Quick bulk sender rules reference
In February 2024 Google and Yahoo introduced synchronized bulk sender rules for anyone sending 5,000+ messages/day to their users. Microsoft Outlook aligned in May 2025. As of 2026, three of the four major mailbox providers enforce essentially the same requirements, making compliance a de-facto standard for bulk senders.
| Threshold | 5,000+ messages/day per DKIM d= domain to Gmail, Yahoo, or Microsoft addresses. |
| Effective dates | Google + Yahoo: February 2024. Microsoft Outlook: May 2025. All still enforced in 2026. |
| Requirements | SPF + DKIM + DMARC aligned, one-click List-Unsubscribe (RFC 8058), spam rate below 0.30% (Postmaster Tools), TLS enabled. |
| Penalties | Non-compliant mail is throttled, deferred, or routed to spam. Persistent violations trigger domain-level blocks. |
| Standards | RFC 5321 (SMTP), RFC 6376 (DKIM), RFC 7489 (DMARC), RFC 8058 (one-click unsubscribe). |
What are the bulk sender rules?
In October 2023, Google and Yahoo jointly announced new sender requirements effective February 2024. The goal: reduce spam and phishing in the inbox by enforcing basic authentication hygiene on any bulk sender. Microsoft joined with equivalent rules effective May 2025 for Outlook.com and Hotmail addresses.
The rules apply to any sender that delivers 5,000 or more messages in any 24-hour window to one of these providers, aggregated by DKIM d= domain (not by IP or by From-header address). Once you cross the threshold, you must meet all requirements or accept degraded inbox placement.
The 5 requirements in detail
1. Authenticate with SPF and DKIM
Every message must pass either SPF or DKIM (both preferred). SPF authorizes the sending IP for your domain; DKIM cryptographically signs the message. Missing both means the message fails authentication and gets rejected.
- Publish an SPF record at the apex of your sending domain. See SPF record explained.
- Enable DKIM signing with 2048-bit RSA (or Ed25519) keys. The
d=tag must match your From-header domain (or a parent domain, in relaxed alignment). See DKIM record explained.
2. Publish a DMARC policy
A DMARC policy must be published at _dmarc.yourdomain.com. Minimum policy is v=DMARC1; p=none, which is monitoring-only and does not enforce anything, but Google and Yahoo require at least this level to be present. Enforcement (p=quarantine or p=reject) is not required by the rules but is best practice. See DMARC record explained.
3. Align From-header domain with DKIM or SPF
DMARC alignment means the From-header domain must match (or be a parent of) either the DKIM d= tag or the SPF envelope sender. Otherwise DMARC fails and the message is treated as unauthenticated. Fix: enable branded or authenticated sending domain in your ESP so DKIM signs with your domain, not the ESP’s.
4. Implement one-click List-Unsubscribe (RFC 8058)
Marketing and promotional mail must include both:
List-Unsubscribeheader withmailto:and/orhttps://URLs.List-Unsubscribe-Post: List-Unsubscribe=One-Clickheader per RFC 8058.
The recipient must be able to unsubscribe with a single HTTP POST from the mail client, without visiting a landing page or entering credentials. Gmail, Yahoo, and Outlook show a native unsubscribe button in the UI that triggers this. Response must succeed within 2 business days.
5. Keep spam rate below 0.30%
Google Postmaster Tools reports spam rate as a rolling percentage. Above 0.30% and Gmail throttles your domain. Yahoo and Microsoft apply similar thresholds without public dashboards. Target well below 0.10% to have headroom.
