Deliverability: what Gmail and Yahoo require from bulk senders

Who counts as a bulk sender

In its FAQ on the sender guidelines, Google defines bulk senders as senders who send close to 5,000 messages or more within 24 hours to personal Gmail accounts. The count is per primary domain. Google gives the example of 2,500 emails from solarmora.com plus 2,500 from promotions.solarmora.com: together, a bulk sender. Important for stores: according to Google, the status does not expire. Once you have been over the threshold, you remain a bulk sender, even if you send less later.

The threshold is reached faster than many people think. Example calculation with assumptions: a store has 25,000 newsletter recipients, 25% of them with a Gmail address. A single send produces 6,250 emails to Gmail. That makes the store a bulk sender permanently.

On its page for senders, Yahoo does not name a fixed threshold, but sets almost the same requirements for bulk senders as Google.

The requirements at a glance

Gmail's sender guidelines have applied since 1 February 2024; Yahoo has been enforcing its rules step by step since February 2024. The table summarises the obligations for bulk senders:

Requirement	Gmail	Yahoo
Authentication	SPF and DKIM	SPF and DKIM
DMARC	DMARC record, policy p=none is enough	valid policy, at least p=none, DMARC must pass
Alignment	From domain matches the SPF or DKIM domain	From domain matches the SPF or DKIM domain
Unsubscribe	one-click unsubscribe plus visible link in the body	working List-Unsubscribe header, RFC 8058 method recommended, visible link
Processing unsubscribes	within 48 hours	within 2 days
Spam rate	below 0.3%, target below 0.1%	below 0.3%
Technical	valid forward and reverse DNS records, TLS, RFC 5322	valid forward and reverse DNS records, RFC 5321 and 5322

Senders below the threshold must also comply with SPF or DKIM, valid DNS records, TLS and a spam rate below 0.3% at Gmail. For DKIM, Google requires keys of at least 1,024 bits and recommends 2,048 bits.

What alignment means

The domain in your sender address must match the domain that SPF or DKIM confirms. If your email tool sends with its own signing domain, DKIM passes but is not aligned. According to Google, one of the two methods is currently sufficient. Google recommends aligning both and states that full alignment is likely to become mandatory.

Tighten DMARC step by step

p=none meets the requirement but does not protect your domain from abuse. Evaluate the DMARC reports (rua) for a few weeks until all legitimate senders, such as the store system, helpdesk and email tool, pass cleanly. Only then is it worth switching to quarantine and later to reject.

One-click unsubscribe under RFC 8058

One-click unsubscribe is described in RFC 8058. It allows mailbox providers to offer unsubscribing without a confirmation page. Technically, every marketing email needs two headers:

• List-Unsubscribe with an HTTPS address that uniquely identifies the recipient and the list.
• List-Unsubscribe-Post with exactly the value "List-Unsubscribe=One-Click".

When the recipient clicks, their mailbox provider sends a POST request to this address. According to the RFC, the server must not redirect, and both headers must be covered by a valid DKIM signature. Google required one-click unsubscribe from senders with existing unsubscribe links from 1 June 2024 at the latest.

How to check it: send a real campaign to a Gmail test account, open "Show original" and look for both headers. A visible unsubscribe link in the body is still mandatory as well. According to Yahoo, it may lead to a preference centre.

The spam rate: 0.3% is the limit, 0.1% the target

Google measures the spam rate daily as the proportion of emails that recipients themselves mark as spam. According to the FAQ, even a rate above 0.1% worsens delivery. From 0.3%, bulk senders also lose eligibility for mitigation support from Google. They only regain it once the rate has been below 0.3% for seven consecutive days.

An example calculation shows what this means in complaints. With 8,000 delivered Gmail emails per newsletter, 0.1% is just 8 spam reports, and 0.3% is 24. So the margin is narrow. Yahoo points out that it calculates the rate based on emails delivered to the inbox.

Important levers against spam reports are clear consent at sign-up, a clearly visible unsubscribe option and removing recipients who have not responded for months.

Enforcement since 2025

The requirements themselves have not changed since 2024. What has changed is the consequence. In its FAQ, Google writes that from November 2025 Gmail is stepping up enforcement on non-compliant traffic. Emails that do not meet the requirements are temporarily or permanently rejected. Industry observers such as Spam Resource documented this addition on 3 November 2025.

In practice, this shows up as bounces. According to Spam Resource, non-compliant emails are more often deferred (SMTP code 4xx) or rejected (5xx). So check the bounce reports in your email tool after every send and look out for clusters at Gmail addresses. If bounces only rise there, check authentication and spam rate first.

According to Google, an accelerated timeline applies to new domains. A domain counts as new if it has not sent more than 5,000 emails a day since 1 January 2024. So if you set up a new sending domain, you should meet all requirements before the first large send.

Using Google Postmaster Tools

Google Postmaster Tools shows how Gmail rates your emails. According to Google Help, the views include:

• Compliance status: whether your emails meet the sender requirements.
• Spam rate: the proportion of emails marked as spam.
• Authentication: the proportion of emails that pass SPF, DKIM and DMARC.
• Delivery errors: rejected or temporarily refused emails, including reasons.
• Encryption: the proportion of emails transmitted via TLS.

The data is not real-time. According to Google, it is usually updated within 24 hours; for compliance status, changes can take up to seven days. With low volumes, data is missing on some days. Check the values after every larger send.

Practical checklist and common mistakes

• Your own sending domain with SPF and DKIM, DKIM with 2,048 bits.
• DMARC record on the main domain, initially with p=none and a reporting address (rua).
• From domain is aligned with DKIM, ideally also with SPF.
• List-Unsubscribe and List-Unsubscribe-Post in every marketing email, signed via DKIM.
• Visible unsubscribe link, unsubscribes are processed within 48 hours.
• Postmaster Tools set up, spam rate consistently below 0.1%.
• Inactive recipients are removed regularly.

Common mistakes that cost you deliverability:

• Sending with an @gmail.com sender: Google prohibits impersonating Gmail sender addresses. Always use your own domain.
• Only the tool's signature: DKIM passes but is not aligned.
• Too many SPF entries: under RFC 7208, a maximum of 10 DNS lookups is allowed. If you include the store system, helpdesk and email tool, you quickly exceed this, and SPF fails.
• Forgetting subdomains: at Gmail, emails from subdomains count towards the main domain and therefore towards the 5,000 threshold.
• DMARC straight to reject: without evaluating the reports, you may block your own legitimate emails, such as invoices from the store system.

If you would like your setup checked, Minotaurus does this as part of its email support for Shopify stores.

Sources

1. Google: Email sender guidelines
2. Google: Email sender guidelines FAQ
3. Google: Postmaster Tools dashboards
4. Yahoo Sender Hub: Sender Best Practices
5. RFC 8058: Signaling One-Click Functionality for List Email Headers
6. RFC 7208: Sender Policy Framework (SPF)
7. Spam Resource: Google warns, sender requirements enforcement ramping up