Gmail, Yahoo and Microsoft bulk sender rules: what cold emailers must do in 2026

Most cold emailers read "5,000 a day" and decide the rules aren't for them. That's a mistake. Gmail counts every message sent from the same primary domain. Twenty inboxes on one domain at 40 sends a day each come to 800 a day, and that number grows quickly once you add clients and follow-ups. The authentication basics also apply to everyone, not just bulk senders.

Here's what each mailbox provider actually publishes, where the sources disagree, and what to do about it.

Who counts as a bulk sender?

Gmail: A bulk sender is "any email sender that sends close to 5,000 messages or more to personal Gmail accounts" in 24 hours. Messages from the same primary domain count together. Senders that hit the threshold even once "are permanently considered bulk senders" (Google sender guidelines FAQ).

Yahoo: Defines a bulk sender only as one "sending a significant volume of mail" and gives no number (Yahoo Sender Hub FAQ).

Microsoft: The rules apply to "domains sending over 5,000 emails per day" to Outlook.com, the consumer service that covers hotmail.com, live.com and outlook.com addresses (Microsoft Tech Community).

Note that Gmail measures per primary domain. Spreading volume across subdomains of one root domain doesn't reset the count. That's one more reason cold email runs on several separate root domains. We cover the math in how many inboxes you need.

Rules that apply to every sender, at any volume

According to Google's email sender guidelines, every sender to personal Gmail accounts must:

• Set up SPF or DKIM for the sending domain.
• Have valid forward and reverse DNS (PTR) for sending IPs.
• "Use a TLS connection for transmitting email."
• "Keep spam rates reported in Postmaster Tools below 0.3%."
• Format messages to RFC 5322 and not impersonate Gmail From headers.

Yahoo's best practices are close to the same list: SPF or DKIM at minimum, spam rate below 0.3%, valid forward and reverse DNS, and compliance with RFC 5321 and 5322. Yahoo's page doesn't mention TLS.

If you send from Google Workspace or Microsoft 365 inboxes, the provider handles PTR and TLS. SPF, DKIM and DMARC are your job, because they live in your DNS.

Rules for bulk senders: authentication and alignment

At bulk volume, "or" becomes "and."

• Gmail: SPF, DKIM and DMARC are all required. "Your DMARC enforcement policy can be set to none." For direct mail, "the domain in the sender's 'From:' header must be aligned with either the SPF domain or the DKIM domain" (Google).
• Yahoo: "Implement both SPF & DKIM," publish a DMARC policy of at least p=none, and DMARC must pass. "Relaxed alignment is acceptable" (Yahoo).
• Microsoft: SPF must pass, DKIM must pass, and DMARC must be "at least p=none and align with either SPF or DKIM (preferably both)" (Microsoft).

Alignment means the domain your prospect sees in the From line matches the domain that passed SPF or DKIM. If you send as alex@trygrowthco.com but DKIM signs as your sending platform's domain, DMARC fails even though DKIM "passed." The setup is in our SPF, DKIM and DMARC guide.

Spam complaint rate: 0.1% is the target, 0.3% is the line

Google says to keep your user-reported spam rate below 0.10% and to avoid ever reaching 0.30%. Bulk senders at 0.3% or higher are "ineligible for mitigation," so support won't help you until you're back under. Spam rate is "calculated daily" and shown in Postmaster Tools (Google FAQ).

Yahoo uses the same 0.3% ceiling and calculates it "based on mail delivered to the inbox" (Yahoo). Microsoft publishes no number for consumer Outlook.

For cold email, 0.1% is about one complaint per 1,000 delivered emails. One badly targeted list can blow through that in a day. A rule of thumb: if a segment draws more than one or two "this is spam" replies per few hundred sends, stop it before Gmail does.

One-click unsubscribe and cold outreach

The headline rule from RFC 8058 is two headers:

List-Unsubscribe: <https://example.com/u/abc123>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

What the providers say:

• Gmail: "Marketing messages and subscribed messages must support one-click unsubscribe" and include a visible unsubscribe link in the body. Transactional mail is exempt (Google, FAQ).
• Yahoo: One-click is required "for marketing and subscribed messages," the RFC 8058 POST method is "highly recommended," and you must "honor unsubscribes within 2 days" (Yahoo).
• Microsoft: Lists "functional unsubscribe links" as a recommended hygiene practice, not a hard requirement (Microsoft).