Microsoft Outlook alignment (May 2025)
Microsoft joined the Google/Yahoo standard in May 2025 with a nearly identical rule set for Outlook.com and Hotmail addresses. Slight differences:
| Requirement | Yahoo | Microsoft (May 2025) | |
|---|---|---|---|
| SPF + DKIM | Both required | Both required | Both required |
| DMARC policy | p=none minimum | p=none minimum | p=none minimum |
| Alignment | Required | Required | Required |
| One-click unsubscribe | Required (RFC 8058) | Required (RFC 8058) | Required (RFC 8058) |
| Spam rate threshold | Below 0.30% (Postmaster Tools) | Below 0.30% (CFL data) | Below 0.30% (SNDS data) |
| TLS | Required for connections | Required for connections | Required for connections |
| Enforcement | February 2024 | February 2024 | May 2025 |
In practice, this means one compliance posture works across the three major providers. If you are compliant for Google, you are essentially compliant for Yahoo and Microsoft.
One-click unsubscribe implementation
The one-click List-Unsubscribe header is the piece most senders get wrong. Correct implementation:
List-Unsubscribe: <https://example.com/unsub?u=abc123&t=xyz>, <mailto:unsubscribe@example.com?subject=unsub>
List-Unsubscribe-Post: List-Unsubscribe=One-Click
Requirements:
- Both headers must be present.
- The HTTPS URL must accept a POST request with body
List-Unsubscribe=One-Click. - No login page, no confirmation click, no CAPTCHA. Just accept the POST and unsubscribe the recipient.
- Response must complete unsubscription within 2 business days.
- The URL should be idempotent and safe to POST multiple times.
The most common failure: the unsubscribe URL redirects to a login-required page or a preference center that requires the recipient to authenticate. This defeats one-click and violates the rule. The POST endpoint must unsubscribe without any authentication.
ARC signatures for mailing lists
Mailing lists that modify subject lines (e.g. adding [list-name]) or inject footers break DKIM signatures because they alter what was signed. Recipients see DMARC fail even though the message was legitimate.
The fix is Authenticated Received Chain (ARC, RFC 8617). The mailing list adds an ARC set of headers that vouches for the original authentication before modification. Downstream receivers can trust the ARC chain and treat the message as authenticated.
Google, Yahoo, and Microsoft all honor ARC in 2026. If you run a mailing list or forwarder, implement ARC signing on outbound. If your mail is being forwarded through a list that does not sign ARC, your DMARC alignment breaks for those recipients and you must accept some placement loss.
Compliance checklist
Before sending your first 5,000+/day batch, verify:
- SPF record published at apex, includes sending IP or ESP mechanism.
- DKIM 2048-bit key published at
selector._domainkey.yourdomain.com, signing withd=yourdomain.com. - DMARC policy published at
_dmarc.yourdomain.com, at leastp=none. - DMARC aggregate reports going to a monitoring address (rua= tag). Review weekly.
- List-Unsubscribe header on all marketing/promotional mail, with one-click POST endpoint.
- Unsubscribe endpoint completes within 2 business days without login.
- Google Postmaster Tools enrolled and spam rate monitored (target below 0.10%).
- Microsoft SNDS enrolled if you use dedicated IPs.
- Yahoo CFL subscribed if you send significant Yahoo volume.
- TLS enabled for all outbound connections. TLS 1.2 minimum, 1.3 preferred.
Common violations and their consequences
- DKIM signed with ESP’s domain (d=esp.com instead of d=example.com). DMARC fails alignment. Mail may still be delivered but reputation is attributed to the ESP, not to you. Fix: enable branded sending domain.
- One-click unsubscribe requires login. Violates RFC 8058. Gmail may downgrade placement. Fix: unsubscribe endpoint must accept POST without authentication.
- Spam rate above 0.30% for a week. Gmail throttles your domain. Fix: pause sending, purge inactive recipients, resume at lower volume.
- DMARC not published. Automatic non-compliance. Fix: publish
v=DMARC1; p=noneat minimum. - Postmaster Tools not enrolled. You are compliant but blind. Fix: enroll and check weekly.
- Mailing list breaks DKIM without ARC. Downstream receivers reject on DMARC. Fix: implement ARC signing.
- Sending marketing without List-Unsubscribe header. Auto-throttled by Google. Fix: add both headers.
Google Yahoo Microsoft bulk sender rules FAQ
What counts as 5,000 messages per day?
