Gmail bulk sender requirements, rule by rule

Google announced its bulk sender requirements in October 2023, began enforcing them in February 2024, and gave them real teeth in November 2025, when Gmail started rejecting unauthenticated mail with a 550-5.7.26 error instead of filing it in spam. Most write-ups still describe the 2024 rules. This one goes requirement by requirement with the exact artifact that satisfies each one, then covers the Yahoo rules that shipped in the same announcement and the Microsoft rules that followed in May 2025. It is the compliance half of our email deliverability handbook.

The timeline that got us here

• October 2023: Google and Yahoo jointly announce the requirements (Google's announcement blog post, October 3, 2023).
• February 2024: enforcement begins for senders of 5,000 or more messages a day to Gmail.
• June 2024: one-click unsubscribe becomes required on commercial messages.
• May 5, 2025: Microsoft applies the same authentication trio to Outlook, Hotmail and Live at 5,000 a day (Microsoft Tech Community announcement, April 2025).
• September 30, 2025: Postmaster Tools v1 retires, the domain and IP reputation dashboards disappear, and v2's Compliance Status dashboard becomes the official scorecard.
• November 2025: Gmail moves from deferrals to permanent 550-5.7.26 rejections for unauthenticated mail.

Each step made the same rules harder to ignore. Nothing was relaxed at any point, which tells you the direction of the next step too.

Requirement by requirement, with the artifact

1. SPF

A TXT record on your domain naming the services allowed to send for it. First mention, so the plain definition lives in our glossary: SPF.

yourdomain.com  TXT  "v=spf1 include:spf.yourrelay.com ~all"

Your relay's docs give you the exact include value. Verify with dig TXT yourdomain.com +short, and go deeper in our SPF record guide.

2. DKIM

A cryptographic signature on every message, validated against a public key in DNS. Your provider generates the key pair and gives you the record, typically at a selector:

selector._domainkey.yourdomain.com  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkq..."

Google requires at least a 1,024-bit key and recommends 2,048 (Gmail sender guidelines). Verify by sending to a Gmail address and reading "Show original": you want DKIM: PASS with your domain named. DKIM is also the signature that survives forwarding, which matters in requirement 4.

3. DMARC

One TXT record that tells receivers what to do when SPF and DKIM disagree with the From address:

_dmarc.yourdomain.com  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com"

A policy of p=none fully satisfies the requirement. Treat it as a progression anyway: publish none, read the reports for a few weeks, then move to quarantine and finally reject once the reports are clean. The whole trio is walked through record by record in our SPF, DKIM and DMARC guide, with DMARC defined in the glossary.

4. Alignment

The domain in your visible From header must match the domain that passed SPF or DKIM. This is the requirement that silently breaks when mail is forwarded, and we can quantify that from experience: in June 2026, Gmail rejected 73% of the mail we mirrored through Cloudflare's forwarding while our logs recorded a clean handoff. Forwarding always breaks SPF, because the forwarder re-sends from its own IP, and that alone is survivable: DMARC passes on either aligned check. What killed those messages is that they arrived with no surviving aligned DKIM signature either, so both checks were gone at once. We replaced the forward with an API insert and the rejections stopped. If your architecture forwards mail anywhere, ARC headers help receivers trust the hop, but the real fix is not depending on forwarding for anything you cannot afford to lose.

5. PTR records (reverse DNS)

Your sending IP must resolve to a hostname that resolves back to the same IP. On a shared relay this is the relay's IP and the relay's job. Verify anyway:

dig -x 198.51.100.7 +short

If you run your own MTA, this record is yours to publish with your hosting provider, and mail from an IP without it is dead on arrival.

6. TLS

Messages must be transmitted over TLS. Every serious relay does this by default; confirm in "Show original", where Gmail prints "Standard encryption (TLS)" on the security line.

7. One-click unsubscribe

Commercial messages need RFC 8058 one-click unsubscribe: two headers, honored within two days.

List-Unsubscribe: <https://yourdomain.com/unsub/TOKEN>, <mailto:unsub@yourdomain.com>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

We stamp both on every campaign and honor the request immediately rather than using the allowed two days, because the person you make wait is the person who files a spam report. Details and edge cases in our one-click unsubscribe guide, definition at list-unsubscribe.

8. Spam rate

Stay under 0.1% and never reach 0.3% of delivered mail, measured in Postmaster Tools. At or above 0.3%, Gmail withholds delivery mitigation until you have been under it for 7 consecutive days. The worked math at real list sizes, including why one report can breach the line on a small send, is in our complaint-rate breakdown. The artifact here is a dashboard, not a record: register in Google Postmaster Tools v2, which since September 30, 2025 is the only version and includes a Compliance Status view that grades you on this exact list.

9. Format and identity

Messages must comply with RFC 5322, and the From header must not impersonate Gmail. These two are trivially satisfied by any competent sending stack and violated mainly by people who deserve what happens next.

The "bulk = 5,000" myth

Two corrections to the number everyone quotes. First, the mechanics: the threshold is about 5,000 messages to personal Gmail accounts within 24 hours, counted across your primary domain and its subdomains together, and Google's FAQ states that a sender who crosses it once is classified as a bulk sender permanently. Sending less later does not undo it.

Second, and more useful: the dangerous rules were never volume-gated in practice. Since November 2025, mail without at least SPF or DKIM bounces at any volume. Spam-rate filtering applies to every sender and always has. One-click unsubscribe is how you avoid the complaints that trip requirement 8, whatever your size. We follow the full bulk-sender list while sending dozens of emails a day, and the total cost of doing so is three DNS records and two headers. Waiting until you are big enough to be forced is choosing to warm up your domain during the highest-stakes week of its life.

Yahoo's parallel rules

Yahoo announced on the same day, October 3, 2023, and enforces a similar list (senders.yahooinc.com): SPF and DKIM with DMARC at p=none minimum, unsubscribes honored within two days, and complaints under 0.3%. It is not identical, and the differences matter. Yahoo sets no volume threshold at all, states no TLS requirement, accepts a mailto: unsubscribe where Google insists on RFC 8058 one-click, and publishes only the 0.3% line where Google also names a 0.1% target. One thing Yahoo offers that Google does not: a real feedback loop. Register for Yahoo's CFL and you receive an ARF copy of each complaint, which also covers AOL addresses. Gmail's aggregate-only substitute, the Feedback-ID header, is covered in the complaint-rate article.

Microsoft's May 2025 line

Since May 5, 2025, Microsoft applies SPF, DKIM and DMARC (p=none minimum) to senders of 5,000 or more messages a day to outlook.com, hotmail.com and live.com, and rejects noncompliant mail at SMTP:

550 5.7.515 Access denied, sending domain [yourdomain.com] does not meet
the required authentication level.

That is from Microsoft's April 2025 Tech Community announcement. Register for SNDS and JMRP while you are in that ecosystem; both are free and JMRP mails you each complaint the way Yahoo's CFL does.

Do this week

1. Publish the three records above. p=none is fine for now.
2. Send yourself a message at a Gmail address and confirm three PASS verdicts in "Show original".
3. Add both unsubscribe headers to every commercial send.
4. Register Postmaster Tools v2, Yahoo CFL, and Microsoft SNDS with JMRP.
5. Watch the spam rate against 0.1%, and decide now what happens automatically at 0.3%.

The list reads as bulk-sender compliance. Treat it as the definition of a working email domain, at any volume, because that is what every mailbox provider now assumes it is.