Requirements for bulk email senders

Google and Yahoo enforce a set of requirements for bulk email senders. Compliance affects whether your messages reach the inbox, land in spam, or get blocked outright. The requirements have been in effect since February 2024.

What counts as a bulk sender

A bulk sender is any sender that sends 5,000 or more messages per day to personal accounts with accounts from gmail.com, yahoo.com, googlemail.com, and similar consumer mailbox addresses (Workspace and other business addresses are not counted). Messages from the same primary domain count toward the daily threshold together.

Crossing the threshold triggers the bulk-sender requirements for your sending. Recipient providers evaluate your sending pattern continuously, so reducing volume after a high-volume day doesn’t automatically exempt you from the requirements.

Compliance checklist

Bulk senders need to:

Authenticate mail with SPF, DKIM, and DMARC
Align the From: header domain with the SPF or DKIM signing domain
Have valid forward and reverse DNS (PTR) records for sending IPs
Use TLS encryption for connections
Implement one-click unsubscribe on promotional messages and honor opt-outs within 2 days
Keep spam rate below 0.3% (ideally below 0.1%)

The rest of this article expands on each requirement.

Authentication: SPF, DKIM, DMARC

All three are required for bulk senders.

SPF (Sender Policy Framework) specifies which servers are authorized to send mail for your domain. Published as a TXT record on your domain.

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each message that recipients verify against a public key on your domain. The signing domain (the d= tag in the DKIM header) accumulates its own sender reputation.

DMARC (Domain-based Message Authentication, Reporting and Conformance) tells recipients what to do with messages that fail SPF or DKIM checks. Publish a DMARC record at _dmarc.your-domain.com. Google and Yahoo require at least a p=none policy (monitoring mode); moving to p=quarantine or p=reject is recommended once you’ve validated your authentication is set up correctly.

For Close-specific setup steps, see Email Deliverability.

DMARC alignment

DMARC also requires that the domain in your From: header aligns with either the SPF authorization domain or the DKIM signing domain. Misaligned messages fail DMARC even when SPF and DKIM individually pass.

If you send from you@yourdomain.com, the SPF record or DKIM signature must reference yourdomain.com (a subdomain is acceptable under relaxed alignment).

Forward and reverse DNS (PTR) records

Both Google and Yahoo require valid forward and reverse DNS records for the IP addresses you send from. PTR (reverse DNS) records map your sending IP back to a hostname; the corresponding A record maps that hostname back to the IP. Both directions must resolve correctly.

If you send through a third-party email service (Mailgun, SendGrid, Google Workspace), the service handles this. If you self-host SMTP, confirm your IPs have proper PTR configuration with your hosting provider.

TLS encryption

Bulk senders must transmit messages over TLS-encrypted connections. Almost all modern email infrastructure supports TLS by default. If you send from a self-hosted SMTP server or a legacy provider, confirm TLS is enabled.

One-click unsubscribe

Required for marketing and promotional messages. Transactional messages (password resets, order confirmations, form submission confirmations) are exempt.

The technical implementation requires the List-Unsubscribe-Post: List-Unsubscribe=One-Click header per RFC 8058, along with a server endpoint that processes the POST without further user action. You can include additional unsubscribe links in the message body, but for deliverability mitigation requests, Google requires the RFC 8058-compliant header.

Yahoo also requires that you honor unsubscribes within 2 days of receipt.

Close has unsubscribe handling built in. See Managing unsubscribe requests.

Spam rate

Spam rate is the ratio of messages your recipients report as spam to total messages delivered. It’s measured per recipient mailbox provider.

Below 0.1% is healthy.
Below 0.3% is required. Google considers mitigation requests only when spam rate has been below 0.3% for 7 consecutive days.
Above 0.3% sustained causes deliverability problems.

Monitor your spam rate via Google Postmaster Tools for Gmail and the Yahoo Complaint Feedback Loop for Yahoo. Both require domain ownership verification.

Transactional vs. promotional

The one-click unsubscribe requirement applies only to promotional messages. Google and Yahoo don’t categorize your messages for you - you decide what’s transactional. Common transactional categories:

Password resets and account verification
Receipt or order confirmation
Form submission acknowledgement
Appointment reminders and meeting confirmations
Account activity alerts (login from a new device, etc)

Misclassifying promotional mail as transactional doesn’t exempt it. If recipients start reporting it as spam, your spam rate rises regardless of how you labeled the message.

Best practices

Segregate sending by purpose

Don’t send bulk or marketing email from the same IPs you use for transactional or user-facing email. Each IP and DKIM domain accumulates its own reputation; mixing high-volume marketing with critical transactional mail risks the transactional mail’s deliverability if your marketing volume spikes complaints.

Warm up new sending infrastructure

New IPs and domains have no reputation. Ramp volume over 2 to 4 weeks rather than starting at full volume.

Use automated senders for high-volume Workflows

Rotating sender identities spreads per-sender volume and keeps any single inbox’s reputation from being the bottleneck.