Gmail and Yahoo each publish a page of requirements for people who send them bulk mail, and both say the same thing about consequences: mail that does not meet them "might not be delivered as expected, or might be marked as spam". The lists overlap heavily but not exactly, so this page sets out what each provider's own page says. For the steps in Bird, the Gmail and Yahoo requirements guide covers what to do with your domain.
Who counts as a bulk sender?
Around five thousand messages a day to that provider. Google states this in three of its own pages and phrases it differently in each:
| Google page | Its wording |
|---|---|
| Sender guidelines | "more than 5,000 messages per day to Gmail accounts" |
| Postmaster Tools dashboards | "any sender that sends about 5,000 messages or more to Gmail accounts in a 24-hour period" |
| Sender guidelines FAQ | "any email sender that sends close to 5,000 messages or more to personal Gmail accounts within a 24-hour period" |
Two differences are worth more than the others. "More than 5,000" and "close to 5,000" are not the same boundary, and one of them catches you before you reach the number. And the FAQ says personal Gmail accounts, which excludes Workspace mailboxes and so counts a smaller population than the other two phrasings do.
That second one is not even consistent within a single page. On the dashboards page the sentence immediately before the definition scopes the dashboard to senders "that send messages to personal Gmail accounts", and then the definition one sentence later drops the word. So the ambiguity is not just that three pages disagree; one page disagrees with itself.
The FAQ adds one thing the others do not: "Messages sent from the same primary domain count toward the 5,000 limit." So the count is per domain rather than per subdomain or per stream, and splitting a campaign across mail. and news. does not split the total.
If your volume is anywhere near the line, the safe assumption is that you are in scope. Yahoo publishes no number at all, applying its own volume criteria, so the only durable plan is to meet the bulk requirements at any volume.
Note also that the count is per provider. Two hundred thousand messages a day to a corporate audience with few Gmail addresses may leave you outside Google's bulk tier and inside Yahoo's.
What does Google require of every sender?
A short list, regardless of volume, from the sender guidelines:
- Set up SPF or DKIM email authentication for your sending domains.
- Ensure that sending domains or IPs have valid forward and reverse DNS records, also referred to as PTR records.
- Use a TLS connection for transmitting email.
- Keep spam rates reported in Postmaster Tools below 0.3%.
- Format messages according to the Internet Message Format standard, RFC 5322.
- Don’t impersonate Gmail From: headers.
Two of these are infrastructure rather than sender configuration. Reverse DNS belongs to whoever owns the sending IP, and TLS to whoever runs the sending server, so on a managed platform both are already handled.
What does Google add for bulk senders?
Three requirements that are genuinely yours to meet:
- Set up SPF and DKIM email authentication for your domain.
- Set up DMARC email authentication for your sending domain. Your DMARC enforcement policy can be set to none.
- For direct email, the domain in the sender's From: header must be aligned with either the SPF domain or the DKIM domain. This is required to pass DMARC alignment.
- Marketing messages and subscribed messages must support one-click unsubscribe, and include a clearly visible unsubscribe link in the message body.
The complaint ceiling is also restated in the bulk section as "below 0.30%", which is where Google's target of 0.10 percent and its ceiling of 0.30 percent both come from. What is a spam complaint rate covers how the figure is measured, which is narrower than it looks.
The alignment requirement is the one that most often fails on a technically complete setup. Publishing all three records and having all three pass is not sufficient: one of SPF or DKIM has to pass in the name of the domain in your From header. What is DMARC alignment is the mechanism, and a platform-owned bounce address is the usual reason it fails.
Notice too that p=none satisfies the requirement. A monitoring policy is enough for Gmail and Yahoo, even though it is not enough for BIMI.
What does Yahoo require?
The same shape in Yahoo's sender best practices, with its own emphases:
- Implement both SPF & DKIM
- Publish a valid DMARC policy with at least p=none - DMARC must pass
- Ensure the domain in the From: header is aligned with either the SPF domain or the DKIM domain. This is required for DMARC alignment.
- Implement a functioning list-unsubscribe header, which supports one-click unsubscribe for marketing and subscribed messages
- Keep your spam rate below 0.3%
Yahoo adds two things Google's list does not. It asks forwarders to implement ARC, and it treats its Complaint Feedback Loop as part of the deal: "An active CFL is needed for all DKIM domains to make sure you're processing complaints quickly."
Yahoo also names a DKIM key length that Google does not, asking senders to sign "with a minimum 1024-bit key length".
What is the deadline for honouring an unsubscribe?
Two days, and it is checked separately from whether the header exists.
Google's Compliance status dashboard carries a "Honor unsubscribe" entry, and explains what makes it fail:
You might receive this entry if you don't honor the unsubscribe requests within 48 hours.
with a consequence worth reading twice if anything sits in front of your endpoint:
Successful unsubscribe requests count toward your compliance rate whether or not your servers receive it. This means that if services like Cloudflare block these requests and keep them from your servers, you're still responsible if the request isn't processed.
So an unsubscribe endpoint behind a bot filter that challenges the POST is a compliance failure even though nothing in your logs shows a problem. One-click unsubscribe covers the header pair and the endpoint's obligations.
How do I know whether I am compliant?
Google publishes the answer per requirement rather than making you infer it.
The Compliance status dashboard in Postmaster Tools grades each requirement as Compliant, Needs work, or No data found, and it covers SPF and DKIM, DNS records, message formatting, encryption and user-reported spam rate for everyone, plus DMARC, one-click unsubscribe and honour-unsubscribe for bulk senders.
Two caveats come with it. The data is not live, and Google says a change can take "up to 7 days for changes to be reflected in the dashboard". And the dashboard reports on primary domains only, using subdomain data to compute the primary domain's status. What is Google Postmaster Tools covers reading the rest of the dashboards.
Yahoo publishes no equivalent dashboard, so its side is verified by authenticating correctly and watching the feedback loop.