Gmail and Yahoo bulk sender requirements, applied to cold email

Google and Yahoo require every sender to authenticate with SPF or DKIM, keep complaints low and publish valid DNS. They require more from bulk senders: SPF, DKIM and DMARC together, an aligned From domain and one-click unsubscribe for marketing mail. Google’s bulk threshold is close to 5,000 messages a day to Gmail, Yahoo publishes none, and neither provider exempts cold email. If you run outreach, build to the bulk standard from the first send.

The rules were announced for February 2024, and Google says it has been ramping up enforcement since November 2025, with temporary and permanent rejections for mail that does not comply. This article lists what each provider states on its own pages, how the bulk definition works for a cold program, and what to check before you send.

Who counts as a bulk sender

Google’s definition is “close to 5,000 messages or more to personal Gmail accounts within a 24-hour period”. Three details matter for cold senders:

• Subdomains are added together. Google counts all messages sent from the same primary domain. Sending from mail.example.com and outreach.example.com does not split your count.
• Mailboxes are added together too. The count is by sending domain, not by mailbox. Ten mailboxes on one domain sending 500 messages a day to Gmail each are 5,000.
• Status does not expire. Google says a sender classified as bulk is permanently classified as such.

Google’s summary page words the threshold as “more than 5,000” and its FAQ as “close to 5,000”. Treat 5,000 as the line and stay clear of it.

One detail changes the picture for business-to-business outreach. Google’s FAQ says the sender guidelines and Google’s enforcement apply only to mail sent to personal Gmail accounts, and do not apply to messages sent to Google Workspace accounts. A B2B list that is mostly company domains on Workspace is therefore mostly outside the Gmail count. It is not outside everyone’s rules, because Microsoft, Yahoo and the receiving company’s own filters apply their own, and a company domain can sit behind any of them. A mixed list with some personal Gmail addresses is counted for those addresses.

Yahoo says a bulk sender sends “a significant volume of mail” and says it will not specify a threshold. A small cold program may be outside both definitions today, but the base rules still apply to it, and the cost of meeting the bulk rules is small. We recommend building to them regardless.

What every sender must do

Both providers list a base layer for all senders, whatever the volume.

Cold senders on a fresh domain tend to meet the first two lines by default and miss the third, because the spam rate is the one number the sender does not control directly. A recipient decides.

What bulk senders must add

Once you are above the line, both providers add the following.

Two points from the fine print:

1. Yahoo says a link in the body is not enough. Its FAQ says senders must implement the list-unsubscribe header, preferably according to RFC 8058. The mechanics are in the one-click unsubscribe article.
2. Transactional messages are excluded from one-click. Google and Yahoo both limit the rule to marketing and promotional mail. Cold outreach is promotional in nearly every case.

Google adds that DMARC alignment is not required for forwarded or mailing list messages, which it calls indirect messages. That does not help a cold sender, because your messages are direct.

The spam rate, in numbers

Google reports the spam rate in Postmaster Tools as the percent of your messages that recipients manually mark as spam in Gmail. It states three thresholds: a target below 0.1%, a ceiling you must never reach at 0.3%, and the consequence that bulk senders above 0.3% are ineligible for mitigation.

A worked example, with a made-up volume:

Delivered to Gmail in a day:      2,000 messages
Marked as spam by recipients:     4 messages
Spam rate:                        4 / 2,000 = 0.20%
Gmail target (below 0.10%):       fewer than 2 reports per 2,000
Gmail ceiling (0.30%):            6 reports per 2,000

Four reports is double the recommended level and two thirds of the way to the ceiling. Complaint-driven numbers move quickly on small samples, so look at a window of days, not a single day, and note that Postmaster Tools says data may be missing when the daily message count is too low. If your volume to Gmail is small, you may see nothing in the dashboard at all, and the absence of data is not a clean bill of health.

