Compliance
The Gmail and Yahoo bulk sender requirements: what 5,000 emails a day now costs you
4 February 2026 · 9 min read
In February 2024 Google and Yahoo began enforcing a shared set of requirements for anyone sending more than 5,000 messages a day to their users. Two years on, the rules are no longer a deadline to prepare for — they are the baseline every sending domain is measured against, and enforcement has quietly tightened from bulk folder placement to outright rejection.
The requirements are short. The operational work behind them is not. This article breaks each requirement into what a marketing team actually has to publish, measure and monitor.
The three non-negotiable requirements
Google's Email sender guidelines and Yahoo's Sender Best Practices describe the same three obligations, using almost identical language. Any one of them missing is enough to have mail filtered.
- Authenticate with SPF and DKIM, and publish a DMARC record for the sending domain — even a policy of p=none satisfies the minimum.
- Keep the user-reported spam rate below 0.10% in Google Postmaster Tools, and never let it reach 0.30%.
- Offer one-click unsubscribe in commercial mail, and process every request within two days.
The spam-rate thresholds, read precisely
The two published numbers do different jobs. 0.10% is the target you operate against; 0.30% is the level at which filtering becomes severe and recovery slow. On a 50,000-recipient send the gap between them is startlingly small.
| Recipients | 0.10% target | 0.30% hard threshold |
|---|---|---|
| 5,000 | 5 complaints | 15 complaints |
| 25,000 | 25 complaints | 75 complaints |
| 50,000 | 50 complaints | 150 complaints |
| 100,000 | 100 complaints | 300 complaints |
One-click unsubscribe is a header, not a link
The requirement refers to RFC 8058: a List-Unsubscribe-Post header carrying List-Unsubscribe=One-Click, alongside a List-Unsubscribe header containing an HTTPS URL. The mailbox provider posts to that URL directly, so the recipient never loads a preference page and never sees a confirmation step.
A visible unsubscribe link in the footer is still required, but it does not satisfy the header requirement on its own. Both must be present, and the two-day processing window applies to both.
Aligned authentication, not merely present authentication
DMARC evaluates alignment: the domain in the visible From address must match the domain that SPF or DKIM validated. A message can pass SPF for a provider's bounce domain and still fail DMARC, because the aligned identifier never matched. This is the single most common cause of an authenticated-looking message being filtered.
In practice this means sending from your own verified domain, with DKIM signing keys published under it, rather than from a shared provider address.
What to monitor every week
- Google Postmaster Tools spam rate, read as a seven-day trend rather than a single day.
- DMARC aggregate reports, for messages failing alignment from sources you did not expect.
- Hard bounce rate per send; anything above 2% suggests a list-quality problem upstream.
- Unsubscribe rate per campaign, which usually rises before complaints do.
Key takeaways
- Above 5,000 messages a day to Gmail or Yahoo, SPF, DKIM and DMARC are mandatory, not optional.
- Operate below a 0.10% complaint rate; 0.30% is the point at which filtering becomes severe.
- One-click unsubscribe means RFC 8058 headers, processed within two days — a footer link alone is not compliant.
- Alignment is what DMARC tests. Send from your own verified domain.
Sources
Put this into practice with HTsend
Everything in this guide is built into the platform: authenticate a sending domain, clean your list before you send, and watch inbox placement in real time.
