Do the bulk sender requirements apply if I send fewer than 5,000 emails a day?

The formal threshold does not apply, but the underlying filtering does. Authentication, working unsubscribe links, and a low complaint rate affect delivery at every volume — smaller senders simply fail more quietly. Everything on the list is standard practice for any sender, so there is no benefit to waiting until you cross the line.

What DMARC policy do I need — none, quarantine, or reject?

A published DMARC record is the requirement, and p=none satisfies it. Start there with a reporting address, read the reports until you can account for every legitimate source sending as your domain, then move to quarantine and eventually reject. Going straight to reject is how a team discovers that their invoicing system was sending as the main domain all along.

Does transactional email need a one-click unsubscribe header?

No. The requirement covers marketing and promotional mail. Receipts, password resets, shipping updates, and security alerts are exempt, and adding an unsubscribe to a password reset actively harms the recipient, who can then no longer recover their own account.

How do I check my current spam complaint rate?

Google Postmaster Tools reports it for gmail.com traffic, and your sending platform should report complaints fed back from every provider that offers a feedback loop. Watch the trend rather than the instantaneous value: a rate climbing steadily from 0.05% to 0.15% is a more urgent signal than a single spike from one badly targeted campaign.

My email suddenly started bouncing with 550 errors. What changed?

Most often you crossed the bulk sender threshold and are now being held to requirements you were previously exempt from, or a DNS change broke authentication — a second SPF record added by another tool is the classic case. Check that SPF, DKIM, and DMARC all resolve and align on the From domain before assuming a content or reputation problem.

Deliverability

The bulk sender rules for Gmail, Yahoo, and Microsoft, and what happens when you miss one

Updated 3 September 2026 · 7 min read · SendKernel

If you send 5,000 or more messages a day to any one provider's consumer domains, Gmail, Yahoo, and Microsoft all now require the same three things: SPF and DKIM passing with DMARC aligned on your From domain, a one-click unsubscribe header on marketing mail honoured within two days, and a spam complaint rate below 0.3%. Failing these no longer means landing in the spam folder. It means a rejection at the SMTP conversation — a 550 from Google, a 550 5.7.515 from Microsoft — and the message is never delivered to any folder at all.

The short version

The threshold is 5,000 messages a day to one provider's consumer domains, counted per sending domain. One campaign to a modest list can cross it.
Enforcement moved from filtering to rejection. A non-compliant message is refused, not quietly deprioritized.
Manage complaints to 0.1%, not to the 0.3% ceiling. By the time you can see 0.3% in a report, the damage is done.
One-click unsubscribe applies to marketing mail only. Receipts, password resets, and confirmations are exempt.

Who this applies to

The threshold is 5,000 messages in a day to a single provider's consumer domains — gmail.com for Google, the Yahoo and AOL family for Yahoo, and outlook.com, hotmail.com and live.com for Microsoft. It counts per sending domain, and it is a daily figure rather than a sustained average, so a single announcement to a 20,000-address list puts you over it for that day even if you send nothing for the rest of the month.

Two consequences people miss. First, hitting the threshold once is enough to be treated as a bulk sender; there is no grace period for occasional senders. Second, mail to business domains running Google Workspace or Microsoft 365 is subject to the same filtering infrastructure even where the published thresholds name consumer domains, so building for the rule and then exempting your B2B list is not a strategy that survives contact with the filters.

Requirement one: authentication that aligns

SPF, DKIM, and DMARC are three separate records and all three must be right. The word doing the work is alignment: it is not enough for SPF and DKIM to pass on some domain, they must pass on a domain that matches the one in your visible From address.

1SPF — a TXT record listing who may send for you
Publishes the servers permitted to send mail carrying your domain in the envelope sender. One SPF record per domain, no exceptions; two records is a permanent error rather than a merge, and it is the single most common misconfiguration.
2DKIM — a cryptographic signature on every message
Your provider gives you a public key to publish at a selector, signs each outbound message with the private half, and receiving servers verify the signature. A domain can carry several selectors at once, which is what makes a migration between providers safe: publish the new one and both work while you test.
3DMARC — the policy that ties them to your From address
Tells receivers what to do when neither SPF nor DKIM aligns with the From domain. Start at p=none with a reporting address, read the reports until you can account for every legitimate sender, then tighten to quarantine and eventually reject. Publishing p=reject before you have read the reports is how internal mail from your CRM disappears.

A minimal, valid starting set

; SPF — one record only, listing your sending provider
example.com.        TXT  "v=spf1 include:amazonses.com -all"

; DKIM — the selector and key your provider issues you
sk1._domainkey.example.com.  CNAME  sk1.dkim.example-provider.com.

; DMARC — start here, read the reports, then tighten
_dmarc.example.com. TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

DNS changes propagate on the record's TTL, so allow up to a few hours before concluding something is broken. Check the published record rather than the one in your notes — the gap between what a team believes is published and what actually resolves is where most of these investigations end.

Requirement two: one-click unsubscribe

Marketing mail must carry the RFC 8058 headers, which let a mailbox client show its own unsubscribe control and post to your endpoint directly. The request must be honoured within two days, and the header must work without a login, a confirmation page, or a survey asking why they are leaving.

