Gmail and Yahoo Sender Requirements Explained

Published October 23, 2026 · Updated October 23, 2026 · 8 min read

What the Gmail and Yahoo sender requirements actually are

The gmail yahoo sender requirements are a set of enforcement rules from two mailbox providers, not a new law: if you send 5,000 or more messages a day to Gmail accounts, Google expects you to authenticate your mail with SPF or DKIM (and DMARC for bulk senders), support one-click unsubscribe on promotional mail, and keep spam complaint rates below 0.3%. Yahoo applies parallel rules to bulk senders, and both providers began enforcing bulk sender rules in 2024.

Two clarifications matter before you touch a DNS record:

"Bulk sender" is a volume threshold, not a business type. Google's guidelines set the bulk sender threshold at 5,000 messages per day to Gmail accounts (see Google's bulk sender guidelines). A small SaaS sending a weekly digest may never cross it; a retailer with a 40,000-contact list crosses it on a single send.
The rules cover promotional and transactional mail alike. Authentication requirements apply to all senders; the one-click unsubscribe requirement targets promotional and subscribed messages, not pure transactional receipts.

This is not legal advice. The authoritative texts are Google's bulk sender guidelines and Yahoo's sender best practices pages; read them directly, because both providers have updated wording since launch. For the wider picture of how mailbox providers judge senders, see our deliverability fundamentals.

Not sure your current tool is the right fit? Compare the Best Email Marketing Platforms by price, features and free plans for your exact list size.

Why these rules exist (and what changes if you ignore them)

Mailbox providers are optimizing for one thing: their users' inboxes. Spoofed mail, unauthenticated bulk blasts and hard-to-cancel subscriptions all erode trust in the inbox, so Google and Yahoo pushed the cost of proving legitimacy onto senders.

The realistic consequences of non-compliance, roughly in escalation order:

Temporary deferrals — your mail is retried later, which delays time-sensitive campaigns.
Throttling — your sending rate is capped, so a large send trickles out over hours.
Spam folder placement — messages deliver, but nobody sees them.
Rejection — persistent failures get refused outright at the SMTP level.

Authentication protects your domain from spoofing whether you send 200 emails a day or 200,000, and DMARC reporting is useful at any volume. The hard requirements simply target bulk volume first.

The four requirements, one by one

SPF, DKIM and DMARC: what each one does

SPF lists which servers may send mail for your domain. It is a TXT record.
DKIM attaches a cryptographic signature to each message, proving it was not altered in transit and that you authorized it. It uses a public key published in DNS.
DMARC ties the two together: it tells receivers what to do when a message fails authentication, and where to send reports.

Gmail requires SPF or DKIM for all senders, and both plus a DMARC record for bulk senders. Yahoo requires authentication including DMARC.

An illustrative DNS setup (replace the values with your provider's):

; SPF — authorize your sending platform
mail.example.com.  TXT  "v=spf1 include:spf.your-esp.com ~all"

; DKIM — selector published by your sending platform
mf2026._domainkey.example.com.  TXT  "v=DKIM1; k=rsa; p=MIGfMA0GCSq..."

; DMARC — start with monitoring only
_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

Once reports look clean, move to p=quarantine, then p=reject.

Alignment is the part most people get wrong. DMARC passes only when the domain in the visible From header matches the domain that passed SPF or DKIM. If you send as news@example.com but your platform signs as example.mail-esp.com, SPF alignment fails and you rely on DKIM alignment instead. Check which one is actually aligned before assuming you are covered.

One-click unsubscribe (RFC 8058)

Bulk senders must support one-click unsubscribe in promotional and subscribed messages, and honor the request within two days. In practice this means two headers:

List-Unsubscribe: <https://example.com/unsubscribe?token=abc123>, <mailto:unsubscribe@example.com>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

The unsubscribe must work without a login, without a confirmation page, and without asking the recipient to pick a reason. A visible unsubscribe link in the message body is still expected — the headers are an addition, not a replacement.

A failing implementation looks like this: the link opens a preference center that requires a password, or it redirects through a click-tracking domain that returns a 404 when the recipient's mail client posts to it. Test it from a real inbox, not just your own admin panel.

Spam rate below 0.3% in Postmaster Tools

Google asks bulk senders to keep spam complaint rates below 0.3% as reported in Postmaster Tools (see Google's bulk sender guidelines). This is measured from user reports, not from your own analytics, and it is a rolling signal — one bad campaign can push you over for a while.

Register your sending domains in Postmaster Tools and watch the spam rate dashboard alongside reputation and delivery errors. Yahoo publishes complaint-rate guidance and operates a complaint feedback loop; if you are enrolled, route those complaints into suppression rather than ignoring them.

How to comply: a step-by-step path

Inventory every domain and subdomain you send from. Include marketing platforms, transactional APIs, support tools and any internal script that sends mail. Most compliance failures are a forgotten subdomain.
Publish SPF, DKIM and DMARC. Start DMARC at p=none with rua reporting enabled so you can see who is sending as you.
Read the reports, then tighten. Move to p=quarantine, then p=reject, once you know which legitimate streams might break.
Implement one-click unsubscribe and test it from Gmail, Yahoo Mail and a mobile client.
Register domains in Postmaster Tools and set up a complaint feedback loop.
Clean the list. Remove hard bounces, sunset contacts who have not engaged in a long time, and never re-add suppressed addresses.
Send consistently. Steady volume builds reputation; sudden bursts from a cold domain look like abuse.

