The Gmail and Yahoo Bulk Sender Requirements Checklist (2026)

This stopped being optional a while ago. Since 2024, Google and Yahoo have enforced a specific set of requirements for anyone sending bulk mail, and Microsoft has since joined with similar rules. As of 2026 enforcement, non-compliant mail isn't quietly filtered to spam anymore - it's rejected outright, permanently, with no delivery attempt.

The threshold that triggers all of this: roughly 5,000 emails per day, per sending domain, to that provider. Under that, the requirements aren't enforced the same way - but honestly, if you're sending cold outreach or marketing mail at any real volume, you're already there or heading there, so treat this as the baseline regardless of your current count.

Authentication - SPF, DKIM, DMARC

• SPF and DKIM both configured and passing on the sending domain
• DMARC published at minimum p=none - a policy that only monitors still satisfies the requirement, though p=quarantine or p=reject gives you actual protection against spoofing
• Alignment: the domain in your From: header has to match either the SPF-authenticated domain or the DKIM-signing domain (relaxed alignment, the default, allows a subdomain match)

→ Check all three at once with our free Domain Health Check

One-click unsubscribe (RFC 8058)

Required by Google, Yahoo, and Apple; strongly recommended by Microsoft. This only applies to marketing and promotional mail, not transactional or one-to-one cold outreach - but the line between "cold outreach" and "marketing" gets blurry fast once you're sending sequences to a purchased or scraped list, so err toward compliance if there's any doubt.

• A List-Unsubscribe header pointing to a mailto: or https: URI
• A List-Unsubscribe-Post header set to List-Unsubscribe=One-Click, which tells the mail client it can unsubscribe with a single click, no landing page, no login, no "are you sure"
• The actual unsubscribe action has to work within seconds - a broken or slow unsubscribe endpoint defeats the entire point and looks worse to the provider than not having one

Spam-complaint rate

Google Postmaster Tools reports this per domain. The published ceiling is 0.3% - but by the time you're anywhere near that number, providers are already throttling you. Treat 0.1% as the real target, not 0.3%. A complaint rate that creeps from 0.05% to 0.15% over a few weeks is an early warning worth acting on immediately, not a number to watch passively until it crosses a line.

Forward-confirmed reverse DNS (FCrDNS)

Your sending IP needs a PTR record, and that PTR's hostname needs to resolve back to the same IP. This one is easy to miss because it lives at the infrastructure level, not the DNS-records-on-your-domain level - if you're on shared sending infrastructure (many ESPs, some VPS providers), you may not control this directly and need to ask your provider whether it's configured.

None of these five requirements are new practices invented for compliance - they're what a well-run sending setup already looks like. The enforcement just removed the option to skip them and still get delivered.

If you're not sure where you stand on any of this, the honest way to find out isn't to wait for a rejection - it's to check now, fix what's missing, and confirm before your next real send.