Google and Yahoo Sender Requirements: What Cold Emailers Must Know

Since February 2024, Gmail and Yahoo have published a shared set of sender requirements. Most cold emailers read the headline — "this only applies to bulk senders sending 5,000+ messages a day" — decided it didn't apply to them, and moved on. That was a mistake. The requirements are not a separate rulebook for newsletter companies. They are a written description of the signals both providers already use to decide whether your mail reaches an inbox, and Microsoft has since pushed its consumer Outlook domains in the same direction.

If you send cold email, you are being measured against these rules whether or not you cross the volume threshold. The difference is that big senders get bounced with a clear error code, and small senders just quietly stop getting replies.

Here's each requirement, what it actually means, and the specific thing you need to do about it.

The requirements at a glance

1. Authentication: SPF and DKIM, then alignment

The baseline is that every message must pass SPF or DKIM. The bulk-sender bar is both, plus DMARC alignment. There is no reason to aim at the lower bar — SPF and DKIM together take less than half an hour to configure and cost nothing.

Alignment is the part people miss. Passing SPF and passing DMARC are different things. If your From address is hello@yourcompany-mail.com but the envelope sender and DKIM signing domain belong to your ESP, SPF and DKIM can both return "pass" while DMARC still fails, because neither authenticated domain matches the one your recipient sees.

Action: publish an SPF record that includes your actual sending platform, publish a DKIM key with a 2048-bit selector, and then send a test message to a mailbox you control and read the Authentication-Results header. You want to see `dkim=pass header.d=yourdomain.com` where the d= value is your own domain, not your provider's. The full walkthrough is in SPF, DKIM, and DMARC for Cold Email.

One practical trap: SPF allows a maximum of 10 DNS lookups. Stacking three or four `include:` statements from different vendors on the same cold-email domain will silently break authentication with a permerror. Keep cold-email domains lean — one sending path, one include.

2. DMARC: publish it, even at p=none

Google and Yahoo require bulk senders to have a DMARC policy. The minimum acceptable policy is `p=none`, which requests no enforcement at all. That sounds pointless, but the record itself is the checkbox, and the aggregate reports it generates are how you find out that your invoicing tool has been sending unauthenticated mail from your domain for six months.

Action: add a TXT record at `_dmarc.yourdomain.com` with something like `v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com;`. Read reports for two to four weeks, confirm every legitimate source is aligned, then move to `p=quarantine`. On a dedicated cold-email domain where you control every sending path, you can usually go to quarantine within a month.

3. One-click unsubscribe is a header, not a link

This is the requirement most cold-email tools get half right. Google's rule for bulk commercial mail is that the message must carry two headers: `List-Unsubscribe` with an HTTPS URL, and `List-Unsubscribe-Post: List-Unsubscribe=One-Click`. Together they let Gmail render the native "Unsubscribe" button next to your sender name and POST to your endpoint without the recipient ever opening the message. A plain text link at the bottom of your email does not satisfy it. A `mailto:` unsubscribe alone does not satisfy it either.

The second half of the rule is a two-day processing deadline. Once someone unsubscribes, you have 48 hours to stop sending — in practice, that means automated suppression across every campaign and every mailbox, not a note in a spreadsheet.

Action: turn on List-Unsubscribe headers in your sending platform and verify them. Send yourself a campaign email, open it in Gmail, and check that the native unsubscribe control appears in the header row. If it doesn't, the headers aren't being written. Then click it and confirm the lead actually lands in your suppression list.

Is this legally required for one-to-one cold email? That's a separate question with a nuanced answer, covered in Does Cold Email Require an Unsubscribe Link?. But the deliverability answer is simple: giving people a frictionless exit is the cheapest way to keep them from hitting the spam button instead, and the spam button is what actually kills your domain.

4. The 0.3% spam rate — and why it's brutal at low volume

Google asks senders to stay under 0.3% reported spam and says to aim below 0.1%. Yahoo uses the same threshold. Run the arithmetic for cold email and the number gets uncomfortable fast.

