Gmail and Yahoo bulk sender requirements: the 2024 rules

What changed, and when

Both providers announced in late 2023 and began enforcing in February 2024. Google’s own guidelines set one date later than the rest: the one-click unsubscribe header became a requirement for bulk senders from 1 June 2024, a few months after the authentication and complaint-rate requirements. Everything else has been in force since February 2024, and both providers maintain the list on their own sender pages, which are the primary sources for this page.

None of the individual requirements was new. SPF has been specified since 2014 in RFC 7208, DKIM since 2011 in RFC 6376, DMARC since 2015 in RFC 7489, and the one-click unsubscribe header since 2017 in RFC 8058. What changed was the consequence. Before February 2024 an unauthenticated message from a small sender was filtered on the balance of other evidence; since then it is refused outright, and Gmail returns a 5.7.26 error saying so.

The second change is subtler and has done more work. By publishing a numeric complaint threshold, both providers turned a reputation system nobody could see into one number a sender can look up. That number is not on your sending dashboard and never will be — your provider is not told it — but it is free on each mailbox operator’s own postmaster dashboard to whoever proves they control the domain.

Who counts as a bulk sender

Google defines a bulk sender as one sending close to 5,000 messages or more in a single day to personal Gmail accounts from the same domain, and its guidelines state that once a domain has done that it is treated as a bulk sender from then on. Three details in that sentence do most of the work. It is counted per domain, so splitting a send across subdomains is not a way under the line. It counts personal Gmail accounts, not mail to organisations using Google Workspace. And it is a day’s volume, not a month’s, so one launch puts you over permanently.

The authentication floor is separate and applies to everyone at any volume. Publishing SPF and DKIM for the domain you send from is not a bulk requirement; unauthenticated mail is refused whether you send five messages or fifty thousand. This is the part most often misread, because the announcements were written around the word bulk and the hardest consequence in them applies to the smallest sender.

So the practical reading for somebody running a course to a few hundred people is that the whole list applies. You will cross the bulk line on a good month, the threshold is permanent once crossed, and none of the work is anything you would want to do reactively — a DNS record published in a hurry during an incident is how a sending domain ends up misconfigured for a year.

The requirements, and how to check each one yourself

Each of these is verifiable from outside, with a DNS lookup or by reading the raw source of a message you sent to yourself, and that is the reason to go through them one at a time rather than trusting a settings page that says “verified”. A sending tool reporting a domain as verified is reporting that it can send as the domain, which is not the same claim as any of the rows below.

The one that catches people out is alignment. Mail can pass SPF and pass DKIM and still fail DMARC, because both passes were on your provider’s domain while the From line the reader sees is yours. That is the default state with a good many sending services until the domain setup is finished, and it looks identical to success everywhere except in the Authentication-Results header and a DMARC report. The guide on SPF, DKIM and DMARC in this cluster writes the records out; this page is only about which of them the requirements ask for.

What failing looks like from your side, which is mostly nothing

There is exactly one requirement that fails loudly. Unauthenticated mail to Gmail is refused at the door with a 5.7.26 error, which your provider will surface as a bounce, and a bounce is something you can see. Everything else fails quietly.

Failing on alignment, on the unsubscribe header or on the complaint rate does not produce an error, a warning or a notification. The mail is accepted, counted as delivered by your sending tool, and filed into a spam folder. Your delivery rate stays at ninety-nine per cent and your open rate falls slowly enough to be mistaken for seasonality. This is the single most important thing to understand about these rules: compliance is not something you will be told about, in either direction.

Which is why the complaint rate is worth looking at on a schedule rather than when something feels wrong. Watch the trend against your own history, per provider, weekly. A move from 0.02 per cent to 0.08 per cent is a warning even though both figures are inside the threshold, and at small volumes the arithmetic is unforgiving: at a thousand delivered messages, three complaints is already 0.3 per cent, and at two hundred a single complaint is more than that. A small sender has no statistical cushion, only a structural one.

What a small sender should actually do about it

The whole list is an afternoon of work done once, and almost all of it is done in DNS and in a settings page rather than in your writing. The order below is deliberate: the authentication comes first because it is the part that fails loudly, and the structural protections come last because they are the ones that keep the complaint rate where it needs to be without further attention.

In this order, once, and then checked once a year:

• Send from a subdomain reserved for it rather than from the root domain. A burned subdomain is retired and replaced in an afternoon; a burned root domain takes your invoices and password resets with it.
• Publish SPF, set up DKIM signing with your own domain in the signature rather than your provider’s, and publish a DMARC record at p=none with a report address you will actually read.
• Send a message to an address you control and read the Authentication-Results header for all three, particularly dmarc=pass, which is the only one that reports alignment.
• Confirm the one-click unsubscribe header is present and that the endpoint answers a POST with a bare 200 rather than redirecting, because a redirect there silently fails the specification.
• Claim the domain on each provider’s postmaster dashboard, and put a weekly look at the complaint rate somewhere you will see it.
• Require a confirmation click before anything but the confirmation email is sent, and suppress a hard bounce on the first failure. These two are what keep the complaint rate low structurally, rather than by vigilance.

What the rules do not say

Neither provider requires a confirmation step. There is no double opt-in requirement in either document, and anyone telling you Gmail now demands it is describing an implication rather than a rule. The implication is real — complaints come overwhelmingly from people who do not recognise the sender, so a confirmed list sits far below the threshold almost by construction — but the requirement is the threshold, not the mechanism, and the guide in this cluster on choosing between single and double opt-in argues the mechanism on its own merits.

Neither provider publishes a warm-up ramp. Both say, in general terms, to increase volume gradually and watch the signals as you go; the specific schedules quoted around the internet to three decimal places are habits rather than published figures. Nor is there a volume cap, a content rule, a list of forbidden words, or a requirement to use any particular sending service.

And nothing in either document is a legal requirement. These are the terms on which two private companies accept mail, enforced by the only mechanism that matters to a sender, which is whether the mail arrives. The law is a separate floor with separate contents — a working unsubscribe honoured in a stated window, a real postal address, an accurate From line, and for readers in the European Union a consent record you can produce — and the guides on the GDPR, CAN-SPAM and unsubscribe requirements in this cluster cover those. Meeting the provider requirements does not discharge the legal ones, and meeting the legal ones does not get your mail delivered.