Gmail, Yahoo and Microsoft bulk sender requirements explained

Requirements at a glance

Google (Gmail) requirements

For all senders

• Set up SPF or DKIM for the sending domain.
• Sending IPs must have valid forward and reverse DNS (PTR) that match.
• Use TLS to transmit email.
• Keep the spam rate reported in Postmaster Tools below 0.3%.
• Format messages according to RFC 5322 and do not impersonate Gmail From addresses.

Additional rules for bulk senders (5,000+ a day)

• SPF and DKIM, plus a DMARC record; the policy can be p=none.
• For direct mail, the From domain must align with the SPF or the DKIM domain.
• Marketing and subscribed messages need one-click unsubscribe (List-Unsubscribe and List-Unsubscribe-Post: List-Unsubscribe=One-Click headers, per RFC 8058) and a clearly visible unsubscribe link in the body. Transactional mail such as password resets is exempt.
• Spam rate below 0.3%; Google recommends staying under 0.1%.
• Google counts all mail from the same primary domain, including subdomains, toward the 5,000. Once a sender meets the threshold, it is permanently treated as a bulk sender.

Yahoo requirements

• All senders: SPF or DKIM at a minimum; Yahoo strongly urges a DMARC record for every sending domain.
• Bulk senders: SPF and DKIM, a DMARC policy of at least p=none that passes, and From-domain alignment with SPF or DKIM (relaxed alignment is fine). An rua reporting address is strongly recommended.
• Bulk senders must support one-click unsubscribe for marketing and subscribed mail (RFC 8058 POST is highly recommended, mailto is accepted), show a visible unsubscribe link, and honour requests within 2 days.
• Keep the spam complaint rate below 0.3%.

Microsoft Outlook.com requirements (since May 2025)

Microsoft announced in April 2025 that domains sending more than 5,000 messages a day to its consumer services (outlook.com, hotmail.com, live.com) must meet these rules. Enforcement began on May 5, 2025, and non-compliant mail is rejected with 550; 5.7.515 Access denied, sending domain [domain] does not meet the required authentication level.

• SPF must pass, with DNS listing all authorised sending hosts.
• DKIM must pass.
• DMARC must be published with at least p=none and pass, with SPF or DKIM aligned to the From domain (both preferred).
• Recommended: a valid From / Reply-To address that can receive replies, working unsubscribe links, regular removal of invalid addresses, and transparent sending practices.

Do these rules apply to cold email?

The thresholds are measured per sending domain (Gmail rolls subdomains up to the primary domain). A cold email setup that spreads volume over many domains with 2–3 mailboxes each usually keeps every domain far below 5,000 a day. That does not make the rules irrelevant:

• SPF, DKIM, DMARC and alignment are cheap to set up and remove an obvious reason to filter your mail, at any volume.
• The 0.3% spam rate limit applies to all Gmail senders, not only bulk senders.
• One-click unsubscribe is formally required for marketing and subscribed mail. Cold outreach is not subscribed mail, but a clear way to opt out (a plain line such as 'reply stop and I won't email again') reduces spam complaints, and local laws such as CAN-SPAM or GDPR may require an opt-out anyway.
• Microsoft counts volume by the domain in the From address, so concentrating volume on one domain brings you closer to its threshold.

How to comply

1. 1

   Publish SPF, DKIM and DMARC on every sending domain

   Use one SPF record per domain, turn DKIM signing on, and add v=DMARC1; p=none; rua=mailto:... at _dmarc. Exact records: SPF, DKIM and DMARC for cold email.

2. 2

   Check alignment

   Send a test to a Gmail account and use Show original: SPF, DKIM and DMARC should all show PASS, with the DKIM d= domain matching your From domain.

3. 3

   Add an opt-out

   For marketing and newsletter mail, add List-Unsubscribe and List-Unsubscribe-Post headers plus a visible link. For cold outreach, include a simple opt-out line and honour it within 48 hours.

4. 4

   Monitor spam rate

   Verify your domains in Google Postmaster Tools and keep the spam rate under 0.1%, never reaching 0.3%.

5. 5

   Keep volume per domain modest

   Spread sending across multiple domains and mailboxes. See how many mailboxes per domain.

ReplyDak publishes MX, SPF, DKIM and DMARC records on Cloudflare for every domain it sets up, and its warmup slows down or pauses mailboxes when bounces, spam placement or complaints rise. Compliance with these rules is necessary but does not guarantee inbox placement.