Gmail bulk sender requirements: the full checklist

The requirements at Gmail, Yahoo and Outlook.com#

A typical failure: a newsletter that reached Gmail for a year starts bouncing, because your email app signs it with its own domain instead of yours and your domain has since crossed Gmail’s bulk line. Gmail has two tiers: rules for every sender, and extra rules once you send close to 5,000 messages a day to personal Gmail accounts. Yahoo has the same two tiers but no number. Outlook.com has one set, for domains sending over 5,000 a day.

Below that line, your part is to publish the DNS records your email provider gives you, add a DMARC record (v=DMARC1; p=none is enough) and email only people who asked. Meeting the rules keeps mail from being rejected or filtered for breaking one. It does not decide Primary or Promotions: Gmail sorts tabs by sender and content, as the Promotions tab guide explains.

Sources: Google’s sender guidelines and FAQ,^[1][2] Yahoo’s Sender Hub,^[3][4] and Microsoft’s announcement and error page.^[5][6] “Not specified” means the requirements page does not list it, not that it is safe to skip. Microsoft’s announcement also recommends a From or Reply-To address that can receive replies, regular removal of invalid addresses, and a gradual move from p=none to p=reject.^[5]

The terms, in one line each:

• SPF: a DNS record listing the servers allowed to send for your domain. DKIM: a signature on each message that receivers check against a key in your DNS.
• DMARC: a DNS record that says what to do with mail that has no aligned SPF or DKIM pass, and where to send reports. Aligned: the domain SPF or DKIM vouched for matches the domain in the From: line.
• PTR (reverse DNS) maps the sending server’s IP address to a hostname, which must resolve back to the same address. TLS here means the sending server encrypts the connection when it delivers, with STARTTLS; MTA-STS is a separate standard for mail you receive. RFC 5322 is the standard layout of a message.

Which rows are yours, and which are your provider’s#

If you send through an email provider, the rows split the same way almost everywhere. The provider runs the servers and gives you DNS values; you publish them, decide what is marketing and own the spam rate. The last column is Rasket, as its docs and feature pages state it.

With any other provider, three questions to send their support team:

• Do you sign my mail with my own domain (DKIM with d= set to my domain)?
• Is the bounce address, the return path, on my domain?
• Does my marketing mail get Gmail’s one-click unsubscribe (the List-Unsubscribe-Post header)?

Who counts as a bulk sender#

Google’s own example: 2,500 messages a day from solarmora.com and 2,500 from promotions.solarmora.com make a bulk sender, because both count toward the primary domain.^[2] A subdomain separates the data, which is what a marketing subdomain is for, but not the volume. Only personal addresses count: the rules “don’t apply to messages sent to Google Workspace accounts.”^[2] A Workspace address can be on any company domain, so a B2B sender counts only the @gmail.com and @googlemail.com recipients and leaves the rest out.

Google gives no figure for “close to”. Our advice, not Google’s: once any day reaches about 4,000 messages to Gmail addresses, meet the bulk rules. To count, take every system that sends as your domain (the store platform, the email app, the help desk), because Gmail counts by domain, not by tool. Then add up the @gmail.com and @googlemail.com recipients on your busiest day.

A worked example: a store has 12,000 customers and 4,000 use Gmail. One campaign to everyone stays under the line. Send it on a sale day with 1,100 order and shipping emails to Gmail addresses, and the domain has sent 5,100: it is a bulk sender from then on.

Yahoo looks at the sender “at the authenticated domain or From header domain level”, and a bulk sender is one “sending a significant volume of mail. We will not specify a volume threshold.” Spoofed mail counts too: asked whether it counts toward the bulk threshold, Yahoo answers “Yes, those emails will count towards the mail we look at for enforcement.” The rules cover every domain Yahoo Mail hosts, AOL included.^[4] Microsoft counts 5,000 or more messages to its consumer services with “the same domain in the 5322.From address”,^[6] meaning outlook.com, hotmail.com and live.com addresses.^[5]

What each requirement means in practice#

SPF, DKIM and alignment#

Alignment is checked on the organizational domain, the name you registered, so mail.example.com aligns with example.com under relaxed alignment, the default; a record with adkim=s or aspf=s demands the exact name. Only SPF or DKIM has to align today, but Google says “It’s likely that DMARC alignment with both SPF and DKIM will eventually be a sender requirement.”^[2] This is the row that fails when a provider signs with its own domain instead of yours; the mechanics are in DKIM, SPF and DMARC explained.

