Gmail, Yahoo and Outlook bulk sender requirements, explained
What Google, Yahoo and Microsoft require from senders of around 5,000 messages a day: authentication, one-click unsubscribe and low spam rates.
By the OutreachPro team at DanixSoft8 min read
Google and Yahoo announced requirements for bulk senders in October 2023 and began enforcing them in February 2024. Microsoft announced similar rules for Outlook.com, Hotmail and Live addresses in April 2025, effective from May 2025. The rules apply to mail sent to those providers’ consumer mailboxes, and they are the closest thing email has to a published standard for what a legitimate sender looks like.
Who counts as a bulk sender
Google’s threshold is sending close to 5,000 or more messages to personal Gmail accounts in a single day, counted across everything sent from your primary domain. Once a domain has crossed it, Google treats it as a bulk sender permanently. Microsoft uses the same figure of more than 5,000 messages a day to its consumer domains. Yahoo publishes its requirements without a fixed number.
Most small senders will never cross that line. The requirements below are still worth meeting, because the ones marked “everyone” apply at any volume, and the rest describe what receivers look for when deciding whether mail is wanted.
What every sender needs
- SPF or DKIM authentication for the sending domain.
- Valid forward and reverse DNS for the sending servers.
- TLS when delivering the message.
- A spam complaint rate below 0.3%, as reported in Google Postmaster Tools. Google advises staying below 0.1%.
- Messages formatted to the email standard (RFC 5322), and no impersonation of Gmail in the From header.
If you send from a Google Workspace or Microsoft 365 mailbox, the provider’s own servers handle DNS and TLS for you. Authentication and complaint rate are yours to manage.
What bulk senders additionally need
- Both SPF and DKIM, not one or the other.
- A DMARC record for the sending domain. A policy of p=none is enough to meet the requirement.
- Alignment: the From domain must match the domain authenticated by SPF or DKIM. DMARC alignment explains what that means in practice.
- For marketing and subscribed mail, one-click unsubscribe using the List-Unsubscribe and List-Unsubscribe-Post headers (RFC 8058), plus a clearly visible unsubscribe link in the message body.
- Unsubscribe requests honoured within two days.
Microsoft’s rules for high-volume senders cover the authentication part: SPF, DKIM and DMARC (at least p=none) aligned with SPF or DKIM. Microsoft said non-compliant mail would first be routed to Junk, with rejection to follow later.
What the rules do not say
Meeting every requirement does not guarantee the inbox. The rules are a floor: they remove reasons to filter you, but the receiver still decides based on how its users react to your mail. That is why the complaint rate matters as much as the DNS records, and why no honest tool can promise an inbox placement rate.
The simplest way to keep complaints low is to send only to people who asked to hear from you. What counts as consent covers what that means and how to keep a record of it.
How OutreachPro handles the parts it controls
- Every message carries List-Unsubscribe and List-Unsubscribe-Post headers, plus a visible unsubscribe link.
- An unsubscribe suppresses the address across the whole account immediately, well inside the two-day window, and later imports cannot add it back.
- Mail is sent from your own mailbox, so SPF, DKIM and DMARC are the records you publish for your own domain. The domain health checker shows whether they are in place.