Gmail and Yahoo Bulk Sender Requirements for Cold Email

The Gmail and Yahoo bulk sender requirements were written with newsletters and marketing platforms in mind, but they shape what happens to cold email too. Some apply only above a volume line. Others apply to every sender, however small. Knowing which is which tells you what to fix first when your mail lands in spam.

What changed and who it applies to

Yahoo's sender page says enforcement of its standards began in February 2024 and rolled out gradually. Google's requirements page lists its own start date for TLS and other basics as February 1, 2024. Both providers split senders into two groups.

• All senders: a minimum set of basics, including authentication with SPF or DKIM and a spam rate under 0.3%.
• Bulk senders: a stricter set. Google defines this as more than 5,000 messages per day to Gmail addresses. Yahoo applies a second, stricter set to its own bulk senders.

If you send well below 5,000 a day from a domain, you may technically sit in the all-senders group. Do not read that as a free pass. The spam rate limit and the authentication minimum already apply to you, and meeting the bulk standard costs little. Build to it from the start.

The rules are in Google's email sender guidelines and Yahoo's sender best practices. Read the originals; they are short.

Authentication: SPF, DKIM, DMARC and alignment

Both providers require authentication, in tiers:

Alignment is where many cold email setups fail quietly. SPF and DKIM can both pass while DMARC still fails, because the domain they authenticate is not the one in the visible From address. This is common when a sending platform signs with its own domain. Our guide to SPF, DKIM and DMARC for cold email shows how to set each record and test alignment.

The spam rate numbers: 0.10% and 0.30%

This is the rule that applies to every sender. Google says to keep spam rates reported in Postmaster Tools below 0.30%, and its guidance is to stay under 0.10% and avoid ever reaching 0.30%. Yahoo says to keep spam rate below 0.3%.

For scale, 0.10% is roughly one spam report per thousand messages counted, and 0.30% is roughly three. Cold email is unsolicited by definition, so it draws more complaints than newsletters people signed up for. A campaign that looks fine on opens can still cross these lines if even a few recipients click the spam button.

Set up Google Postmaster Tools for every sending domain so you can see the figure instead of guessing. Pause a campaign when the number moves toward the lower line, not after it crosses the higher one.

One-click unsubscribe and the List-Unsubscribe headers

Bulk senders must support one-click unsubscribe on marketing and subscribed messages. Google specifies two headers: List-Unsubscribe-Post: List-Unsubscribe=One-Click and a List-Unsubscribe header containing the unsubscribe URL. It also asks for a visible unsubscribe link in the message body. Yahoo asks bulk senders to honor unsubscribes within 2 days.

The mechanism comes from RFC 8058. It exists because security software often fetches every link in a message, and a plain link would unsubscribe people by accident. The RFC defines a POST request that receivers can recognize. The message must carry a valid DKIM signature covering those headers, and the unsubscribe URL should not redirect.

Whether a one-to-one sales email counts as marketing mail is a judgment call. The safe route is to include a working unsubscribe either way. You need an opt-out for legal reasons in several countries too, as our guide to whether cold email is legal explains.

What the rules mean for cold email specifically

Three practical points follow.

• Spread volume across domains and mailboxes. Sending hundreds of messages a day from one mailbox draws attention. Moderate volume per mailbox, spread across several, is the normal pattern. This is not a way to dodge the rules: the sender behind them is still accountable, and the aim is to keep each mailbox's reputation healthy, not to hide.
• Ramp new mailboxes. A new domain has no reputation. Our domain warm-up guide covers a safe ramp.
• List quality is a spam rate lever. Wrong contacts bounce and complain. Verify addresses, and target people with a reason to hear from you.

Think of the numbers as a budget. Every message you send either spends or adds to the trust a mailbox provider has in that domain. A well-targeted message to a relevant buyer costs almost nothing. A message to the wrong person, or to an address that no longer exists, spends trust fast. The requirements are less a checklist than a description of what trustworthy senders already do.

