Gmail, Yahoo and Microsoft Outlook all require senders of 5,000 or more emails a day to authenticate with SPF, DKIM and a DMARC record that aligns with the From domain. Gmail and Yahoo also require one-click unsubscribe on marketing mail and a spam complaint rate below 0.3%. Mail that misses the rules can be rejected.

Picture a five-person B2B consultancy that plans a Q4 outbound push. Three salespeople each send a few hundred cold emails a day from the main company domain through an outreach tool, and the newsletter goes out from a subdomain of the same domain. Nobody set up DKIM for the outreach tool, and the DMARC record was never published. In the first week, replies drop and some messages bounce with an authentication error. The invoices and proposals sent from the same domain start landing in spam too.

What are the Gmail, Yahoo and Microsoft bulk sender requirements in 2026?

All three providers ask high-volume senders for the same core: SPF and DKIM that pass, a published DMARC record, and alignment between the authenticated domain and the visible From address. Gmail and Yahoo add one-click unsubscribe and a complaint ceiling.

Gmail's and Yahoo's rules took effect in February 2024. Microsoft's apply to Outlook.com, Hotmail, Live.com and MSN addresses. Here is how they compare, taken from each provider's own pages:

• Gmail (Email sender guidelines). Threshold: about 5,000 messages a day to personal Gmail accounts. Authentication: SPF and DKIM, plus DMARC (a policy of none is enough) with the From domain aligned to SPF or DKIM. Unsubscribe: one-click for marketing and subscribed messages, plus a visible link in the body. Spam rate: keep it below 0.10% and never reach 0.30%.

• Yahoo (Sender best practices). Threshold: bulk senders; the page doesn't give a number. Authentication: SPF and DKIM, and a valid DMARC policy of at least p=none that passes. Unsubscribe: a working List-Unsubscribe header with one-click for marketing, with the RFC 8058 POST method "highly recommended"; unsubscribes honoured within 2 days. Spam rate: below 0.3%.

• Microsoft Outlook.com (Fix NDR error 550 5.7.515). Threshold: 5,000 or more messages to Microsoft consumer mailboxes using the same From domain. Authentication: SPF and DKIM must both pass, a DMARC record must be published, and at least one of SPF or DKIM must align with the From domain. Non-compliant mail is rejected with "550 5.7.515 Access denied".

Every sender, not only bulk senders, must also meet Gmail's baseline: SPF or DKIM, valid forward and reverse DNS for sending IPs, TLS, and a spam rate below 0.3%.

Does cold email count, and who is a bulk sender?

Yes, the rules apply to cold email as much as to newsletters, because the providers count messages per domain, not per campaign type. Volume across every tool and every salesperson using the domain adds up.

Google counts "all messages sent from the same primary domain". Its sender guidelines FAQ gives the example of 2,500 messages from a domain and 2,500 from a subdomain of it: together that sender is a bulk sender. Google also says bulk sender status "doesn't have an expiration date". Once you cross the line, you are treated as a bulk sender from then on, even if your volume falls.

Two consequences for outbound teams:

1. Sending from a subdomain doesn't avoid the count. It still rolls up to the primary domain at Gmail.

2. Being under 5,000 isn't a free pass. The all-sender rules still apply, and complaint rates still decide where your mail lands.

Many teams send cold email from a separate, related domain so a reputation problem there can't reach invoices and support mail. That isolates risk, but the separate domain needs the same authentication and is held to the same rules.

How do you set up SPF, DKIM and DMARC?

Publish an SPF record listing every service that sends for the domain, turn on DKIM signing in each of those services, then publish a DMARC record and read its reports before tightening the policy.

Each standard does one job:

• SPF (Sender Policy Framework) is a DNS record that lists the servers allowed to send mail for your domain.

• DKIM (DomainKeys Identified Mail) is a cryptographic signature added to each message, checked against a public key in your DNS.

• DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS record that tells receivers what to do when SPF and DKIM don't line up with the From domain, and where to send reports.

Alignment is the part most teams miss. It means the domain that passed SPF or DKIM is the same domain, or a subdomain of it, as the one in the From address the recipient sees. An outreach tool that signs with its own domain passes DKIM but fails alignment for yours.

The setup order

1. List every sender. The outreach tool, the CRM, the newsletter platform, the help desk, billing and the office mailbox provider.

2. Fix SPF. Keep one SPF record per domain and include each service in it.

3. Turn on DKIM with your domain. Each service usually gives you records to add to your DNS so it signs as you, not as itself.

4. Publish DMARC at p=none with a reporting address. All three providers accept a policy of none.

5. Read the reports for a few weeks. Find any sender that fails alignment and fix it before you move to quarantine or reject.

What does one-click unsubscribe actually require?

