Gmail & Yahoo's bulk-sender rules, and what actually happens if you ignore them
For a while, sending email without proper authentication just meant a worse inbox rate — annoying, survivable. That grace period is over. The big mailbox providers now reject non-compliant bulk mail with a permanent error, which means it doesn't go to spam, it doesn't arrive at all. It bounces. If you send in any volume, this is the difference between your receipts and newsletters landing and simply vanishing.
Here's what's required, who it applies to, and how to check you're actually covered — because a lot of people think they are and aren't.
Do these rules apply to you?
Gmail treats you as a bulk sender once you're sending around 5,000 or more messages a day to Gmail addresses, counted across everything from your domain — not per campaign. Yahoo and the other majors use a similar bar. Two things people miss:
- It's cumulative. Your app's password resets, your invoices, and your newsletter all count toward the same total.
- You want to meet the requirements before you hit the threshold, not scramble the week you cross it. And honestly, everything below is just good hygiene at any volume.
The actual checklist
| Requirement | What it means |
|---|---|
| SPF | A DNS record listing who's allowed to send for your domain — and it must align with the domain you send from. |
| DKIM | A cryptographic signature on your mail, also aligned. This is the one people skip — and it's now mandatory for bulk senders. |
| DMARC | A published DMARC record for your domain. Even a starter policy counts toward the requirement, but see the caveat below. |
| One-click unsubscribe | Marketing mail must honour one-click unsubscribe (the List-Unsubscribe header), and process it within a couple of days. |
| Spam rate under 0.3% | Keep your complaint rate below 0.3% — realistically aim under 0.1%. Spike past 0.3% and deliverability craters, slowly to recover. |
The big change from the old world: SPF or DKIM on its own is no longer enough. Bulk senders need both, aligned, plus DMARC. A setup that was "fine" two years ago can quietly be non-compliant now.
The DMARC catch nobody mentions
Publishing a DMARC record technically satisfies the requirement, and the easiest way to do that is p=none. But p=none protects nothing — it just monitors. So you can be "compliant" on paper while your domain is still fully spoofable. If you're setting up DMARC anyway to meet these rules, do it properly and plan the climb from none to quarantine to reject. Meeting the letter of the rule and actually being protected are two different things.
Why this got teeth
The requirements first landed in early 2024, and for a while enforcement was gentle — non-compliant mail leaned toward the spam folder. Then, in late 2025, the providers escalated: non-compliant bulk mail at scale now gets permanent rejections (the classic 550-style bounce). The practical effect is stark. Compliant senders sail into the inbox; non-compliant ones watch a big chunk of their mail get refused at the door. There's no quiet middle ground anymore.
The failure used to be invisible — your email was "sent," it just underperformed. Now it's loud: it bounces. In a way that's better. You find out immediately instead of wondering why conversions dropped.
How to check you're actually covered
Don't assume. The three DNS records that carry all of this — SPF, DKIM's presence, and DMARC with its policy — are exactly the kind of thing that's set once and then drifts: a DNS cleanup drops a record, a new sending tool isn't added to SPF, someone edits DMARC back to none. Check what's actually published, and keep checking, because the day one of these breaks is the day your mail starts bouncing and nobody gets an alert.
If you want the deeper how-to, see reading your DMARC record and the full SPF, DKIM & DMARC setup order.
Check your email authentication in seconds
Perimeter reads your live SPF and DMARC (and TLS and security headers) and flags what's missing or weak — then watches daily so you hear about a broken record before your mail starts bouncing. Free, no signup.
Watch it continuously → · from $29/mo