The M3AAWG position on cold email is worth knowing here. It calls deceptive delivery methods, such as lookalike domains and multiple sending accounts used to avoid spam filters, an abusive practice. Set up multiple domains to protect reputation and share load, not to evade detection.

A 10-minute self-check

1. Look up the SPF, DKIM and DMARC records for each sending domain. Confirm there is one SPF record, a DKIM key of at least 1024 bits (2048 preferred), and a DMARC record.
2. Send a test email from each mailbox to a Gmail account you control. Open the message, choose Show original, and confirm SPF, DKIM and DMARC all say PASS.
3. Check that the domain in the From address matches the domain that passed SPF or DKIM. If not, alignment is broken.
4. Look for the List-Unsubscribe headers in the original message. Add them if they are missing.
5. Register each sending domain in Google Postmaster Tools and note the spam rate.
6. Count the messages per mailbox per day, and mailboxes per domain, then compare with your plan.
7. Check your bounce rate on the last campaign. A high rate points to list problems.

Why are my cold emails going to spam? A diagnosis order

When placement drops, work through the causes in order of how cheap they are to check. Skipping ahead to copy changes is the common mistake, because copy is the last thing to blame.

1. Authentication. A failing or misaligned record is the cheapest fix and the most common one. Use the self-check above.
2. Spam rate. If Postmaster Tools shows the number climbing toward 0.10%, slow the campaign and look at who is complaining. Recipients who were never a fit for your offer produce most complaints.
3. Bounces. A rising bounce rate points to a stale or badly verified list. M3AAWG lists high unknown-user hard bounces among the signals that mark a sender as cold email.
4. Volume and pace. Sudden jumps in daily volume from a mailbox look like automation. Return to a steady ramp.
5. Content. Heavy formatting, many links and promotional phrasing add weight to every other problem. Plain, specific text helps.

Fix one thing at a time and give each change a few days of data. Changing five variables at once leaves you unable to say what worked.

When to bring in a deliverability audit

Bring in help when authentication passes but placement is still poor, when the spam rate is climbing and you cannot find the cause, or when several domains show the same problem at once. An audit looks at the whole chain, from DNS to list source to sending pattern, and our email deliverability consulting service does exactly this. For a deeper look at the causes, read the inbox placement guide.

We have not covered Microsoft's rules for Outlook senders here, because we could not confirm the details from Microsoft's own page. Check it directly if a large share of your list sits on Outlook or Microsoft 365 addresses.

Frequently asked questions

Why are my cold emails going to spam?

The usual causes are missing or misaligned authentication, a new domain with no reputation, sending too fast, a poor list that produces bounces, and spam complaints. Start by checking that SPF, DKIM and DMARC pass in the message headers, then look at your spam rate in Google Postmaster Tools and your bounce rate.

What is the Gmail spam rate limit?

Google says to keep the spam rate reported in Postmaster Tools below 0.30%, and recommends staying under 0.10% where possible. Yahoo also asks senders to keep spam rate below 0.3%. For scale, 0.10% is about one spam report per thousand messages counted, and 0.30% is about three.

Do I need DMARC for cold email?

If you send more than about 5,000 messages a day to Gmail, Google requires DMARC, and a policy of none is enough. Yahoo requires it for bulk senders too. Below that volume it is not mandatory, but Yahoo strongly urges every sender to publish a policy, and setting one up takes minutes.

What counts as a bulk sender for Gmail?

Google applies its bulk sender requirements to senders of more than 5,000 messages per day to Gmail addresses. Its page uses slightly different wording in different places, so treat 5,000 as the line. Many cold email setups sit below it, but the rules for all senders still apply to you.

Do Yahoo and Gmail require one-click unsubscribe?

For bulk senders, yes, on marketing and subscribed messages. Both rely on the List-Unsubscribe header supporting one-click. Google also requires a visible unsubscribe link in the body. Yahoo adds that bulk senders should honor unsubscribes within 2 days. Whether a one-to-one sales email counts as marketing is a judgment call, so including an unsubscribe is the safe choice.

Related guides

• Inbox placement: why great emails fail
• Domain warm-up isn't optional
• SPF, DKIM and DMARC for cold email