Gmail and Yahoo Bulk Sender Requirements: 2026 Checklist

This is a source-checked Gmail and Yahoo bulk sender requirements checklist, verified in August 2026 against Google's and Yahoo's own live sender guidelines rather than recycled from the 2024 launch coverage. If you send bulk email — roughly 5,000 or more messages a day to personal Gmail or Yahoo addresses — both providers now require a specific set of authentication, infrastructure, and list-hygiene controls.

The stakes have risen since the rules first landed. Gmail no longer just files non-compliant bulk mail as spam; it rejects it. This page lists every requirement, shows exactly where Gmail and Yahoo differ, and gives you a concrete way to check each one before your next send.

The short answer#

Google and Yahoo published aligned sender requirements that took effect in February 2024, and the bar has only tightened since. The core list is the same on both sides: authenticate with SPF and DKIM, publish a DMARC policy of at least p=none, keep your From address aligned, send over TLS, run valid DNS, offer one-click unsubscribe on marketing mail, and hold your spam rate down.

The threshold that flips you into bulk-sender rules is Google's: about 5,000 messages a day to personal Gmail accounts. Google counts those 5,000 across your whole primary domain, subdomains included, and once you cross it the classification is permanent. Yahoo applies the same practices to bulk senders but does not publish a specific volume number on its best-practices page.

The criteria that actually matter#

Nine controls do the real work. They fall into three groups: authentication that proves you sent the mail, infrastructure that proves your servers are legitimate, and list hygiene that proves recipients want it. Here is what each one is and why it is on the list.

Authentication: SPF, DKIM, and DMARC#

This is the group most senders get wrong, and usually not because a record is missing. It is because the records do not line up. Alignment is the piece that trips people up.

• SPF: publish a Sender Policy Framework record listing the servers allowed to send for your domain. Required by both Gmail and Yahoo.
• DKIM: sign your mail with a DKIM key so the receiver can confirm it was not altered in transit. Required by both.
• DMARC: publish a DMARC record with a policy of at least p=none. That is the floor — none takes no action on failures but still turns on reporting. Both require it; Yahoo adds that DMARC must pass.
• Alignment: the domain in your visible From header must match the domain that passes SPF or the domain that signs DKIM. Without alignment, DMARC fails even when SPF and DKIM individually pass.

Infrastructure: TLS, DNS, and message format#

This group is about your sending machinery looking like a real, well-run mail system rather than a hijacked box. Most of it is set once and left alone.

• TLS: transmit mail over a TLS connection. Google requires it. Yahoo's best-practices page does not state a TLS requirement, though sending over TLS is standard practice.
• Forward and reverse DNS: your sending IPs need valid forward and reverse (PTR) DNS records, and Yahoo asks that the reverse record be meaningful and non-generic rather than a default ISP string. Required by both.
• Message format: mail must follow the Internet Message Format standard, RFC 5322, with a valid From header. Google calls this out explicitly.

List hygiene: one-click unsubscribe and spam rate#

The last group is about wanted mail. Providers measure whether recipients treat your messages as welcome, and they give people a fast way out.

• One-click unsubscribe: marketing and subscribed messages must include a working List-Unsubscribe header plus List-Unsubscribe-Post: List-Unsubscribe=One-Click — the one-click method defined in RFC 8058 — and honor the request within two days. Google requires it; Yahoo requires a functioning list-unsubscribe header and highly recommends the RFC 8058 Post method. It does not apply to transactional mail.
• Spam rate: Google says keep the spam rate reported in Postmaster Tools below 0.1% and never let it reach 0.3%. Yahoo's stated line is below 0.3%. Google adds a recovery rule — after a spike, you are eligible for mitigation only once your rate stays under 0.3% for seven consecutive days.

The full checklist: Gmail vs Yahoo#

Here is the whole list side by side. "Required" means the provider's own guidelines state it for bulk senders; where a provider does not publish a requirement, the cell says so rather than assuming it is absent. Verified against the live pages in August 2026.