Any 24-hour rolling window, aggregated by DKIM d= domain, across Gmail (or Yahoo, or Microsoft) recipient addresses. Sending 4,999 to Gmail and 4,999 to Yahoo does not count as 9,998; each provider counts its own volume independently.
Do the rules apply below 5,000/day?
The formal enforcement kicks in at 5,000/day, but Google and Yahoo apply similar signals to lower-volume senders for spam filtering. Compliance is best practice at any volume.
Is p=none enough for DMARC?
Yes for compliance. p=none is monitoring-only and does not instruct receivers to act on failures. Best practice is to graduate to p=quarantine (spam folder for failures) or p=reject (bounce) once you are confident authentication is solid. Move slowly with pct= to ramp enforcement.
Do the rules apply to transactional email?
SPF, DKIM, DMARC, TLS, and spam rate apply to all mail. One-click unsubscribe is required for marketing and promotional mail, not for pure transactional (receipts, password resets, notifications). Mixed streams (order confirmation with a marketing footer) should include the header to be safe.
What is a Feedback-ID header and do I need it?
Feedback-ID (RFC 6449) is an optional header that lets Google Postmaster Tools attribute spam complaints to specific campaigns. Not required for compliance, but valuable for diagnosing what content triggers complaints. Format: Feedback-ID: campaign_id:list_id:esp_id:custom.
How do I test one-click unsubscribe?
Send a test to a Gmail address you control. Open in Gmail web. Click the unsubscribe link Gmail shows in the header (a native button, not the one in your email body). Verify your endpoint receives POST with body List-Unsubscribe=One-Click and unsubscribes the recipient.
What does Microsoft’s SNDS show?
Similar to Google Postmaster Tools: complaint rate, filter placement, and trap hits for IPs you own. Requires dedicated IP ownership verification. Register at sendersupport.olc.protection.outlook.com.
Do I need to move to p=reject to comply?
No. The rules require p=none minimum. Moving to p=reject is best practice and stops most spoofing, but it can cause legitimate mail to bounce if any of your sending sources are not signing with DKIM. Ramp to enforcement with pct= (start at pct=10) and monitor DMARC reports.
Final words
The February 2024 Google/Yahoo rules, extended by Microsoft in May 2025, unified three of the four major mailbox providers under one compliance standard. If you send bulk mail in 2026, you meet all five requirements (SPF, DKIM, DMARC, one-click unsubscribe, low spam rate) or you accept degraded placement.
Two years into enforcement, the industry has adapted. ESPs pre-configure authentication, one-click unsubscribe is a standard feature, and Postmaster Tools enrollment is universal. The senders who still get filtered are the ones who mixed transactional and marketing on the same domain, kept lists too long, or ignored the compliance dashboards for months.
Compliance is not optional. It is the baseline for bulk mail delivery in 2026 and forward.
Keep spam rate below 0.30% with a clean list.
SMTPing catches disposables, role addresses, catch-alls, syntax errors, dead mailboxes and known spam traps before they hit your Postmaster Tools spam rate. 13 validation types, 25 free checks daily, no card required.
About the Author
Alaa · LinkedIn
Email infrastructure specialist with 8+ years of hands-on experience in SMTP, deliverability, and email verification. I’ve configured and troubleshot mail systems across Postfix, Exchange, and cloud relays, managed IP reputation and warmup campaigns, and built verification pipelines processing millions of addresses. My work spans DNS authentication (SPF, DKIM, DMARC, BIMI), bounce handling, blocklist monitoring, and compliance frameworks including CAN-SPAM and GDPR. I write every article on SMTPedia to give email professionals, developers, and marketers the accurate, RFC-grounded reference they need.
About SMTPedia
SMTPedia is an independent email industry reference covering SMTP, IMAP, POP3, email deliverability, marketing platforms, DNS authentication, and email verification. Every article is researched from official provider documentation, IETF RFCs, and industry best practices. Settings and configurations are verified quarterly.
We are cited as a source by ChatGPT, Microsoft Copilot, and thousands of email professionals worldwide. Learn more about our editorial process.
