Do Bulk Sender Rules Apply to a Small Business?

If you run a ten-person company with one domain and a modest list, you have probably been told that the Gmail and Yahoo bulk sender rules do not apply to you. That is half right, and the half that is wrong is the half that gets your mail rejected. Some of those requirements apply to every sender at any volume — so the question of whether bulk sender rules apply to a small business has a more useful answer than a flat yes or no.

Gmail and Yahoo both split their sender guidelines into two tiers: a baseline that every sending domain must meet, and an extra set that starts once you cross about 5,000 messages a day to that provider. A small sender is exempt from the second tier, not the first. This guide covers exactly which rules you owe at your volume, what to set up, and what to do when mail still lands in spam.

The short answer#

You are not exempt. Gmail and Yahoo each publish a "requirements for all senders" list that carries no volume threshold at all. It applies to a business sending fifty emails a day exactly as it applies to one sending fifty thousand. Meeting it is the baseline for reaching the inbox, not an optional extra for large brands.

• Set up SPF or DKIM for your sending domain — at least one, on the domain your mail actually comes from.
• Publish valid forward and reverse DNS (a PTR record) for your sending IP addresses.
• Send over a TLS connection — Gmail requires it, and most modern providers do this for you.
• Format messages to the Internet Message Format standard, RFC 5322 (Yahoo adds RFC 5321).
• Keep the spam rate reported in Postmaster Tools below 0.3% — Google recommends staying under 0.1%.
• Do not impersonate Gmail From: headers.

What the extra tier adds above the threshold#

The second tier — the part people mean when they say "bulk sender rules" — is what starts above the threshold. It adds both SPF and DKIM together rather than either one, a published DMARC policy (a starter policy of p=none is enough to comply), DMARC alignment on your From: address, and one-click unsubscribe on marketing mail.

A small sender under the threshold owes none of these. But there are two good reasons to set up SPF, DKIM and a p=none DMARC record anyway, and both come from how Gmail defines the threshold — covered in the next section.

Before you start: check what you actually owe#

Before you change any DNS, work out which tier you are in, because the answer decides how much work this is. Two facts about the threshold surprise small senders, and both come straight from Google's own guidelines.

• Identify the domain in your From: address — that is the domain these rules attach to — and confirm you can edit its DNS.
• Gather your provider's SPF and DKIM values from its admin console. The values are defined by whoever sends your mail (Google Workspace, Microsoft 365, an email service provider), not by a mail client.
• Check your real daily volume to personal Gmail accounts. Gmail counts the threshold as close to 5,000 messages or more to personal Gmail accounts within a 24-hour period.
• Know that the count is per primary domain and aggregates subdomains — mail from news.example.com and shop.example.com is added together under example.com.
• Decide whether you send any marketing or subscribed mail, because that is what triggers the one-click unsubscribe rule.

How to meet the rules at small-business scale#

Here is the order that gets a small sender fully compliant with the baseline and safely ahead of the bulk tier. Steps 1 to 3 matter most — do them even if you send far under 5,000 a day. The exact record values come from your mail provider; this is about getting them published correctly.

1. 1

   Confirm your domain and count your volume

   Look at the domain in your From: address — that is the one these rules attach to. In Google Postmaster Tools, check how many messages a day you send to Gmail addresses. Under about 5,000 a day to personal Gmail accounts you owe only the all-senders baseline; at or above it, the bulk tier applies. Remember the count aggregates every subdomain under your primary domain.

2. 2

   Set up SPF (or confirm it exists)

   Publish one SPF record as a TXT record on your domain, listing every service allowed to send as you — for example v=spf1 include:_spf.google.com ~all. The baseline needs SPF or DKIM, so SPF alone satisfies it. Keep exactly one SPF record per domain: merge multiple senders into a single v=spf1 string rather than adding a second record.

3. 3

   Set up DKIM

   Turn on DKIM in your mail provider's admin console and publish the key it gives you as a DNS record. DKIM adds a signature receivers can verify, and it is the more robust of the two because it survives forwarding better than SPF. With both SPF and DKIM in place you already meet the bulk-tier authentication requirement, whatever your volume.

4. 4

   Add a DMARC record at p=none

   DMARC is only required above the threshold, but publish it now as a TXT record named _dmarc — for example v=DMARC1; p=none; rua=mailto:[email protected]. A p=none policy enforces nothing and only collects reports, so it is safe to add, and it means a volume spike can never leave you a non-compliant bulk sender overnight. Note the DMARC standard is now RFC 9989, which removed the old pct tag — leave it out.

5. 5

   Confirm reverse DNS and TLS

   Valid forward and reverse DNS (a PTR record on your sending IP) and TLS transport are on the all-senders list, but for most small businesses the mail provider handles both. If you send through Google Workspace, Microsoft 365 or an ESP, this is already done. If you send from your own server, ask your host to set a matching PTR record and enable TLS.

6. 6

   Add one-click unsubscribe to marketing mail

   If you send newsletters or any subscribed mail, add a List-Unsubscribe header that supports one-click unsubscribe (RFC 8058) and keep a visible unsubscribe link in the body. Gmail and Yahoo both require this above the threshold; Yahoo also asks that you honor an unsubscribe within two days. Transactional mail — receipts, password resets — is exempt.

7. 7

   Watch your spam rate

   Whatever your volume, keep the spam rate in Postmaster Tools below 0.3%, and treat 0.1% as the real target Google recommends. A small list with clean permission usually sits well under that. The fastest way to breach it is buying a list or emailing people who never opted in.

Platform differences: Gmail, Yahoo and Microsoft#

The three biggest mailbox providers publish the same idea with different edges. Gmail and Yahoo are closely aligned; Microsoft runs its own separate regime that most "Gmail and Yahoo requirements" articles leave out. Here is where they differ for a small sender.

What to do when it doesn't work#

If a small sender's mail keeps landing in spam or bouncing, volume is rarely the cause — a missing baseline is. Work from the symptom, and check the record with a public DNS lookup before you assume it is published correctly.

A faster way — and the honest limit#

After the one-time DNS work, there is no ongoing sender-rules chore a small business does by hand — and no mail client can do the DNS part for you. Publishing SPF, DKIM and DMARC is a domain-level job you do once. AI Emaily is a mail client, not a DNS host, a DMARC monitoring service or a deliverability tester, so it will not create these records or fix your outbound reputation. For that, use your provider's admin console and, to read DMARC reports, a dedicated DMARC tool.

Where AI Emaily does the continuous work is the receiving side. SPF, DKIM and DMARC are how a server decides whether a message truly came from the domain it claims, and AI Emaily reads those same results on inbound mail — so its spam protection and phishing checks can flag a sender that failed alignment. We build AI Emaily, and it comes with a 7-day free trial on the Pro and Autopilot plans.