Work down that list in order. A broken DMARC record is the most common single reason mail that looks compliant still gets rejected, because alignment fails silently while SPF and DKIM appear green on their own.

A worked example#

Take a concrete case. Acme runs a 12,000-subscriber product newsletter from the subdomain news.acme.com, sending through an email service provider. That is well over 5,000 a day to personal inboxes, so every requirement applies — and because Google aggregates subdomains, news.acme.com counts against acme.com's primary domain.

A compliant setup for Acme comes down to a handful of DNS records and headers:

With those in place, Acme sends a seed batch and reads the DMARC aggregate reports its rua address collects. The reports confirm SPF and DKIM both align on acme.com, so DMARC passes. Acme then watches Gmail Postmaster Tools: the spam rate sits at 0.04%, comfortably under the 0.1% target. The newsletter delivers.

Notice what did the work. None of it happened inside a mail client. It happened in DNS records, at the ESP that signs and sends the mail, and in a reporting tool that reads the DMARC data back. That division matters for the recommendation below.

Red flags that get bulk mail rejected#

These are the mistakes that turn a technically close setup into rejected mail. Each maps to a requirement above.

• DMARC passes authentication but fails alignment. SPF and DKIM go green on their own, yet the From domain matches neither, so DMARC still fails. This is the most common silent failure.
• Treating a subdomain as a fresh start. Google aggregates subdomains into the primary domain, so spinning up news2.acme.com does not reset your volume, your reputation, or your bulk-sender status.
• Assuming bulk-sender status is temporary. Once you cross 5,000 a day to personal Gmail, the classification is permanent — it does not lapse when volume drops.
• No one-click unsubscribe on marketing mail, or a link you do not honor within two days. A List-Unsubscribe header alone is not enough; Google wants the RFC 8058 one-click Post method.
• Letting the spam rate drift toward 0.3%. Gmail's target is under 0.1%; at 0.3% you are in rejection territory, and you must then hold under 0.3% for seven straight days before mitigation is even available.
• Sending to purchased or scraped lists. Nothing raises complaint rates faster, and complaints are exactly what the 0.1% and 0.3% lines measure.

What we would pick, honestly#

Here is the honest part, and it is the whole point of a checklist page: the tools that get you through this list are not email clients. Meeting Gmail and Yahoo's bulk sender requirements is a sending-side job, and it takes three things working together.

• Your DNS provider — where the SPF, DKIM, DMARC, and PTR records actually live. Your registrar, Cloudflare, or whoever hosts your zone.
• Your email service provider — the platform that signs and sends the campaigns and, on any reputable one, sets up DKIM alignment and injects the RFC 8058 one-click unsubscribe headers for you. Mailchimp, Klaviyo, SendGrid, and Amazon SES all handle this; the packaging differs (per-contact versus usage-metered), so confirm each one's current setup on its own docs.
• A DMARC monitoring service — to read the aggregate reports your rua address collects, catch alignment failures, and move you safely from p=none toward enforcement. Services such as dmarcian, Valimail, and Postmark's DMARC tool exist for exactly this; verify current capabilities on the vendor's own page.

AI Emaily is not on that list, and we are not going to pretend otherwise. We build AI Emaily, and it is a mail client — the app you read and reply in — not an ESP, a DMARC monitor, or a deliverability tester. It will not authenticate your sending domain or send your campaigns, so if your job today is passing this checklist, the three tools above are your answer, not us.

Where AI Emaily fits is the other side of the same wire. These rules exist because bulk mail floods personal inboxes; on the receiving end, our spam and cold-email filtering keeps unsolicited and non-compliant bulk mail out of the inbox you actually work in, and files the rest. If you are a founder or team drowning in inbound, that is the reader we are right for. If you are the one sending the campaigns, go set up your ESP and DMARC first — this page has done its job when your mail lands.