Deliverability · 5 min read

What Google and Yahoo's bulk sender rules mean for cold email

The published requirements every sender to Gmail and Yahoo has to meet, and what each one means in practice for an outreach team.

By ClaraPublished Updated

Since February 2024, Gmail and Yahoo have enforced a published set of requirements for anyone who sends email to their users. The rules were written with newsletters in mind, but nothing in them exempts cold outreach. They are also the plainest statement mailbox providers have made about what they expect from a sender.

Who counts as a bulk sender

Google splits senders into two groups. Everyone who sends to Gmail has to meet a baseline: authenticate mail with SPF or DKIM, send from infrastructure with valid forward and reverse DNS, use TLS, and keep the reported spam rate low.

Bulk senders have to do more. Google defines a bulk sender as one that sends close to 5,000 messages or more to personal Gmail accounts within 24 hours. Two details matter:

  • The count is per primary domain. Mail from mail.example.com and get.example.com counts toward the total for example.com.
  • The status does not expire. Google's guidance says a domain that meets the threshold once is treated as a bulk sender from then on.

Yahoo published matching requirements at the same time without naming a number. Microsoft has since announced similar rules for high-volume senders to its consumer mailboxes.

Most cold email teams send far less than that from one domain. Meet the bulk tier anyway. The extra requirements are cheap, and they describe what filters look for at any volume.

SPF and DKIM

SPF is a DNS record listing the servers allowed to send mail for your domain. DKIM is a signature on each message, checked against a public key in your DNS. The baseline asks for one. Bulk senders need both, and so do you.

  • Publish one SPF record per domain, never two. For Google Workspace it looks like v=spf1 include:_spf.google.com ~all. Add an include for every service that sends as your domain, and stay under the 10 DNS lookups the SPF standard allows.
  • Turn on DKIM signing for your own domain. In Google Workspace this is a setting in the admin console. Until you switch it on, messages are signed with a default Google domain instead of yours, which matters for the next requirement.
  • Do this for every sending domain, including secondary domains bought for outreach.

The step-by-step version is in how to set up SPF, DKIM and DMARC. The free domain checker shows what your records return right now.

DMARC and alignment

DMARC is a third DNS record. It tells receivers what to do when a message fails authentication, and where to send reports. Bulk senders must publish one. The minimum policy is p=none, which only asks for reports:

v=DMARC1; p=none; rua=mailto:dmarc@example.com

The part teams miss is alignment. It is not enough for SPF and DKIM to pass. The domain in the visible From address has to match the domain that passed SPF or the domain in the DKIM signature. A message sent through a third-party relay can pass SPF on the relay's domain, carry the relay's DKIM signature, and still fail DMARC because neither domain is yours.

To check, send a campaign email to a Gmail account you control and choose "Show original". You want a DMARC pass with your own domain beside it.

One-click unsubscribe

Bulk senders must support one-click unsubscribe on marketing and subscribed messages, show a clearly visible unsubscribe link in the body, and honour requests within two days.

One-click has a specific technical meaning, defined in RFC 8058. The message carries two headers:

  • List-Unsubscribe, containing an HTTPS URL
  • List-Unsubscribe-Post: List-Unsubscribe=One-Click

The mail client shows an unsubscribe button next to the sender name. One click posts to your URL and the person is removed. No landing page, no login, no confirmation step.

Cold email teams often resist this because it makes a message feel like marketing. Consider the alternative. A recipient who cannot find an exit will use the spam button, and that click counts against the one metric Google puts a hard number on.

The visible link does not need to be a banner. A plain sentence with a working link meets the intent. Fuzegenai adds both one-click headers to campaign emails by default.

Spam rate below 0.3%

Google measures how often Gmail users mark your mail as spam and reports it in Postmaster Tools. The requirement is to stay below 0.3%. Google's own advice is to stay under 0.1%.

At 0.3%, three reports per thousand messages is the ceiling. A small sender has less room still: at 200 messages, a single report is 0.5% for that day.

Three things to know:

  • Set up Postmaster Tools for every sending domain. It is free and verified with a DNS record.
  • Data appears only when you send enough daily volume to Gmail. Empty charts mean no data, not good standing.
  • The rate is calculated on mail that reached the inbox. Google notes that if much of your mail already goes to spam, the reported rate can look low while the real problem is large.

You control complaints upstream: tighter targeting, relevant copy, modest volume per mailbox and an easy opt-out. Building a lead list that does not burn your domain covers the list side.

When you fall short

Mail that fails the requirements can be rate-limited, rejected or filed as spam. Authentication is the most fixable cause. If complaints have already done damage, the fix is slower: see how to recover a damaged sender reputation.

The checklist

  1. SPF and DKIM published and passing on every sending domain.
  2. A DMARC record with at least p=none, and a DMARC pass on a real campaign email.
  3. One-click unsubscribe headers on every campaign email, plus a visible opt-out in the body.
  4. Opt-outs honoured within two days, and never emailed again.
  5. Postmaster Tools verified for each domain and checked weekly.
  6. Complaint rate treated as the number that decides everything else.

None of this gets a cold email read. It gets the email judged on its content instead of being turned away at the door. Before a campaign goes out, the free spam checker scores a draft the way a content filter would.

Sources

All posts

Keep reading

New posts, by email.

One address, nothing else. We write when we have something worth reading.