Guides · Updated October 26, 2026 · Not legal advice; provider rules change, so check the linked sources.

Google and Yahoo bulk-sender rules: what small businesses need to do

Since February 2024, Gmail and Yahoo Mail have required senders to authenticate their email and keep spam complaints low. Mail that doesn't meet the rules can be rejected or sent to spam. The rules depend on how much you send. Even if you're small, you have to meet the baseline that applies to everyone.

Rules for every sender

Google's Email sender guidelines require anyone sending to personal Gmail accounts to:

• Set up SPF or DKIM for your sending domain.
• Have valid forward and reverse DNS (PTR) records for your sending servers. Your email provider usually handles this.
• Send over a TLS connection.
• Keep the spam rate reported in Postmaster Tools below 0.3%. Google recommends staying under 0.1%.
• Format messages to the Internet Message Format standard (RFC 5322), and don't impersonate Gmail From: headers.

Yahoo's Sender Best Practices set out the same basics: authenticate with SPF and DKIM, have valid DNS, and keep complaint rates low.

Extra rules for bulk senders

Google defines a bulk sender as one that sends close to 5,000 or more messages a day to personal Gmail accounts. Once you hit that level, you're treated as a bulk sender from then on. Bulk senders must:

• Set up both SPF and DKIM.
• Publish a DMARC record. The policy can be p=none.
• Align the domain in the visible From: address with the SPF or DKIM domain (DMARC alignment).
• For marketing and subscribed messages, support one-click unsubscribe (RFC 8058, the List-Unsubscribe and List-Unsubscribe-Post headers), show a visible unsubscribe link in the message, and honor unsubscribes within 2 days.

Yahoo applies matching requirements to bulk senders, including a DMARC record and easy unsubscribe. See its sender FAQs.

Why this matters if you're small

Most small businesses never send 5,000 messages a day. But the all-senders rules still apply. In practice, a domain with SPF, DKIM and DMARC set up properly is also harder for criminals to spoof. Newsletters, invoices and booking confirmations often go out through several services, such as your mailbox provider, a newsletter tool and a booking or ecommerce platform. Each one has to be authorized in SPF and/or sign with DKIM for your domain.

A short checklist

1. List every service that sends email using your domain.
2. Make sure you have exactly one SPF record covering them (RFC 7208).
3. Turn on DKIM signing in each service (RFC 6376).
4. Publish a DMARC record, starting at p=none with reporting (see DMARC basics).
5. Add one-click unsubscribe to marketing mail. Most newsletter tools do this for you.
6. Check the result (see how to check SPF, DKIM and DMARC).