Google and Yahoo bulk sender requirements
The checklist mailbox providers enforce for anyone sending in volume, and how to test each item.
Updated 19 September 2026 · 1 min read
Since 2024 Gmail and Yahoo reject or spam-folder mail from senders who do not meet a shared baseline. Microsoft applies similar rules to Outlook.com. The thresholds for "bulk" (around 5,000 messages a day to Gmail) matter less than the rules, because the rules are simply good practice.
The checklist
| Requirement | How to check |
|---|---|
| SPF and DKIM both pass | Mail facet: SPF result and DKIM keys found for your selectors |
DMARC record published (at least p=none) |
Mail facet: DMARC section |
| The From: domain aligns with SPF or DKIM | Header decoder on a sent message: dmarc=pass with header.from matching |
| Valid forward and reverse DNS on sending IPs | Mail facet MX/SMTP section, or an IP lookup on your sending address: PTR that forward-confirms |
| TLS on the sending connection | Your provider's job; check with the SMTP test on your MX for the receiving side |
One-click unsubscribe (List-Unsubscribe + List-Unsubscribe-Post) for marketing mail |
Header decoder shows both headers if present |
| Spam rate under 0.3% in Google Postmaster Tools | Postmaster Tools, not a DNS check |
| No impersonating Gmail From: addresses | Send from your own domain |
Common failures
- SPF passes but DMARC fails because a third-party sender uses your domain in From: but its own domain in the return path, and DKIM is not set up for your domain at that sender. Fix: add the sender's DKIM (their CNAME records) so DKIM aligns.
- DKIM with a 1024-bit key: still accepted, but move to 2048-bit when you rotate.
- Forwarding: SPF breaks on forwarded mail; DKIM survives it. Another reason to have both.
Testing a real message
Send yourself a message from the system in question, open it in Gmail, choose Show original, and paste the headers into the Header decoder. The Authentication section shows exactly what Gmail decided.
Check your own domain