One-click unsubscribe means the recipient can leave your list from the mailbox's own unsubscribe button without visiting a page or confirming anything. It is set in the message headers, not in the email body.

The method is defined in RFC 8058, "Signaling One-Click Functionality for List Email Headers". A message needs a List-Unsubscribe header that contains an HTTPS address and a List-Unsubscribe-Post header with the value List-Unsubscribe=One-Click. The RFC also says the DKIM signature must cover both headers, so they can't be forged.

Google is direct about the body link: a mailto link in the body "doesn't meet our one-click unsubscribe requirement". You need the headers and, for Gmail bulk senders, a visible unsubscribe link as well.

What to check in your outreach tool

• It adds both headers to campaign messages and signs them with your DKIM key.

• An unsubscribe from the header removes the contact across every sequence and every sender, not only the current campaign.

• Removals take effect within 2 days, which is Yahoo's requirement and within Google's recommended 48 hours.

• The suppression list flows back to your CRM so a colleague can't re-add the contact next month.

Google's guidelines tie one-click unsubscribe to marketing and subscribed messages. A first-touch sales email is promotional by most readings, so the safe course for cold outreach is to include it.

What complaint rate is too high?

Keep the user-reported spam rate below 0.1% and never let it reach 0.3%. Gmail and Yahoo both use 0.3% as the line; Gmail's guidelines set 0.1% as the target.

The spam rate is the share of delivered messages that recipients mark as spam. Gmail calculates it daily and shows it in Postmaster Tools, for domains you have verified there. At 0.1%, one complaint per thousand delivered emails is already at the target. Cold email gets complaints more easily than newsletters, because the recipient never asked for it.

What keeps complaints down

• Tight targeting. Send only to people with a clear reason to care. Volume from loose lists is where complaints come from.

• Clean data. Remove bounces, role addresses and duplicates before a sequence starts. Clean Your CRM Data Before You Add AI covers dedupe and ownership.

• Short sequences. Stop after a few touches without a reply.

• Visible exits. An easy unsubscribe turns a would-be spam report into a quiet removal.

AI writing tools make it cheap to send more messages, which is the fastest way to cross 0.3%. AI SDRs in 2026: What They Do Well and Where They Burn Your Domain goes into that risk.

What should you fix before the Q4 sending peak?

Fix authentication first, unsubscribe second and list quality third, then raise volume slowly while watching complaint rates. In order:

1. Inventory: list every domain and service that sends mail as you.

2. SPF: one record per domain, every sender included.

3. DKIM: every service signing as your domain.

4. DMARC: published, with reports going to an inbox someone reads.

5. Alignment: confirm from the reports that each sender aligns.

6. DNS and TLS: forward and reverse DNS valid for sending IPs; TLS on.

7. One-click unsubscribe: both headers, DKIM-signed, removals within 2 days across all tools.

8. Postmaster Tools: verify each sending domain so you can see your Gmail spam rate.

9. Lists: remove bounces, duplicates and contacts with no clear reason to hear from you.

10. Volume: increase daily sends gradually and pause a sequence when complaints rise.

Mailbox provider rules are separate from the anti-spam and privacy laws in your recipients' countries. This post is not legal advice; check those laws with counsel before you send.

How we approach it at Vizio AI

We start with the mail that is already going out. We list every service sending as the domain, read the DMARC reports and headers of real messages from each one, and mark which pass, which align and which carry working unsubscribe headers. That usually shows the gap faster than any checklist.

Then we fix it at the source: DNS records, signing in each tool, and one suppression list that every sending tool and the CRM share. Only after the domain is clean do we work on targeting and sequences, and we raise volume step by step while watching the complaint rate.

This is part of the outbound work of our Growth Studio.

Sources

• Google Workspace Admin Help, Email sender guidelines: https://support.google.com/a/answer/81126

• Google Workspace Admin Help, Email sender guidelines FAQ: https://support.google.com/a/answer/14229414

• Yahoo Sender Hub, Sender Best Practices: https://senders.yahooinc.com/best-practices/

• Microsoft Support, Fix NDR error "550 5.7.515" in Outlook.com: https://support.microsoft.com/en-us/outlook/fix-ndr-error-550-5-7-515-in-outlook-com

• IETF, RFC 8058: Signaling One-Click Functionality for List Email Headers: https://www.rfc-editor.org/rfc/rfc8058

• Vizio AI, AI SDRs in 2026: What They Do Well and Where They Burn Your Domain: https://www.vizio.ai/resources/blog/ai-sdr

• Vizio AI, Clean Your CRM Data Before You Add AI: https://www.vizio.ai/resources/blog/crm-data-cleanup

• Vizio AI, Growth Studio: https://www.vizio.ai/studios/growth-studio