None of the three define where cold outreach fits. A one-to-one sales email isn't "subscribed," but it's commercial. Google also tells senders: "Don't send messages to people who didn't sign up to get messages from you." Our view: don't look for a loophole. A clean opt-out costs you nothing and stops an annoyed prospect from hitting "Report spam," which costs you a lot. In the US, CAN-SPAM also requires a working opt-out for commercial email, a physical postal address and opt-out processing within 10 business days, and "makes no exception for business-to-business email."

What happens to mail that breaks the rules?

Gmail: "Starting in November 2025, Gmail is ramping up its enforcement on non-compliant traffic. Messages that fail to meet the email sender requirements will experience disruptions, including temporary and permanent rejections" (Google FAQ). The guidelines page also warns that unauthenticated mail may be "rejected with a 5.7.26 error." Industry write-ups describe this as 4xx deferrals followed by 5xx rejections (Red Sift, Spam Resource).

Yahoo: Non-compliant mail "may be sent to the spam folder or rejected," and Yahoo "may defer mail from domains with a high complaint rate" (Yahoo FAQ).

Microsoft: This is where the sources conflict. The original April 2, 2025 announcement said non-compliant mail would go to Junk first. An April 29 update to the same post reversed that: messages that fail the requirements are rejected with 550; 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level, starting May 5, 2025. The post also says adding a sender to Safe Senders "won't be honored" as a bypass (Microsoft Tech Community). But Microsoft's own Outlook.com postmaster page still says non-compliant messages "will go to the junk folder" and that rejection comes "shortly." Third-party trackers also differ on when rejections actually began. Plan for rejection. If you're compliant, it doesn't matter which page is current.

Side-by-side: Gmail vs Yahoo vs Microsoft

What cold emailers should actually do

1. Send from secondary domains, never your main brand domain.
2. Publish one SPF record, 2048-bit DKIM and DMARC at p=none with reporting on every sending domain. Check alignment.
3. Put a one-click List-Unsubscribe header and a plain-language opt-out on every email, and honor opt-outs within two days.
4. Keep complaint rates under 0.1%: verify lists, target tightly, and cap volume per inbox.
5. Watch Postmaster Tools for Gmail and test placement at Outlook regularly.

Zylar does the first and last steps for you. It checks SPF, DKIM, DMARC, your tracking domain and MX the moment a domain is connected and gives you the exact record to paste. It also runs placement tests at Gmail and Outlook for each domain. The full checklist is in the cold email infrastructure checklist, and more is on our deliverability page.

Free SPF / DKIM / DMARC checkerCheck any domain in seconds. No signup.Check now

FAQ

Do the 5,000-a-day rules apply if I send cold email from many small inboxes?

Gmail counts all messages from the same primary domain toward the 5,000 threshold, not per inbox. Once you cross it, even once, Google treats you as a bulk sender permanently. Many inboxes on one root domain can add up faster than you expect.

Is DMARC p=none really enough?

Yes, for compliance. Gmail, Yahoo and Microsoft all accept p=none as long as DMARC passes with alignment. Moving to quarantine later protects your domain from spoofing, but no provider requires it today.

Does one-click unsubscribe apply to cold email?

The providers write the rule for "marketing and subscribed messages" and don't address one-to-one cold outreach directly. Cold email is commercial and unsolicited, so the safe reading is to include a one-click List-Unsubscribe header and a visible opt-out. It also lowers spam complaints.

What does the 550 5.7.515 error mean?

It's Microsoft's rejection for high-volume mail to Outlook.com, Hotmail and Live that doesn't meet its SPF, DKIM and DMARC requirements. Fix the failing record, confirm alignment, and resend.

What spam rate should cold emailers aim for?

Under 0.1% of delivered mail, which is Google's recommended target. At 0.3% you are out of compliance with Gmail and Yahoo, and Google won't offer mitigation until you're back under it.