|—|—|—|—|
| Weighs most | Recipient engagement, sending-domain history | IP + domain reputation, complaint levels | Complaints, engagement | Standard authentication + upstream filtering |
| Free sender dashboard | Postmaster Tools | SNDS | Sender Hub resources | — |
| Feedback loop | Spam-rate reporting via Postmaster Tools | JMRP (complaint copies) | Complaint feedback loop | — |
| Known quirks | Tabs (Promotions vs Primary); clips emails over ~102 KB; detects repeated template fingerprints | Assigns bulk-mail scores to campaigns; historically strict on unfamiliar IPs and domains | Enforces the joint bulk-sender rules alongside Gmail | Mail Privacy Protection inflates opens |
| Bulk-sender rules | 5,000+/day: full authentication, one-click unsubscribe, spam rate under 0.3% (target 0.1%) | Equivalent requirements, enforced since May 2025 | Same joint requirements as Gmail | Follows standard authentication; enforcement expected to expand |

Two things to notice. Gmail is the only one weighing recipient engagement as its top signal — which is why the same list can perform completely differently at Gmail and Outlook. And Microsoft is IP-focused where Gmail is domain-focused, which is why SNDS (Smart Network Data Services) is most useful if you're on a dedicated IP.

Two details about the 5,000 threshold that catch people

Both are stated in Google's own sender guidelines FAQ, and both surprise almost everyone.

Subdomains count together. The threshold is measured across all subdomains of your primary domain, not per subdomain. Splitting marketing onto mail.yourbrand.com and transactional onto send.yourbrand.com is excellent practice for other reasons — it does nothing to keep you under the line.

The classification is permanent. Cross 5,000 in a day even once and you're a bulk sender from then on. It doesn't lapse if your volume drops later. One Black Friday send can reclassify you forever.

If you're anywhere near the threshold, read Google's FAQ yourself rather than taking my word for it — provider policies change, and this is a claim worth verifying at the source.

The self-audit

Run this before your next big send. Ten minutes, and it maps directly to the three requirements above.

• Exactly one SPF record exists for my sending domain
• SPF includes my ESP and every other sending tool — CRM, helpdesk, billing
• SPF is under 10 DNS lookups
• DKIM enabled and verified in my ESP, signing under my domain, not the ESP's shared signature
• DMARC record published, minimum p=none with a reporting address
• "Show original" on a Gmail test shows SPF = PASS, DKIM = PASS, DMARC = PASS
• My From-address domain aligns with the SPF or DKIM domain
• One-click unsubscribe (RFC 8058 List-Unsubscribe) enabled for marketing mail
• Unsubscribe requests complete within two days, including any custom preference-centre or CRM flow
• Complainers are auto-suppressed globally, not per campaign
• Domain added to Google Postmaster Tools
• Domain added to Yahoo Sender Hub
• Calendar reminder set to re-verify after any DNS or website migration

That last one prevents more incidents than anything else on the list. Most "sudden" authentication failures trace back to a DNS or hosting change nobody connected to email.

What happens if you don't comply

Not filtering. Rejection.

Microsoft returns 550 5.7.515 Access denied. Gmail moved from deferrals to outright rejections in November 2025. The mail doesn't arrive in spam where a diligent subscriber might find it — it doesn't arrive at all.

Which means the failure mode is also invisible from your side unless you're reading bounce logs. Your ESP dashboard shows the send went out. Your open rate collapses. And the connection between those two facts is a bounce message you never opened.

The habit worth building: after every large send, skim ten actual bounce messages. Not the rate — the text. Two minutes, and it's the difference between deleting subscribers who were fine and fixing a DNS record that was silently breaking everything.

Frequently asked questions

Do the rules apply under 5,000 emails a day?
The formal bulk-sender requirements trigger at 5,000 messages a day to personal Gmail addresses, counted across all subdomains together. But authentication, one-click unsubscribe, and a low complaint rate are what every provider's filtering rewards regardless of volume — so a smaller sender who ignores them will underperform even while technically compliant. Also worth knowing: once you cross the threshold even once, the classification is permanent.

What is the 0.3% complaint rate?
It's the hard ceiling for spam complaints as a share of delivered mail — three per thousand. The working target is under 0.1%, one per thousand. Crossing 0.3% costs you eligibility for Gmail's mitigation support until your rate holds below the line consistently. Treat it as a cliff edge rather than a goal.

What happens if I don't comply?
Rejection at the server, not spam filtering. Microsoft returns 550 5.7.515 Access denied; Gmail moved from deferrals to outright rejections in November 2025. Your ESP will still report the send as attempted, so the failure is invisible unless you read bounce messages.

