What the big three require, and from when
What the three largest inbox providers require from bulk senders — source by source.
7 min read
Since February 2024, Gmail and Yahoo have applied the same rules to anyone sending in volume; Microsoft joined them on 5 May 2025. These are not recommendations: a non-compliant message goes to the spam folder first, then gets rejected with an error code. Here is the detail, provider by provider — and what to keep from it when you send less than the threshold.
Gmail, from 5,000 messages a day
The threshold counts per day, to Gmail addresses, since 1 February 2024. Below it, SPF or DKIM is enough; above it, four requirements, and they add up.
SPF, DKIM and DMARC, all three. That is the only difference the threshold makes, and the easiest one to settle: six lines at whoever manages your domain name.
A DKIM key of at least 1,024 bits, and one-click unsubscribe on marketing and subscription messages — the List-Unsubscribe and List-Unsubscribe-Post: List-Unsubscribe=One-Click headers.
A complaint rate below 0.3%, measured in Postmaster Tools, with an explicit recommendation to stay below 0.10%. Three people per thousand hitting « report spam » are enough to tip a send.
Yahoo: same requirements, no published threshold
Yahoo applied the same rules in the same window, but frames them by message type rather than by volume: no daily threshold is published. A newsletter is covered whatever the number of subscribers.
SPF and DKIM, plus a valid DMARC policy, p=none at minimum. A working unsubscribe header, one-click for marketing and subscriptions. And the same complaint ceiling, 0.3%.
In practice, a sender who satisfies Gmail satisfies Yahoo. The reverse is not true: Gmail asks for DMARC, Yahoo settles for SPF and DKIM with a valid policy.
Microsoft, since 5 May 2025
Microsoft joined for domains sending 5,000 messages or more a day to consumer Outlook, Hotmail and Live mailboxes.
All three records are required, DMARC at `p=none` minimum, aligned with SPF or DKIM. Non-compliant messages go to junk first, then get rejected with 550 5.7.515 Access denied, sending domain does not meet the required authentication level.
One surprise worth knowing in advance: according to Microsoft, a domain that has crossed the threshold stays treated as a bulk sender even if its daily volume drops back below it.
What it changes, in practice
Below 5,000 emails a day, nothing is formally required beyond SPF or DKIM. But all three providers judge every sender on the same signals: authentication, complaints, how easy it is to leave. Behaving like a bulk sender costs nothing, and covers you the day your list grows.
Above it, four non-negotiables: the three records in your domain; one-click unsubscribe, honoured quickly — a link that does not work is worse than no link; watching your complaint rate; and a maintained list, because there is no other way to steer that rate.
What these rules do not say
They say nothing about forbidden words, image-to-text ratio, or message length. The debate about « words that trigger the filters » has no support in the official documents of any of the three.
Where these rules come from
Everything on this page comes from these four pages, published by the providers themselves. None is a blog post, and no figure was rounded on the way.
- Google's sender guidelines — Gmail's four requirements, and the 5,000 threshold
- Yahoo Sender Best Practices — the same rules, framed by message type
- Microsoft's announcement (May 2025) — the threshold, the error code, and the once-crossed rule
- Google Postmaster Tools — where your complaint rate can be read, free
Words from this guide
One-click unsubscribe, set without thinking about it
Plumail sets the unsubscribe headers on every campaign and walks you through your three records before the first send. 3,000 emails a month, no credit card.