Both headers are required — the URL alone is not enough

List-Unsubscribe: <https://example.com/u/8f3c1a>, <mailto:unsub@example.com>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

Two failure modes are worth naming because both are common. Sending only the List-Unsubscribe header without List-Unsubscribe-Post does not qualify as one-click. And building an unsubscribe link that expires means an old newsletter produces a spam complaint instead of an unsubscribe — strictly worse for your reputation than honouring a three-year-old link would have been. Unsubscribe tokens should never expire.

Transactional mail is exempt. Receipts, password resets, shipping notifications, and security alerts do not need an unsubscribe header, and adding one to a password reset is a mistake: the recipient who opts out of it has broken their own account recovery.

Requirement three: complaints below 0.3%

The published ceiling is 0.3% of delivered mail marked as spam. The number to actually manage to is 0.1%, for a reason that is structural rather than cautious: complaint data arrives with a delay, so by the time a report shows 0.3% you have already been sending at that rate for a while and the reputation damage is done. Treat 0.1% as the operating limit and 0.3% as the cliff edge.

Rate	What it means	What to do
Under 0.1%	Healthy	Nothing. This is where a consented list sits.
0.1% to 0.3%	A list or content problem, not yet a delivery one	Stop sending to unengaged segments and check where the addresses came from
Over 0.3%	Rejections start; recovery takes weeks	Stop the campaign, suppress the complainers, and send only to recently engaged recipients until it drops

For comparison, our own platform warns at 0.1% and pauses sending automatically at 0.3% — deliberately tighter than the published ceiling, because a pause is recoverable and a reputation is not.

Bounces are governed separately and matter almost as much. A hard bounce rate above roughly 2% suggests a list that has not been cleaned; above 5% you are being treated as a sender who does not know who their recipients are. Both are usually symptoms of the same cause — addresses acquired somewhere other than an explicit opt-in.

What failure looks like

The change that catches people out is that this is no longer a filtering decision. A non-compliant message is refused during the SMTP conversation, so there is no spam folder to find it in and no way for the recipient to rescue it.

Symptom	Likely cause
550 rejections from Google on a previously fine domain	Missing or misaligned DMARC, or complaint rate over the ceiling
550 5.7.515 from Microsoft consumer domains	Authentication requirements not met for a bulk sender
Delivery fine to business domains, failing to gmail.com	You crossed 5,000 a day and are now held to the bulk sender rules
Sudden drop after a list import	Bounce rate spike from addresses that were never opted in
Gradual decline over weeks	Complaint rate climbing under the ceiling — check the trend, not the current value

A checklist you can run today

Exactly one SPF record on the sending domain, ending in -all or ~all, listing every service that sends as you.
DKIM signing active, with the selector your provider issued resolving in public DNS.
A DMARC record published, with a reporting address someone actually reads.
List-Unsubscribe and List-Unsubscribe-Post on every marketing message, with a link that never expires.
Unsubscribes honoured within two days — immediately, in practice, since there is no reason to wait.
A physical postal address in the footer of commercial mail, as CAN-SPAM has always required.
Complaint rate visible on a dashboard someone looks at weekly, with an alert below 0.1%.
Suppression applied account-wide, so an unsubscribe from one campaign cannot be undone by an import into another list.

Questions people actually ask

Do the bulk sender requirements apply if I send fewer than 5,000 emails a day?: The formal threshold does not apply, but the underlying filtering does. Authentication, working unsubscribe links, and a low complaint rate affect delivery at every volume — smaller senders simply fail more quietly. Everything on the list is standard practice for any sender, so there is no benefit to waiting until you cross the line.
What DMARC policy do I need — none, quarantine, or reject?: A published DMARC record is the requirement, and p=none satisfies it. Start there with a reporting address, read the reports until you can account for every legitimate source sending as your domain, then move to quarantine and eventually reject. Going straight to reject is how a team discovers that their invoicing system was sending as the main domain all along.
Does transactional email need a one-click unsubscribe header?: No. The requirement covers marketing and promotional mail. Receipts, password resets, shipping updates, and security alerts are exempt, and adding an unsubscribe to a password reset actively harms the recipient, who can then no longer recover their own account.
How do I check my current spam complaint rate?: Google Postmaster Tools reports it for gmail.com traffic, and your sending platform should report complaints fed back from every provider that offers a feedback loop. Watch the trend rather than the instantaneous value: a rate climbing steadily from 0.05% to 0.15% is a more urgent signal than a single spike from one badly targeted campaign.
My email suddenly started bouncing with 550 errors. What changed?: Most often you crossed the bulk sender threshold and are now being held to requirements you were previously exempt from, or a DNS change broke authentication — a second SPF record added by another tool is the classic case. Check that SPF, DKIM, and DMARC all resolve and align on the From domain before assuming a content or reputation problem.

Check your domain's records before your next send

Enter a domain and see its live SPF, DKIM, and DMARC status, with the specific problem named rather than a pass or fail. No account needed.

Run the DMARC checker

Where these numbers came from

Sender requirements: Published bulk sender guidelines from Google, Yahoo, and Microsoft, as they stood in September 2026: a 5,000-message daily threshold to consumer domains, required SPF, DKIM and aligned DMARC, RFC 8058 one-click unsubscribe on marketing mail honoured within two days, and a 0.3% spam complaint ceiling.
Rejection codes: Google returns 550 for non-compliant bulk mail; Microsoft returns 550 5.7.515 on its consumer domains. Both are rejections rather than spam-folder placement.