Deliverability guide

Gmail and Yahoo bulk sender requirements

Who they apply to

The commonly cited trigger is 5,000 messages a day to addresses at one of these providers, counted per sending domain. Two things about that number are worth internalising.

It is a daily figure, not a monthly average — one launch announcement can cross it. And once you have crossed it, the provider treats you as a bulk sender going forward rather than only on the days you exceed it.

Both providers also set a floor for every sender regardless of volume — but it is a lower floor than the one above: authenticate with SPF or DKIM, keep valid forward and reverse DNS, use TLS, and stay under the same spam-rate ceiling. The DMARC record and the alignment requirement are what the bulk threshold adds. The practical reading is still to build to the full set from the start, because retrofitting it under pressure during a deliverability incident is the worst time to learn DMARC.

1. Authenticate, with alignment

SPF and DKIM both, plus a DMARC record on your sending domain — and the message must pass DMARC, which means at least one of the two has to be aligned with the domain in the From header. Valid but unaligned authentication does not satisfy this.

A p=none DMARC policy is sufficient to meet the requirement. Alignment is what most senders are missing, and the SPF/DKIM/DMARC guide covers why. Verifying your domain here publishes DKIM keys under your own domain, which is what makes the mail aligned.

2. One-click unsubscribe

Bulk mail needs both RFC 8058 headers, and the unsubscribe must be honoured within two days. A visible unsubscribe link in the body is expected as well — the header is in addition to it, not instead of it.

Sending with bulk: true generates both headers, hosts the endpoint and enforces the result immediately rather than within two days. The mechanics, including why the endpoint refuses to act on a GET, are in the one-click unsubscribe guide.

3. Stay under the spam complaint rate

The published threshold is 0.3%, with 0.1% named as the level to stay below in practice. This is the requirement that is hardest to fix reactively, because it is measured by the recipient's provider using data you cannot see.

Two consequences follow. Complaints are lagging — by the time a rate is visible, the mail that caused it went out days ago. And the rate is a ratio, so the fastest way to breach it is a small send to a stale list rather than a large send to an engaged one.

Sending through this platform, complaints arrive as feedback-loop events, suppress the address automatically, and are graded per account. If your rate degrades you are emailed on the transition rather than after the fact, and sending is cut off before it can damage the shared sending identity. That protects you from other senders as much as it protects them from you.

The rest of the list

Less discussed, equally enforced. Use a valid forward and reverse DNS record for the sending IP. Format messages per RFC 5322 and do not forge Gmail or Yahoo From headers — impersonating the provider you are sending to is treated exactly as it sounds. Use TLS for transmission. Keep the From domain consistent so recipients and filters can build a reputation for it.

On this platform the IP, rDNS and TLS points are properties of the sending infrastructure and are already satisfied. Header forging is rejected at the API — address parsing fails closed rather than letting a display name smuggle a different address past the ownership check.

What to do this week

Publish a p=none DMARC record with a reporting address, and read the reports for a month. That single step tells you whether you currently meet requirement one, and it is the only one of these you cannot answer from your own logs.

Then separate your bulk mail from your transactional mail at the call site, so the unsubscribe rules apply to the former without ever touching the latter. That separation is what the bulk flag exists for, and getting it right is what keeps a newsletter opt-out from silently blocking a password reset.

Requirements change and both providers update their published guidance. Treat the figures above as the current shape of the rules and check Google's and Yahoo's own sender documentation before making a compliance decision on them.