Gmail, Yahoo & Outlook Bulk Sender Requirements (2026 Guide)

Who counts as a bulk sender

Google defines a bulk sender as one that has sent close to 5,000 or more messages in a single day to personal Gmail accounts (addresses ending in @gmail.com or @googlemail.com). Messages from all subdomains of the same organisational domain are counted together. Once you cross the threshold, you are treated as a bulk sender permanently — dropping below it later does not reset the status.

Yahoo does not publish a fixed number but applies the same practical expectations to high-volume senders. Microsoft’s rules apply to domains sending more than 5,000 messages a day to Outlook.com, Hotmail.com and Live.com consumer addresses. Mail to business domains hosted on Google Workspace or Microsoft 365 is not counted toward these consumer thresholds.

Rules for every sender, regardless of volume

• Authenticate with SPF or DKIM (Google asks all senders for at least one).
• Have valid forward and reverse DNS: the sending IP needs a PTR record, and that hostname must resolve back to the same IP. Missing PTR causes Gmail’s 550 5.7.25 rejection.
• Use TLS for transmitting mail.
• Keep spam rates reported in Google Postmaster Tools below 0.3%, and ideally below 0.1%.
• Format messages according to RFC 5322 — a single, valid From: header, a proper Date: and Message-ID:.
• Do not impersonate Gmail: do not send with a From: address @gmail.com through other servers, because gmail.com publishes a DMARC quarantine policy.

Extra rules for bulk senders

• Both SPF and DKIM, not just one.
• A DMARC record with at least p=none, published at _dmarc.yourdomain.com.
• DMARC alignment: the From: domain must match the SPF domain (Return-Path) or the DKIM d= domain. Relaxed alignment, where subdomains count, is fine.
• One-click unsubscribe for marketing and subscription messages, using RFC 8058: include both List-Unsubscribe: <https://…>, <mailto:…> and List-Unsubscribe-Post: List-Unsubscribe=One-Click headers, and the message must be DKIM-signed covering them.
• Honour unsubscribe requests within two days.
• A clearly visible unsubscribe link in the message body as well.
• Transactional messages such as password resets and receipts do not require the unsubscribe header, but they still need authentication.

Microsoft Outlook.com’s 2025 rules

Microsoft announced its requirements for high-volume senders in April 2025 and began enforcing them on 5 May 2025. Domains sending more than 5,000 messages a day to Outlook.com, Hotmail.com and Live.com must have SPF passing for the sending domain, DKIM passing, and DMARC at least p=none aligned with SPF or DKIM.

Non-compliant mail is rejected with 550 5.7.515 Access denied, sending domain does not meet the required authentication level. Microsoft also recommends, though does not yet enforce, a functional unsubscribe link, valid From: and Reply-To: addresses that can receive replies, and regular removal of invalid addresses.

What enforcement looks like

Google’s enforcement was gradual: a percentage of non-compliant traffic was first given temporary 4xx errors, and since late 2025 Gmail has increasingly rejected non-compliant mail with permanent errors. The two you will see most are 550 5.7.26 (unauthenticated or DMARC fail) and 421 4.7.28 or 550 5.7.1 for spam-rate problems. Senders that exceed a 0.3% spam rate lose eligibility for mitigation help from Google until the rate stays below that for a sustained period.

Yahoo uses similar authentication failures and may defer or reject mail. Microsoft uses 5.7.515 for authentication failures. In every case, the fix is the same: publish SPF, DKIM and DMARC correctly and keep complaints low.

A compliance checklist

• Look up your domain with a DNS checker: one SPF record, DKIM at every selector you sign with, and DMARC with an rua= reporting address.
• Send a test to a Gmail account and open Show original: SPF, DKIM and DMARC should all say PASS.
• Confirm the DKIM d= domain or the Return-Path domain matches your From: domain.
• For any marketing or newsletter tool, enable its custom-domain DKIM and its one-click unsubscribe feature; send a test and check for List-Unsubscribe-Post in the headers.
• Register in Google Postmaster Tools and check the compliance status and spam-rate pages regularly.
• Remove hard bounces immediately and suppress unsubscribers across every tool you use.

Where business email fits

Ordinary one-to-one business email rarely reaches the bulk thresholds, but the all-sender rules apply to everyone, and DMARC is the baseline every provider now expects. HavitoMail signs every outbound message with a per-domain DKIM key, provides the SPF and DMARC values to publish, and checks each record live in its DNS wizard — so the authentication side of the rules is covered for normal correspondence.

HavitoMail is not designed for bulk sending: it applies per-message and daily recipient limits and does not provide newsletter tooling such as list management or one-click unsubscribe headers. If you send campaigns at bulk volume, use a dedicated email service provider on a subdomain such as news.yourdomain.com, and keep your day-to-day mailboxes separate.