At 0.3%, you get three complaints per thousand delivered messages. If you send 40 emails a day from each of five mailboxes, that's 200 a day, roughly 4,000 a month. Your entire monthly complaint budget is twelve people — and one bad day with a poorly targeted segment can spend half of it.

There's a measurement problem too. Google Postmaster Tools only displays spam-rate data once your domain sends enough volume, which most cold-email domains sending 50 messages a day per mailbox will never reach. So you get the penalty for crossing the threshold without the dashboard that tells you where you are.

Action: since you can't measure complaints directly, control the inputs. Verify every address before sending. Cut any segment where the relevance of your offer is a guess. Cap daily volume per mailbox rather than pushing it. And watch the proxy signals you can see — a reply rate that collapses, or seed-mailbox placement sliding from Primary to Spam, usually shows up before the domain is fully burned. Inbox placement testing is the closest substitute for Postmaster Tools at cold-email volumes.

5. The infrastructure requirements you probably already meet

• Valid forward and reverse DNS: your sending IP needs a PTR record that resolves back to a hostname pointing at the same IP. If you send through Gmail, Microsoft 365, or a reputable SMTP provider, this is handled. If you stood up your own relay on a VPS, check it — most cloud IPs ship with generic or missing rDNS.
• TLS in transit: connect on 587 with STARTTLS or 465 with implicit TLS. Any modern client does this by default; only hand-rolled scripts get it wrong.
• Valid RFC 5322 formatting: a real From header with a real domain, a matching envelope sender, and a message that isn't malformed.
• No Gmail impersonation: never set a From address at gmail.com on mail sent from your own infrastructure. Gmail enforces DMARC on its own domain and will reject it.
• ARC for forwarders: only relevant if you forward or relay other people's mail. Most cold senders can skip it.

The 5,000/day threshold is not the safety line you think it is

Two things make the bulk-sender exemption less useful than it sounds. First, Google counts per sending domain, not per mailbox — twelve mailboxes on one domain add up. Second, and more importantly, nothing in the spam-rate rule is volume-gated. The 0.3% ceiling and the authentication basics apply to everyone. Filters don't switch off for small senders; they just have less data, which makes them lean harder on domain age, authentication, and early complaint signals.

Treat the bulk requirements as the floor for every cold-email domain you run, from day one. It costs you nothing extra and it removes an entire category of failure from the diagnosis list when replies dry up.

A 15-minute compliance audit

• Send a message from each sending domain to a Gmail address you control and view the original. Confirm SPF pass, DKIM pass with your domain in d=, and DMARC pass.
• Query your DMARC record. If there isn't one, add p=none today.
• Count your SPF DNS lookups. Over 10 means SPF is failing right now.
• Open a campaign email in Gmail and look for the native unsubscribe control in the header line. Click it and verify suppression fires.
• Run a draft through a spam-score check and a seed-mailbox placement test before your next launch.
• Check that your suppression list is shared across every campaign and mailbox, not scoped to one sequence.

Where Sendvanta fits

Most of these requirements are things a sending platform should handle for you instead of leaving in your DNS to-do list. Sendvanta writes one-click unsubscribe headers and enforces suppression across the whole workspace by default, checks mailbox, domain, DKIM, and IP health continuously, and slows or pauses sending automatically when risk thresholds are crossed rather than after the damage is done. Drafts get SpamAssassin-scored before send, and seed-mailbox placement tests give you the inbox visibility Postmaster Tools won't at cold-email volumes. You connect your own Gmail, Microsoft 365, or SMTP mailboxes — nothing routes through shared IPs, so your reputation stays yours. You can see the full feature set at /features, and the free plan covers 1,000 active leads and 3,000 emails a month at $0 with no card.

Comparison and requirement details reflect Google and Yahoo's published bulk sender guidelines as of February 2026; verify current thresholds with each provider's sender documentation before relying on them for compliance decisions.