Bulk sender requirements are the conditions Gmail, Yahoo, and Microsoft impose on anyone sending roughly 5,000 or more messages a day to their users: authenticated mail with an aligned From domain, one-click unsubscribe honoured within two days, and a spam complaint rate below 0.1%. Non-compliant mail is rejected at the server rather than filtered.
The rules took effect in February 2024 and have tightened in stages since. Enforcement is no longer a warning phase.
The requirements, by provider
| Requirement | Yahoo | Microsoft | Apple | |
|---|---|---|---|---|
| Volume threshold | 5,000/day | 5,000/day | 5,000/day | No published threshold |
| SPF | Required | Required | Required | Expected |
| DKIM | Required | Required | Required | Expected |
| DMARC published | p=none minimum |
p=none minimum |
p=none minimum |
Not mandated |
| Aligned From domain | Required, via SPF or DKIM | Required | Required | Expected |
| One-click unsubscribe | Required, honoured in 2 days | Required | Required | Not mandated |
| Spam complaint rate | Below 0.1%, never 0.3% | Below 0.1%, never 0.3% | No published figure | No published figure |
| TLS transmission | Required | Required | Required | Expected |
| Forward-confirmed reverse DNS | Required | Required | Required | Expected |
| Valid, non-impersonating From | Required | Required | Required | Expected |
Apple has not published an equivalent bulk-sender programme. iCloud Mail enforces authentication and rate limits without a public threshold or checklist, and a sender compliant with the other three is generally compliant there.
The enforcement timeline
| Date | Provider | What changed |
|---|---|---|
| February 2024 | Google, Yahoo | Requirements take effect; non-compliant mail met with temporary 421 deferrals |
| 5 May 2025 | Microsoft | Outlook.com enforcement begins |
| November 2025 | Enforcement ramps to permanent 550 rejections |
|
| 2026 | All three | Full enforcement as industry standard |
The shift from 421 to 550 is the change that matters. A 421 is a temporary deferral — the sending platform retries, and mail eventually arrives. A 550 is a permanent rejection: the message is gone, the recipient never sees it, and the sender receives a bounce.
Senders who passed through 2024 and 2025 without noticing a problem may have been surviving on retries that no longer happen.
The error codes and what each one means
| Code | Meaning |
|---|---|
421-4.7.26 |
SPF and DKIM both failed |
421-4.7.30 |
DKIM does not pass for a bulk sender |
421-4.7.32 |
No DMARC alignment |
550-5.7.26 |
Unauthenticated mail, permanently rejected |
550 5.7.515 |
Microsoft hard authentication rejection |
Bounce logs are where compliance failures actually surface, and they name the specific requirement that failed. A sender seeing 421-4.7.32 has an alignment problem rather than a missing record — the difference is explained in email authentication: SPF, DKIM, DMARC and BIMI.
Does the 5,000-a-day threshold apply to you?
The threshold is counted per provider, per day, based on messages sent to that provider's users from the same primary domain.
| Situation | Subject to the rules |
|---|---|
| 5,000 messages a day to Gmail addresses | Yes, at Google |
| 20,000-person list mailed weekly, roughly half Gmail | Yes on send days |
| 800 subscribers mailed daily | No, at any provider |
| 5,000/day across all providers combined | Not necessarily — the count is per provider |
| Crossed 5,000 once during a launch | Yes, and the status is retained thereafter |
Crossing the threshold once makes a sender subject to the rules from then on, so campaign-driven senders who exceed it on launch days are treated as bulk senders permanently.
The more useful reading: every requirement on the list is something a well-run small sender should be doing anyway. SPF, DKIM, DMARC, working unsubscribe links, and a complaint rate below 0.1% are the baseline for anyone who wants their mail delivered, threshold or not. The rules made the baseline enforceable rather than inventing it.
The compliance checklist
Seven items. Each can be verified in minutes.
1. SPF published, single record, under 10 lookups. Query the domain's TXT records and confirm exactly one record starting v=spf1. Two records cause a permanent error.
2. DKIM signing under your own domain. Confirm the sending platform shows the domain as authenticated, and that the signature is not being applied under the platform's domain.
3. DMARC published at p=none or stronger. Query _dmarc.yourdomain.com for a TXT record starting v=DMARC1. The staged path to enforcement is in how to set up DMARC safely.
4. Alignment confirmed, not assumed. Send a message to Gmail, open Show original, and check that the DKIM or SPF domain matches the visible From domain. Passing all three checks while failing alignment is the most common compliance failure.
5. One-click unsubscribe in the headers. The requirement is an RFC 8058 List-Unsubscribe-Post header alongside List-Unsubscribe, not merely a link in the footer. Most major sending platforms add it automatically; verify rather than assume, and confirm requests are honoured within two days.
6. Complaint rate below 0.1%. Check Google Postmaster Tools for the spam-rate chart. Reaching 0.3% costs eligibility for Gmail's mitigation support until the rate holds below the line — reading the charts is covered in how to read Google Postmaster Tools.
7. TLS and forward-confirmed reverse DNS. Sending platforms handle both. Senders on their own infrastructure need to verify that the sending IP's reverse DNS resolves forward to the same IP.
What happens when you fail
Failure is graduated rather than binary, and each stage is recoverable.