Gmail “requires a DKIM key of 1024 bits or longer” and recommends 2048.^[1] The standard agrees: RFC 8301 says signers “MUST use RSA keys of at least 1024 bits for all keys” and “SHOULD use RSA keys of at least 2048 bits”, tightening RFC 6376, which set 1024 bits for long-lived keys only.^[12][13]

DMARC: p=none meets the rule#

Gmail says the policy “can be set to none”, Yahoo asks for “at least p=none”, and Microsoft gives v=DMARC1; p=none as its example.^[1][3][6] The standard itself is RFC 9989, published in May 2026 to replace RFC 7489, and p=none is still a valid policy under it. Two changes touch this page: the pct tag is gone, and receivers find the organizational domain by walking up the DNS tree instead of reading the Public Suffix List.^[14] What p=none does and does not protect, and how to move past it, is in moving DMARC from p=none to p=reject.

One-click unsubscribe, honoured within 48 hours#

“Marketing messages and subscribed messages must support one-click unsubscribe, and include a clearly visible unsubscribe link in the message body.”^[1] One-click means two headers from RFC 8058, with one HTTPS URL; a mailto: or body link alone does not meet Google’s rule, and the body link may go to a preferences page.^[2]

List-Unsubscribe: <https://example.com/unsubscribe/7f3a9c>, <mailto:unsubscribe@example.com>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

RFC 8058 adds three rules that break real setups: a DKIM signature must cover both headers, the POST carries no cookies or login, and your endpoint “MUST NOT return an HTTPS redirect”.^[16] Google asks for unsubscribes to take effect within 48 hours, Yahoo within 2 days.^[2][3] Building the endpoint is in how to set up one-click unsubscribe.

Spam rate: 0.3% is the rule, 0.1% the target#

Gmail measures the rate against mail delivered to the inbox, as Postmaster Tools shows it, requires every sender to stay below 0.3% and asks for below 0.1%.^[17][1] Counting only inbox mail makes the number harsher: 10 reports on 10,000 sent is 0.1%, but if 4,000 of them went to spam, the same 10 reports on 6,000 delivered is 0.17%. Postmaster Tools shows the rate for DKIM-authenticated mail only, and may leave out days when your volume is low. Between the two lines there is no cliff; Google calls the impact “graduated”, and says rates “greater than 0.1% have a negative impact on email inbox delivery for bulk senders.” Above 0.3%, a bulk sender also loses mitigation (Google looking into a delivery problem you report through its sender contact form) until the rate stays under it for 7 consecutive days.^[2] Bringing it down is in the spam complaint rate guide.

Forwarders and mailing lists: Google no longer lists ARC#

If you forward mail or run a list that resends it, the rules changed quietly. In mid-2024 Google’s guidelines told “a forwarding service, including mailing lists or inbound gateways” to “add ARC headers to outgoing email” and lists to add a List-id: header,^[7] and its FAQ said “we require that these types of messages have ARC headers”.^[8] The pages we read on 17 October 2026 mention neither. The FAQ now says only that “DMARC alignment isn’t required for forwarded or mailing list messages”,^[2] and the guidelines link to a forwarding page that asks you to change the envelope sender to your forwarding domain, leave the body and the DKIM-signed headers (Subject, To, Cc, Date, Message-ID) untouched, and add an X-Forwarded-For: or X-Forwarded-To: header.^[9] ARC (RFC 8617) is the set of headers a forwarder adds to record the checks it saw.^[15] Our advice: if you already add ARC and List-id:, keep them; Google withdrew the request without saying ARC stopped mattering.

Receipts, onboarding and other product email#

Every requirement applies to transactional mail except one-click unsubscribe. Google: “One-click unsubscribe is required only for marketing and promotional messages. Transactional messages are excluded from this requirement.” Its examples are password resets, reservation confirmations and form submission confirmations.^[2] Yahoo names order confirmations and password resets.^[4]

Google does not draw the line for you: “Message recipients, not Google, determine the nature of the messages they receive.”^[2] A useful test is whether the email would still go to someone who opted out of marketing. Here is how that test sorts the usual product mail.

Complaints about any of them count against the whole domain, so keep promotions out of receipts, as transactional vs marketing email explains. The law sorts the same mail its own way, with the same answer for these rows; it is in the marketing email guide, along with when an upgrade line flips a tip to marketing.