What to do next

Run the self-audit above against your own domain. Most senders find one or two boxes they can't honestly tick — usually alignment, or the unsubscribe round trip.

Then send yourself a test to Gmail and check Show original. It takes a minute and shows you exactly what Gmail saw, which beats any external checker.

Free: The 60-Minute Email Authentication Fix — verify SPF, DKIM, DMARC, and alignment on your own domain in under an hour.

Go deeper: The Email Deliverability Playbook includes the full 20-minute self-audit scorecard and the provider-by-provider quick reference.

---

Related guides

• Email authentication: SPF, DKIM, DMARC and BIMI — what each record proves
• How to set up DMARC safely — the staged rollout to enforcement
• Why authenticated emails still land in spam — what compliance doesn't buy you

---

---

FAQ FIELD CONTENT

Paste into the mb_faq repeater, one pair per row.

Q1: Do the rules apply under 5,000 emails a day?
A1: The formal requirements trigger at 5,000 messages a day to personal Gmail addresses, counted across all subdomains together. But authentication, one-click unsubscribe, and a low complaint rate are what every provider's filtering rewards regardless of volume. Once you cross the threshold even once, the classification is permanent.

Q2: What is the 0.3% complaint rate?
A2: The hard ceiling for spam complaints as a share of delivered mail — three per thousand. The working target is under 0.1%. Crossing 0.3% costs you eligibility for Gmail's mitigation support until your rate holds below the line consistently.

Q3: What happens if I don't comply?
A3: Rejection at the server, not spam filtering. Microsoft returns 550 5.7.515 Access denied; Gmail moved from deferrals to outright rejections in November 2025. Your ESP still reports the send as attempted, so the failure is invisible unless you read bounce messages.

---

SOURCE NOTES

Not for publication.

Claim	Source
Microsoft rejections from May 5 2025; Gmail rejections from November 2025; Yahoo since 2024	The Email Deliverability Playbook, Ch. 7 and Introduction
550 5.7.515 Access denied, Gmail 421-4.7.32	The Email Deliverability Playbook, Ch. 7 and Ch. 2
5,000/day threshold; subdomains counted together; permanent classification	Google's sender guidelines FAQ, via Playbook Ch. 7 and Appendix G
One-click unsubscribe, RFC 8058, two-day processing	Google's published sender guidelines; Playbook Ch. 7
Complaint target 0.1%, ceiling 0.3%	Google's published sender guidelines; Playbook Ch. 19
Complaint vs unsubscribe cost comparison	The Email Deliverability Playbook, Ch. 16
Falling complaints + falling opens trap	The Email Deliverability Playbook, Ch. 19
Provider comparison table	The Email Deliverability Playbook, Appendix E
Gmail has no traditional per-complainer FBL	The Email Deliverability Playbook, Ch. 19
Authentication checklist items	The Email Deliverability Playbook, Worksheet 7.1
Skim ten bounce messages habit	The Email Deliverability Playbook, Ch. 25

---

JSON-LD Schema

{
  "@context": "https://schema.org",
  "@graph": [
    {
      "@type": "Article",
      "headline": "Gmail, Yahoo & Microsoft Bulk Sender Requirements: The 2026 Checklist",
      "description": "What Gmail, Yahoo, Microsoft, and Apple now require — authentication, one-click unsubscribe, and the 0.3% complaint ceiling — in one table."
    },
    {
      "@type": "FAQPage",
      "mainEntity": [
        {
          "@type": "Question",
          "name": "Do the rules apply under 5,000 emails a day?",
          "acceptedAnswer": { "@type": "Answer", "text": "The formal requirements trigger at 5,000 messages a day to personal Gmail addresses, counted across all subdomains together. But authentication, one-click unsubscribe, and a low complaint rate are what every provider's filtering rewards regardless of volume. Once you cross the threshold even once, the classification is permanent." }
        },
        {
          "@type": "Question",
          "name": "What is the 0.3% complaint rate?",
          "acceptedAnswer": { "@type": "Answer", "text": "The hard ceiling for spam complaints as a share of delivered mail — three per thousand. The working target is under 0.1%. Crossing 0.3% costs you eligibility for Gmail's mitigation support until your rate holds below the line consistently." }
        },
        {
          "@type": "Question",
          "name": "What happens if I don't comply?",
          "acceptedAnswer": { "@type": "Answer", "text": "Rejection at the server, not spam filtering. Microsoft returns 550 5.7.515 Access denied; Gmail moved from deferrals to outright rejections in November 2025. Your ESP still reports the send as attempted, so the failure is invisible unless you read bounce messages." }
        }
      ]
    }
  ]
}