A caution that applies to cold email in particular: Google’s guidelines tell senders not to purchase email addresses from other companies and not to send messages to people who did not sign up to get them, because those recipients may mark the messages as spam. Cold outreach is by definition sent to people who did not sign up, which is why the spam rate is the number that decides whether it works. Keep the list narrow and relevant, make leaving easy, and watch the rate.

Yahoo watches complaints through its Complaint Feedback Loop and does not publish how it applies the 0.3%. Its FAQ says it may defer mail from domains with a high complaint rate.

What happens if you do not comply

Google says enforcement for bulk senders is gradual and progressive, that senders receive error codes naming the failed requirement, and that new domains (defined as domains that have not sent more than 5,000 emails a day to personal Gmail accounts since January 1, 2024) are on an accelerated timetable. That matters to cold programs, which create new domains often. Its enforcement table lists temporary or permanent failure codes, or spam foldering, for failures of alignment, SPF and DKIM, DNS, TLS and message format, and lists “delivery support or mitigations unavailable” for a spam rate above 0.3%, a missing DMARC record, missing one-click unsubscribe and unsubscribes not honored within 48 hours. Yahoo says mail may be sent to the spam folder or rejected. Neither publishes a per-message schedule. Expect the failure to show up as more messages in spam first and as bounces with codes that name the policy later.

A checklist for a cold program

Run this before the first send from a new domain, and again whenever you add a sending source.

1. SPF and DKIM pass for the domain in the From header. Check the headers of a real test message in Gmail (“Show original”) and confirm spf=pass and dkim=pass.
2. A DMARC record exists and aligns. Start with p=none and a reporting address.
3. Forward and reverse DNS are valid for the IP that sends. If a provider sends for you, this is their job, but verify that they do it.
4. TLS is on for the connection.
5. Every message has List-Unsubscribe and List-Unsubscribe-Post, signed by DKIM, plus a visible link in the body.
6. Unsubscribes take effect at once. Both providers set a ceiling, not a target.
7. You can see your spam rate. Add the sending domain to Postmaster Tools. See the deliverability audit checklist.
8. Your volume per domain is recorded and capped so you know how close you are to 5,000 a day to Gmail.
9. List quality is controlled. Providers measure complaints, and the lowest-cost way to reduce complaints is to send fewer messages to people who have no reason to expect them. See cold email deliverability.

An example of DMARC and unsubscribe headers for a domain you own:

_dmarc.example.com.  IN TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

List-Unsubscribe: <https://unsub.example.com/u/7f3c9a1e2b4d>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

How this differs from CAN-SPAM

CAN-SPAM is the US law and the provider rules are a separate layer. The FTC’s guide says the law makes no exception for business-to-business email, requires a valid physical postal address and a clear opt-out, and requires you to honor an opt-out within 10 business days. It does not require advance consent for commercial email. It also says you cannot contract away your legal responsibility when another company sends for you.

Read the two together. CAN-SPAM sets the legal floor and the penalty, which the FTC page lists as up to $53,088 per email. Google and Yahoo set the operating conditions for reaching an inbox, and they are stricter on timing (2 days at Yahoo against 10 business days in the law). A program that follows the provider rules will normally meet the law’s opt-out timing as well. This article is not legal advice.

How Dooxout handles this

Every campaign email from Dooxout carries the List-Unsubscribe and List-Unsubscribe-Post headers and an unsubscribe link, and an unsubscribe or a spam complaint puts the address on the workspace suppression list for all channels. That is the one rule in the platform that cannot be turned off.

Before a launch, preflight checks DNS for SPF, DKIM and DMARC and the sending identity, and the first message can be tested through DeliverProbe. Caps per mailbox, per domain and per channel are set by the server, so you can see how close a domain is to a provider threshold. Bounce and complaint thresholds pause sending automatically, and you set the thresholds. The platform warns and recommends, and the decision stays with you. It does not promise inbox placement. See email deliverability, cold email infrastructure and guardrails and security.