How to check where you stand in ten minutes#

Send a real message from your production setup to a Gmail address you control and check that SPF, DKIM and DMARC pass and the DKIM line names your domain, not your provider’s (reading the headers in Gmail). Then look at the records themselves. The first two lines work for any provider; the last two use the return-path name and DKIM selector Rasket’s domain docs list,^[10] and another provider will give you its own:

# Exactly one line should start with v=spf1; two is a permanent error
dig +short TXT example.com | grep spf1
dig +short TXT _dmarc.example.com

# If you send through Rasket: SPF is checked at the return path, then the DKIM key
dig +short TXT rasket.example.com
dig +short TXT rasket._domainkey.example.com

For the full picture at Gmail, add your domain to Postmaster Tools and open Compliance status. It is open to every sender and can take up to 7 days to reflect a fix. It reports primary domains only: add news.example.com and you see the status of all of example.com, built from every subdomain’s mail. “No data found” on a row means too little mail to judge, not a pass.^[17] Setup is in the Google Postmaster Tools guide. Outside Gmail, Yahoo’s Complaint Feedback Loop sends you a copy of each spam report on DKIM-signed mail,^[3] and Microsoft’s SNDS shows complaint data per sending IP, which on a shared IP is your provider’s number.^[26]

The first two weeks after you cross 5,000#

• Day one: confirm a DMARC record exists, and open Show original on your latest campaign to see List-Unsubscribe-Post: List-Unsubscribe=One-Click.
• If the domain never reached 5,000 before, Google calls it new: one that “hasn’t sent more than 5,000 emails a day to personal Gmail accounts since January 1, 2024”, enforced “on an accelerated timetable”.^[2] Fix failures the day you see them.
• Read the spam rate in Postmaster Tools every day, and Compliance status again on day seven.
• Our rule, not Google’s: send the first campaign only to people who clicked or bought in the last 30 days, the second to the last 90 days, the third to the last 180 days. Move to the next group only if Postmaster Tools showed under 0.1% on the days after each send; otherwise repeat the last group that did. If it shows no data for a small send, count the spam reports your provider passes on instead, and wait a few days rather than one. More on pacing is in warming up a new domain.

Enforcement dates, and what failing looks like#

Sources: Google’s announcement and FAQ,^[18][2] the FAQ as archived in May 2024,^[8] and Yahoo’s requirements page and FAQ.^[3][4] Google’s November 2025 notice is about “Messages that fail to meet the email sender requirements”, not only bulk mail, and its error text for unauthenticated mail says “Gmail requires all senders to authenticate”.^[2][19] A small sender failing an every-sender rule can be rejected too.

Microsoft’s pages do not agree on when failing mail is rejected. Its postmaster announcement says non-compliant messages will be sent to “the junk folder. Shortly we will reject the messages until the DNS records are corrected.”^[20] Its Policies page also says junk folder first, and rejection “If issues remain unresolved”.^[21] Its blog, updated in April 2025, says Microsoft decided “to reject messages that don’t pass the required authentication requirements” from 5 May 2025.^[5] Plan for rejection, which reads:

550 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level.

For developers: Gmail’s codes and Rasket’s headers#

Most Gmail requirements have a temporary code (with a 421 or 451 reply) and a permanent one (usually with 550, though Google lists 5.7.32 with 421, so a bounce classifier should read the 4.x.x or 5.x.x code; your mail server still retries any 4xx reply). Google pairs 4.7.23 with 5.7.25; the rest share a number.^[19] Most temporary codes are the same failure as their permanent twin and will not clear on retry. Two can: 4.7.28 is a rate limit, and one 4.7.26 text says “temporary DNS failures prevent authentication”, which a later retry can get past.^[19]

None of these says anything about the recipient, so a bounce handler should not suppress the address on them. Rasket’s handler does not make that distinction: any permanent bounce, these codes included, adds a suppression row. After fixing DNS, lift those rows as in recovering from a wave of bad bounces, which removes them 100 addresses per call with POST /suppressions/batch/remove.^[25] 5.7.26 also appears when your own DMARC policy tells Gmail to reject a message, or when SPF ends in -all and fails.^[19] The DMARC row lists three codes because Google’s FAQ still gives 4.7.31^[2] while the SMTP reference gives 4.7.40 and 5.7.40; we cannot tell you which Gmail sends more often. Yahoo publishes reply classes rather than one code per rule: a 421 or 451 may be retried later, a 553 or 554 should not be.^[22]