Bulk Sender Requirements: Gmail, Yahoo and Outlook Rules at 5,000 a Day

Bulk sender requirements at Gmail, Yahoo and Microsoft apply to domains that send 5,000 or more messages a day, and they call for SPF, DKIM and a DMARC record at minimum. Enforcement has tightened in steps since 2024, and adoption data show many domains still stop short. This guide gives the rules, the dates and what the studies say.

Last reviewed: October 6, 2026. General information only.

Key takeaways

The bulk sender requirements start at 5,000 or more messages a day and cover SPF, DKIM, DMARC (minimum p=none), one-click unsubscribe and low spam rates.
Google’s guidance is a spam rate under 0.10%, and mitigation help ends at 0.30%.
Outlook.com has rejected non-compliant bulk mail with 550 5.7.515 since May 5, 2025.
Gmail announced stronger enforcement, including permanent rejections, in November 2025.
Red Sift found 38.4% of top US organizations at p=reject, so bulk sender requirements are met on paper more often than they are enforced.

Bulk sender requirements by provider

The rules were announced by Google and Yahoo on October 3, 2023. Our timeline comes from AutoSPF, Proofpoint and Red Sift. We could not open the Google and Yahoo help pages, so treat these as vendor summaries.

Date	Event
February 1, 2024	Enforcement begins with temporary 421 deferrals
April 2024	Stricter handling and more rejections
June 2024	One-click unsubscribe deadline, and Yahoo enforcement
May 5, 2025	Outlook.com rejects non-compliant bulk mail
November 2025	Gmail ramps up temporary and permanent rejections

For Gmail, Red Sift lists SPF, DKIM, DMARC alignment at p=none or stricter, valid forward and reverse DNS, TLS and RFC 8058 one-click unsubscribe honored within 48 hours. Microsoft requires SPF, DKIM and DMARC for senders above 5,000 a day to Outlook.com, Hotmail.com and Live.com, and sets no spam-rate rule. Vendor coverage says Yahoo asks for the same authentication and a complaint rate under 0.3%.

What the enforcement looks like

Gmail uses 4xx codes for temporary deferrals and 5xx for permanent rejections, per Spam Resource, which reported Google’s November 3, 2025 FAQ note. Microsoft first planned to route failing mail to Junk, then changed to outright rejection. A common cause is alignment: a message can pass SPF and DKIM for another domain and still fail DMARC on your From address. We found no provider-published rejection or bounce rates.

Adoption data on bulk sender requirements

Red Sift’s August 2026 report studied the top 100 organizations in each US state, 5,000 domains in all. It found 89.5% had a DMARC record, 38.4% at reject and 22.0% at quarantine. Smaller businesses were outside its scope.

Bulk sender requirements chart of DMARC policies among top US organizations in 2026: reject 38.4 percent, quarantine 22.0, none 29.1, no DMARC record 10.5, from Red Sift — Figure 1. Red Sift DMARC policy split for 5,000 large US organization domains, March to June 2026.

Other studies use different samples. Valimail reported 78% with a record and 42% enforcing in February 2026, without naming its sample. EasyDMARC counted 937,931 of the top 1.8 million domains (52.1%) with DMARC and 411,935 enforcing. DMARCguard scanned 5,499,028 Tranco domains on February 27, 2026 and found DMARC on 30.4% and enforcement on 12.8%.

Grouped bar chart of DMARC adoption and enforcement by study: Valimail 78 and 42 percent, EasyDMARC 52.1 and 22.9, DMARCguard 30.4 and 12.8, relevant to bulk sender requirements — Figure 2. DMARC record and enforcement shares in three 2026 studies. Samples differ.

These are vendor studies, and each defines its population differently, so the gap between 30% and 78% mostly reflects who was counted. EasyDMARC also reported that just over half of Inc. 5000 firms remain at p=none. Google’s reported results, relayed by AutoSPF, include 265 billion fewer unauthenticated messages in 2024 and a 65% reduction, which we could not confirm at the source.

What this means for a small business

Many small senders use several tools at once, and each one needs correct authentication. The table covers common cases.

Your situation	What to do
You send newsletters through a platform	Confirm the platform signs with DKIM for your domain and that your DMARC record aligns with it.
You use several tools (CRM, invoices, support desk)	Each one can fail alignment separately. List them all before you tighten DMARC.
Your DMARC policy is p=none	That meets the minimum, but the studies above show most publishers stop there. Add reporting and plan a move to quarantine.
You see 550 5.7.515 bounces	This means the sending domain failed the authentication level. Check which domain passes SPF or DKIM against the visible From domain.

Three steps to meet the rules

1. Inventory every sender

List each system that sends mail as your domain, then publish SPF and DKIM for each. Our guide to SPF, DKIM and DMARC explains the three records.

2. Publish DMARC with reporting

Start at p=none with an rua address, read the reports and move to quarantine once legitimate mail passes. This is how you meet bulk sender requirements for the long term.

3. Fix unsubscribes and complaints

Add one-click unsubscribe to marketing mail and watch complaint rates in Google Postmaster Tools. Our business email page covers setup and deliverability.

Frequently asked questions about bulk sender requirements

What is the bulk sender threshold?

Vendor summaries of all three providers’ rules describe 5,000 or more messages a day to that provider’s consumer mailboxes. For Gmail, vendors say the bulk label is permanent once you cross it. We could not open Google’s or Yahoo’s own help pages, so confirm the threshold there.

Do I need DMARC if I send fewer than 5,000 emails a day?

Authentication is still wise, since mailbox providers filter on it and a spoofed domain damages your reputation. Vendor guides describe SPF, DKIM and DMARC as the baseline for all senders, with the unsubscribe and alignment rules aimed at bulk senders.

What spam rate is allowed?

Vendor summaries of Google’s rules say to stay under 0.10% and note that at 0.30% you lose eligibility for mitigation until you stay under 0.30% for 7 days. Yahoo coverage cites under 0.3%. Microsoft sets no spam-rate rule that we found.

What does Outlook.com do with non-compliant mail?

Since May 5, 2025 it rejects it with the error 550 5.7.515, according to dmarcian and Security Boulevard. Microsoft first planned to send such mail to Junk, then changed to rejection. Its own blog post carries a note about that change.

What happened in November 2025?

Google added a note to its FAQ on November 3, 2025, saying Gmail was ramping up enforcement, with temporary 4xx and permanent 5xx rejections for senders that miss the rules. We found no published rejection or bounce rates from any provider.