For years, email authentication was the kind of thing a sender could leave for later. Mail still arrived, mostly. Then in 2024 Gmail and Yahoo turned good practice into written rules, and in November 2025 Gmail started rejecting mail that breaks them instead of just filtering it.
If your newsletters, product emails or outreach go to Gmail and Yahoo addresses, these rules are now part of whether your mail exists at all. Here is what they say, without the acronym soup.
Who counts as a bulk sender
Google's line is simple: more than 5,000 messages a day to personal Gmail accounts. Mail sent from the same domain counts together, so your newsletter platform, your CRM and your product emails add up.
Yahoo applies the same idea without publishing a number. If you send regularly at volume, plan as if you are a bulk sender for both.
Counting your 5,000
The threshold trips up more senders than the technical rules do, because the counting is not the counting most teams do.
- It is per domain, not per tool. Everything sent from
example.comcounts together: the newsletter platform, the CRM, the product notifications, the sales sequences and whatever someone set up two years ago. - It is a daily figure, not a monthly average. One launch that sends 20,000 messages on a Thursday makes you a bulk sender for that day, even if the weekly total is small.
- It counts personal Gmail accounts. Mail to a company running Google Workspace is not part of the number, although the same practices apply to how that mail is treated.
- Once you cross it, you stay across it. Google's guidance is that reaching the threshold once means the bulk sender requirements apply from then on.
The practical answer is to stop counting. Every requirement on the bulk list is good practice at any volume, all of it is one-time work, and the alternative is discovering your number on the day a campaign is rejected.
What every sender needs, even small ones
Gmail's sender guidelines set a floor for anyone sending to Gmail:
- SPF or DKIM authentication for your sending domain.
- Valid forward and reverse DNS for the sending servers.
- TLS when transmitting mail.
- A spam rate below 0.3%, as reported in Google Postmaster Tools.
- Well-formed messages that follow the internet message format standard, and no pretending to be a Gmail address in the From line.
If you use a reputable sending platform, most of this is handled for you. Your part is usually authentication on your own domain.
What bulk senders need on top
Above 5,000 messages a day, Gmail adds:
- Both SPF and DKIM, not one or the other.
- A DMARC record. A policy of
p=noneis enough to meet the requirement. - Alignment. The domain in your From address must match the domain that passes SPF or DKIM.
- One-click unsubscribe on marketing and subscribed messages, with a visible unsubscribe link in the body. Google asks that unsubscribes are honoured within 48 hours. Transactional mail such as password resets is exempt.
- A spam rate that stays low. Google recommends staying below 0.1% and never reaching 0.3%. Bulk senders above 0.3% lose access to Google's mitigation help until the rate stays under 0.3% for seven consecutive days.
Yahoo's version
Yahoo's Sender Hub reads almost the same:
| Requirement | Gmail (bulk) | Yahoo (bulk) |
|---|---|---|
| Authentication | SPF and DKIM | SPF and DKIM |
| DMARC | Required, p=none accepted | Required, p=none minimum, must pass |
| Unsubscribe | One-click, honoured within 48 hours | One-click, honoured within 2 days |
| Spam rate | Below 0.3%, ideally below 0.1% | Below 0.3% |
| DNS | Valid forward and reverse DNS | Valid forward and reverse DNS |
Meet Gmail's list and you meet Yahoo's.
One-click unsubscribe, done properly
This is the requirement most often marked as done when it is not. A visible unsubscribe link in the body is not one-click unsubscribe. The requirement is a pair of headers, defined in RFC 8058, that let the mailbox provider show its own unsubscribe button.
List-Unsubscribe: <https://example.com/u/9f2c1>, <mailto:[email protected]>
List-Unsubscribe-Post: List-Unsubscribe=One-Click
Four things go wrong in practice:
- The URL only answers GET. Providers send an HTTP
POSTwith the bodyList-Unsubscribe=One-Click. If your endpoint expects a click in a browser, the unsubscribe silently fails. - The link asks the person to log in or confirm. One click means one click. A preference centre behind a login does not satisfy it.
- Only the
mailto:form is present. Keep it if you like, but the HTTPS form with the POST header is what providers use. - The header is added but the visible link is removed. Both are required: the header for the provider, the link in the body for the reader.
Then honour it. Gmail asks for unsubscribes to be processed within 48 hours, Yahoo says two days. Mail sent after that window is the most likely complaint you will ever generate, because the person already told you to stop.
The errors you see when you fail
Rejections are wordier than most bounce messages, and the wording names the rule you broke.
| What you see | What it means |
|---|---|
550 5.7.26 unauthenticated mail not accepted | SPF and DKIM did not both pass, or nothing aligned with your From domain |
421 4.7.32 temporary rejection for authentication | A throttled warning, often the first sign, and it becomes permanent later |
550 5.7.1 mail not accepted for policy reasons | A reputation or policy block rather than an authentication one |
| Delivery to spam with a healthy spam rate | Usually alignment: authentication passes for the platform's domain, not yours |
Most of these are one DNS record away from fixed. The point of checking before a campaign is that a rejected message cannot be resent to the same person with better headers and count as delivered. It is simply gone.
What changed with enforcement
The rules were announced for February 2024 and phased in. In late 2025 Gmail ramped up enforcement: messages that fail the requirements now meet temporary and permanent rejections, not just a trip to the spam folder.
A rejection is worse than a spam placement in one practical way: the message never exists for the recipient, and your sending platform records a failure you have to explain.
Where list quality comes in
Bounces are not on either list of thresholds. They still decide whether you can meet the ones that are.
- Mailing dead and abandoned addresses hits spam traps and old recycled mailboxes, which count heavily against reputation.
- People who never asked for your mail, or forgot they did, complain. Every complaint moves you toward the 0.3% line.
- Yahoo's own guidance tells senders to monitor bounces and remove invalid recipients promptly.
Why your emails go to spam covers how these signals combine. The short version: a clean list is how you keep the spam rate low without guessing.
A compliance checklist
- SPF and DKIM pass for your sending domain, on every tool that sends for it.
- A DMARC record is published, at least
p=none, and passes. - Your From domain aligns with the SPF or DKIM domain.
- Marketing email carries one-click unsubscribe and a visible link, processed within 48 hours.
- Google Postmaster Tools is set up and shows a spam rate below 0.1%.
- Lists are verified before sending, and hard bounces are suppressed automatically.
The authentication items are one-time work. The last two are habits. How to reduce your email bounce rate turns the habit into three moves, and bulk verification handles the list you send to next.
