Gmail, Yahoo and Microsoft's bulk sender rules for 2026, in plain language

Gmail, Yahoo and Microsoft all now require bulk senders to authenticate their mail, keep spam complaints under 0.3%, and offer an easy unsubscribe. Miss one and the outcome depends on which provider and which rule: Gmail and Yahoo mostly filter you to spam, Microsoft mostly rejects the message outright. The three agree on more than they disagree on, but Yahoo won’t name a volume threshold and Microsoft won’t require one-click unsubscribe, and both of those are easy to get wrong from memory.

Key Takeaways

• Gmail defines a bulk sender as roughly 5,000 messages a day to personal Gmail addresses. Yahoo refuses to publish a number at all. Microsoft’s threshold is 5,000 a day to Outlook.com, Hotmail and Live addresses.
• All three want SPF, DKIM and a DMARC policy of at least p=none from bulk senders. Only Gmail and Yahoo require one-click unsubscribe (RFC 8058); Microsoft asks for an unsubscribe mechanism that’s easy to find, nothing more specific.
• The 0.3% spam complaint rate is a real number from Gmail and Yahoo, but it’s a ceiling, not a target: Gmail’s own guidance says to stay under 0.1%.
• Fail authentication and Gmail or Yahoo mostly spam-folder you. Fail Microsoft’s bar and, since April 2025, the message is rejected outright with a 550 error.

Who counts as a bulk sender

Gmail’s FAQ puts the line at “approximately 5,000 or more messages” to personal Gmail accounts within 24 hours, counted against the sending domain. Cross it once and the stricter rules apply going forward, whether or not you cross it again.

Microsoft’s requirement is stated the same way: domains sending more than 5,000 emails a day to Outlook.com, Hotmail.com or Live.com addresses.

Yahoo is the outlier. Its own FAQ states plainly: “A ‘bulk’ sender is classified as an email sender sending a significant volume of mail. We will not specify a volume threshold.” A single campaign to a few hundred people can be judged bulk mail if it’s identical mail sent to a lot of addresses; there’s no count you can stay under to be exempt.

For a working assumption, treat 5,000 a day as the line for all three. It’s stated outright by two of them, and Yahoo’s own language suggests it applies the same rules well before that count if the mail looks like a campaign.

The requirements, side by side

Sources: Gmail’s sender guidelines and FAQ; Yahoo’s sender requirements and FAQ; Microsoft’s Outlook.com postmaster announcement and policies page.

Authentication: SPF, DKIM, DMARC

All three want a DMARC policy, and all three will accept the weakest one: p=none, which asks receivers to report on failures without acting on them. Nobody requires p=quarantine or p=reject today. Microsoft’s own page recommends p=reject without requiring it, which is the closest any of the three comes to pushing past the minimum.

The baseline differs. Below the bulk threshold, Gmail and Yahoo both accept SPF or DKIM, not both. Cross into bulk sending and both flip to requiring both, plus DMARC aligned to one of them. Microsoft doesn’t publish a separate lighter tier at all; its documentation only addresses the high-volume case, where SPF, DKIM and DMARC must all pass.

EmailFig generates all three records (SPF, DKIM and DMARC) for every sending domain and won’t let a domain send until they verify. See the DNS records we generate and how to publish them at your registrar if you’re setting one up.

One-click unsubscribe, and the two-day window

Gmail and Yahoo both require RFC 8058 one-click unsubscribe on marketing and subscribed mail from bulk senders, meaning the List-Unsubscribe and List-Unsubscribe-Post headers that let the inbox show a native “Unsubscribe” button next to the message, no landing page required. Both also give the same honoring window: two days. Gmail’s FAQ states unsubscribe requests must be honored within 48 hours; Yahoo’s requirements page states the same two-day window in its own wording.

Microsoft doesn’t ask for RFC 8058 specifically. Its postmaster policy asks only that “the mechanism for unsubscribing… must be clearly documented and easy for recipients to find and use,” with no stated header requirement and no honoring window in its own documentation. In practice, supporting the header costs nothing extra and satisfies all three at once, so there’s little reason to build to Microsoft’s lower bar on purpose.

EmailFig sets List-Unsubscribe and List-Unsubscribe-Post on every campaign automatically, whether your account uses a plain unsubscribe page or a preference center. There’s nothing to turn on. See meeting Gmail and Yahoo’s bulk sender requirements for how that maps onto an EmailFig account.

