If you use a mainstream ESP this is usually already done.
9. List quality: remove addresses that hard bounce, and verify lists you did not collect yourself before the first send. Bounces are not one of the named requirements, but sending to dead addresses is one of the quickest ways to look like the kind of sender these rules were written for.

The practical takeaway

The two providers agree on almost everything that matters: authenticate with both SPF and DKIM, publish DMARC, align your From domain, give people a one-click way out and honour it within two days, and keep complaints far below 0.3%. Where they differ, build to the stricter one. That means Gmail's RFC 8058 headers rather than Yahoo's acceptable mailto, and Gmail's 0.1% target rather than the 0.3% ceiling both of them publish.