Temporary deferral (421). The receiving server refuses the message and invites a retry. Mail is delayed rather than lost, and the sending platform's queue absorbs it. Bounce logs show the specific failure.
Permanent rejection (550). The message is refused outright. The recipient never receives it, the sender gets a bounce, and repeated rejections damage domain reputation independently of the original compliance issue.
Rate limiting. Providers throttle accepted volume from a sender whose complaint rate is elevated, producing delayed delivery that looks like a platform problem.
Spam foldering. A compliant sender with poor engagement is still filtered. Compliance is a floor, not a guarantee — the reason is in why authenticated emails still land in spam.
What the rules do not require
Three things are widely believed to be mandatory and are not.
DMARC at p=reject. Only p=none is mandated. Enforcement is strongly recommended and remains a sender's own choice.
A dedicated IP address. Nothing in the requirements references IP dedication, and a dedicated IP is a liability below consistent high volume — discussed in which email service actually delivers.
BIMI. Entirely optional, and separate from compliance. Covered in BIMI: how to get your logo in the inbox.
What's in the book, not here. The 20-minute self-audit scorecard that walks every one of these checks with pass conditions is in The Email Deliverability Playbook.
Frequently asked questions
Do the bulk sender rules apply under 5,000 emails a day?
The published threshold is 5,000 messages a day to a single provider, counted per provider rather than across all of them. Crossing it once makes a sender subject to the rules from then on. Every requirement is baseline practice for any sender who wants mail delivered, regardless of volume.
What is the 0.3% complaint rate rule?
Google and Yahoo require senders to keep spam complaint rates below 0.1% and never reach 0.3%. Crossing 0.3% costs eligibility for Gmail's mitigation support until the rate holds consistently below the line. Complaint rate moves before revenue does, which makes it the best early warning available.
What happens if I don't comply with bulk sender requirements?
Failure is graduated: temporary 421 deferrals delay mail, permanent 550 rejections discard it entirely, rate limiting throttles accepted volume, and poor engagement produces spam foldering on top. Google moved from deferrals to permanent rejections from November 2025.
Do I need DMARC at p=reject to comply?
No. All three providers mandate a published DMARC policy of p=none or stronger. Enforcement at quarantine or reject is strongly recommended for spoofing protection and is not a compliance requirement.
What counts as one-click unsubscribe?
An RFC 8058 List-Unsubscribe-Post header alongside a List-Unsubscribe header, allowing the mail client to unsubscribe the recipient without opening a web page. A footer link alone does not satisfy the requirement, and requests must be honoured within two days.
Does Microsoft have the same requirements as Gmail?
Substantially, yes. Microsoft's Outlook.com enforcement began on 5 May 2025 with the same 5,000-a-day threshold, the same SPF, DKIM, DMARC and alignment requirements, and the same one-click unsubscribe expectation. Microsoft has not published a specific complaint-rate figure.
Does Apple have bulk sender requirements?
Apple has not published an equivalent programme with a stated threshold or checklist. iCloud Mail enforces authentication and rate limits, and a sender compliant with Google, Yahoo, and Microsoft is generally compliant there.
What to do next
Send one message to a Gmail address and read Show original. That check verifies four of the seven requirements at once — SPF, DKIM, DMARC, and alignment.
Then open Google Postmaster Tools and read the spam-rate chart, which verifies the fifth and is the only one of the seven that cannot be fixed with a DNS record.
Free: The 60-Minute Email Authentication Fix — the checklist for verifying every technical requirement on this page.
Go deeper: The Email Deliverability Playbook — the 20-minute self-audit scorecard with pass conditions for each check.
Related guides
- Email authentication: SPF, DKIM, DMARC and BIMI — the records these rules require
- How to set up DMARC safely — going beyond the minimum policy
- How to read Google Postmaster Tools — verifying complaint rate
- Why authenticated emails still land in spam — why compliance is a floor
- Which email service actually delivers? — what platforms handle for you
- BIMI: how to get your logo in the inbox — the optional extra
Free: The 60-Minute Email Authentication Fix
A no-fluff checklist to set up SPF, DKIM & DMARC correctly and pass Gmail & Yahoo's sender requirements.
Muhammad Basim has worked in digital marketing since 2013, focused on email deliverability and AI-assisted content production. He is the author of the Email Deliverability Playbook and the Email Copywriting Playbook, and has run 100+ email campaigns for ecommerce brands, coaches, and B2B senders. He writes about email, SEO, WordPress, and AI — with a bias toward what can be tested over what sounds good.
Related Articles
How to Read Google Postmaster Tools
Google Postmaster Tools is a free dashboard reporting how Gmail treats mail from your domain, and since 2025 it no longer reports a reputation grade — it reports compliance, spam rate, and a plain-language verdict on whether Gmail's users want your email. No third-party checker carries the same authority, because no third party is making […]
Email Verification Tools: Which Are Worth Paying For
Email verification checks whether an address can receive mail, and it cannot tell you whether anyone behind it wants yours. That distinction decides whether the spend is worth it, because a verified address that never opens damages your reputation exactly as much as it did before you paid to confirm it exists. Verification solves one […]
Email Spam Traps: How to Find and Remove Them
A spam trap is an email address that exists only to catch senders with poor list practice, and no tool can tell you whether one is on your list. Traps accept mail silently. They do not bounce, they do not complain, and they do not appear in any report until the damage is already done. […]