Mailerflow handles the operational half: guided DKIM/SPF/DMARC setup with automatic verification, plus automatic bounce and complaint suppression.

Worked examples

These are illustrative scenarios, not customer stories.

A 40,000-contact retailer sending daily promos from a shared domain. The From address is promos@retailer.com, but the platform signs as its own domain, so DMARC fails alignment. Complaints climb after a re-engagement blast to a purchased list. The fix: move to an authenticated subdomain, publish DMARC at p=none to see the damage, add one-click unsubscribe, and drop the purchased segment entirely. Deliverability recovers over several weeks, not days.

A SaaS sending receipts and a weekly digest from the same subdomain. A spike in digest complaints drags down the reputation of the transactional stream, so password resets start landing in spam. The fix: separate streams onto distinct subdomains with their own authentication and reputation, so marketing problems cannot break receipts.

A small sender under 5,000/day. No hard requirement applies, but SPF, DKIM and DMARC still stop spoofers from using the domain, and a one-click unsubscribe reduces complaints from people who would otherwise hit "report spam" because they cannot find the link.

Common mistakes

SPF exceeding the 10-lookup limit. Each include: counts; beyond ten, the record fails (RFC 7208) and you may not notice until mail starts bouncing.
DKIM keys that are too short, or rotated without overlap. Publish the new selector before retiring the old one.
DMARC at p=reject before reading reports. You will block legitimate mail you forgot about.
Alignment failure. Authenticating a domain that is not the one in the From header.
Unsubscribe that requires a login or routes through a tracking domain that breaks the POST request.
Ignoring Postmaster Tools because "complaints are low" — you cannot manage a number you never look at.
Buying or appending lists. No amount of authentication makes a non-consenting list perform.
Re-engaging a segment that never re-consented. Old addresses generate complaints, not revenue.
Treating transactional and marketing streams identically. They have different requirements and different reputations.

Compliance checklist

Authentication

[ ] SPF record published for every sending domain and subdomain
[ ] DKIM selector published and signing verified with a real test send
[ ] DMARC record at _dmarc.yourdomain.com with rua reporting enabled
[ ] DMARC policy progressed to quarantine or reject after reviewing reports
[ ] From domain aligned with the authenticated domain

Unsubscribe

[ ] List-Unsubscribe and List-Unsubscribe-Post headers present on promotional mail
[ ] One-click unsubscribe works without login or confirmation page
[ ] Requests honored within two days
[ ] Visible unsubscribe link in the message body

Reputation

[ ] Domains registered in Postmaster Tools
[ ] Complaint feedback loop configured where available
[ ] Spam rate monitored and kept below 0.3%

List hygiene

[ ] Hard bounces suppressed automatically
[ ] Unengaged contacts sunset on a defined schedule
[ ] Suppression list never bypassed on re-import

Monitoring

[ ] DMARC aggregate reports reviewed monthly
[ ] Sending volume kept steady rather than bursty

Where Sender fits, and what it officially offers

Sender is one of the established email platforms, and its official pricing page (checked 2026-10-23) states that it offers 24/7 support with an average response time of 10 seconds, a 99% satisfaction rate, a free migration service, and that it is trusted by over 180,000 businesses worldwide. The same page notes that VAT is not included in prices because rates vary by country (Germany at 19% is given as an example), that SMTP is included rather than sold separately, that branding is added to subscription forms, popups and newsletters on the free plan and removed on paid plans or the credits system, and that IP reputation is normally shared between most users.

Plan names, limits and prices change, so check Sender's official page for current details before deciding.

FAQ

Does this apply if I send fewer than 5,000 emails a day? No — the hard bulk-sender requirements target 5,000+ messages per day to Gmail accounts. Authentication and good list hygiene still help you at any volume, and Yahoo's guidance is worth reading regardless.

Do I need DMARC if I already have SPF and DKIM? For bulk sending to Gmail, yes. Gmail requires SPF or DKIM for all senders and both plus DMARC for bulk senders. DMARC is also what gives you visibility into who is sending as your domain.

What happens if my spam rate goes above 0.3%? Expect throttling and spam folder placement first, with rejection possible if it persists. Check Postmaster Tools for the specific campaigns driving complaints and fix the source rather than the symptom.

Does one-click unsubscribe apply to transactional email? The requirement targets promotional and subscribed messages. Transactional receipts and password resets are generally out of scope, but keep marketing and transactional streams separate so a complaint spike does not affect delivery of account-critical mail.

How long do I have to honor an unsubscribe request? Two days under the bulk sender requirements. In practice, process it immediately — a delayed unsubscribe often becomes a spam complaint.

Can I use a subdomain for marketing and my root domain for transactional? Yes, and it is a common setup. Authenticate each separately and monitor reputation per domain so problems in one stream do not spill into the other.

Set up your sending domain in Mailerflow with guided DKIM, SPF and DMARC and automatic verification: start here.