Gmail and Yahoo's bulk sender requirements: what you need in place

Anyone sending larger volumes to Gmail and Yahoo addresses needs three things in order: full authentication with SPF, DKIM and DMARC, an unsubscribe that works in one click, and a complaint rate that stays well below half a percent. Fall short and your mail is throttled, filed as spam or refused. The rules are not complicated, but they have to be met all at the same time.

Who the rules apply to

Both providers distinguish ordinary senders from bulk senders. The line sits somewhere around a few thousand messages a day to their addresses; the exact threshold and how it is measured are in their own documentation and change from time to time. Count yourself as a bulk sender too early rather than too late: a newsletter to ten thousand addresses almost certainly qualifies, and a webshop sending a few hundred order emails a day is close. The basic rules, authentication first, apply to everyone regardless.

Rule 1: SPF, DKIM and DMARC, all three

An ordinary sender gets by with SPF or DKIM. A bulk sender needs both to pass, and a DMARC record on the domain on top. That record may sit at the mildest policy, as long as it exists. What matters is alignment: the domain in the sender address the recipient sees must match the domain on which SPF or DKIM passes. If you send as newsletter@yourcompany.be but your tool signs with its own domain, alignment fails. How to set it up correctly is on our SPF, DKIM and DMARC page.

Rule 2: one-click unsubscribe

Marketing mail must contain an unsubscribe link that works without logging in, without a confirmation screen and without a survey. Both providers also expect the List-Unsubscribe header, which puts an unsubscribe button at the top of their own interface. That button must be honoured within two days. An unsubscribe that only takes effect after the next send does not count. This applies specifically to marketing and newsletter mail; an order confirmation or password reset needs no unsubscribe button.

Rule 3: a low complaint rate

The complaint rate is the share of recipients who click "report spam". Both providers want that figure well below half a percent, and preferably considerably lower. It sounds small, but it is a strict number: out of ten thousand messages, only a few dozen people may complain. Anyone mailing an old list that has heard nothing for two years is over the line immediately. Gmail offers a free dashboard where you can follow that rate per domain; switch it on before any large send.

What else is expected

• A correct reverse DNS entry for the sending IP address, which your relay handles.
• Sending over an encrypted connection.
• A sender domain that is not one of the providers' own free addresses: mail from a Gmail address via your own server fails Gmail's DMARC check.
• No addresses that never gave consent; that is the fastest route to complaints.

What it means in practice

Separate your marketing mail from your transactional mail. Newsletters get the unsubscribe button and the header; order confirmations do not. An SMTP relay that adds the right headers per message and prepares authentication for your domain from the dashboard removes most of the technical work. What remains is your list: whoever no longer wants to be on it has to actually come off it.

Then check where you stand. Send a test message to a Gmail address, open it and look in the message details at the results for SPF, DKIM and DMARC. Three times "PASS" means the technical side is in order. After that, follow your complaint rate and bounce rate weekly, in your relay's dashboard and in Gmail's.

What happens if you do not comply

Usually not an immediate hard refusal. First your mail is throttled, then part of it lands in spam, and when complaints keep rising it is refused with an error message pointing to the rules. The problem: by then you have weeks of poor delivery behind you without noticing. Meet the rules up front and you never go through that.

Frequently asked questions

Do these rules also apply to Outlook and other providers?

Microsoft applies comparable requirements to large senders, and most business mail servers watch the same signals. Whoever is in order for Gmail and Yahoo is usually in order everywhere.

My volume is small. Does this affect me?

Authentication, always. The unsubscribe button belongs in every newsletter, whatever the volume. Only the formal bulk-sender threshold may not apply to you.

Should I set DMARC to reject straight away?

No. A record at the mildest policy is enough for these rules. Tighten later, step by step, after reading the reports.