The spam complaint rate, precisely

This is the number that gets mangled most in secondary write-ups.

Gmail’s guidelines say to keep the spam rate reported in Postmaster Tools below 0.3%, and its FAQ is more specific: the working target is under 0.1%, with 0.3% as the point past which a bulk sender loses eligibility for Google’s delivery mitigation support. Postmaster Tools reports the rate daily, from Gmail users who click “Report spam” against total mail delivered. It is not a rolling average across all of history; a bad week shows up and a clean one clears it, but crossing 0.3% even briefly has already cost you the safety net for whatever comes next.

Yahoo states the same ceiling, 0.3%, tracked through its Complaint Feedback Loop, a program you have to sign up for and that requires DKIM signing to work. Yahoo’s rate is “calculated in our system based on mail delivered to the inbox,” which is a narrower base than Gmail’s (Gmail counts against everything delivered, spam folder included). The two numbers are not directly comparable even though they share a threshold.

Microsoft publishes no numeric spam complaint threshold on its own postmaster pages. It monitors reputation through its own signals and the Smart Network Data Services (SNDS) feed, but neither of Microsoft’s requirement pages states a percentage a bulk sender must stay under. Anyone quoting a Microsoft complaint-rate number is quoting a third party’s estimate, not Microsoft’s own documentation.

DNS and TLS

All three require valid forward and reverse DNS (a PTR record) for the sending IP. This one is old and uncontroversial: a sending IP with no PTR record, or one that doesn’t resolve back consistently, looks like a residential or compromised host to every major provider, bulk sender or not.

TLS is where the trail runs out for two of the three. Gmail states its TLS requirement explicitly: use a TLS connection to transmit mail. Neither Yahoo’s requirements page nor Microsoft’s postmaster pages mention TLS as a stated requirement, though both accept and generally prefer it in practice; its absence from their documentation just means you can’t point to their own page as the source for a TLS mandate the way you can for Gmail’s.

What actually happens when you fail

The three providers don’t fail the same way, and the difference changes how you’d notice a problem.

Gmail splits consequences by requirement. An authentication failure gets a message rejected with a 5.7.26 error or delivered to spam. A spam rate over 0.3%, a missing DMARC record, or ignoring one-click unsubscribe doesn’t reject anything directly, it makes you ineligible for Google’s delivery support, so problems that come up later go unaddressed and your mail drifts toward the spam folder on its own.

Yahoo describes the effect in general terms: “a negative impact to the delivery of your mail at Yahoo domains.” In practice that’s deferral or spam placement rather than a hard block, and Yahoo’s FAQ notes its systems may defer mail from domains with a high complaint rate as an ongoing behavior, not a one-time penalty.

Microsoft is the sharpest edge of the three. Non-compliant high-volume mail first went to the junk folder starting May 5, 2025. Microsoft updated the enforcement later that same month to outright SMTP rejection: a message from a domain that doesn’t meet the authentication bar gets refused at the connection with 550 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level. There’s no spam-folder middle ground once that’s live for your domain; the message either sends or it doesn’t.

What this means in practice

If your sending domain is authenticated with SPF, DKIM and a passing DMARC record, your unsubscribe headers work, and your spam rate sits well under 0.3%, you clear all three providers’ published bars at once. Nothing in any of the three requirement sets is unique enough to need separate handling.

Where it’s worth double-checking is the two gaps: Microsoft’s binary rejection means a broken DNS record shows up as bounced mail, not a slow reputation slide, so catch it before a send rather than after. And Yahoo’s refusal to name a volume threshold means “I’m under 5,000 a day” isn’t the exemption it is with Gmail and Microsoft; if the mail looks like a campaign, Yahoo can treat it as one regardless of count.

EmailFig requires SPF, DKIM and DMARC to verify before a sending domain goes live, and puts the unsubscribe headers on every campaign whether you’re on the simple unsubscribe page or a preference center. Your Sending health card tracks bounce and complaint rates so a rising number is visible before it costs you delivery. If you’re setting up a domain for the first time, warming it up gradually and sending first to your most engaged contacts is the fastest way to build the track record these thresholds actually measure.

These three providers’ rules are the technical floor of a much wider subject; see email deliverability for people who aren’t experts for how authentication, bounce and complaint rates, and list hygiene fit together.