Google and Yahoo Bulk Sender Rules for Cold Email
Since February 2024, Gmail and Yahoo have required senders of large volumes of mail to authenticate with SPF, DKIM and DMARC, offer one-click unsubscribe on marketing and subscribed messages, and keep spam complaints low. Google treats about 5,000 messages a day to personal Gmail accounts as bulk, but the spam-rate and authentication expectations apply more widely.
For cold email teams, the rule that bites most isn't volume. It's the complaint rate: if enough recipients click "report spam," your mail starts landing in junk for everyone on that domain. Confirm the current wording on Google's and Yahoo's sender guidelines, since both providers update them.
Vendors Covered in this Article
Disclosure: We may earn a commission if you buy through some links on this page. It doesn't change what we recommend.
Do small cold email teams need to care about these rules?
Yes, for two reasons. First, the bulk threshold is counted per sending domain across all your tools, so a sales team using a sequencer, a CRM and a marketing platform can add up faster than expected. Second, Google's baseline expectations (valid authentication, a low spam rate, properly formatted messages) apply to every sender, not only the large ones.
Other mailbox providers have moved in the same direction, so treat the Gmail and Yahoo rules as the floor for all your outbound rather than a Gmail-only exception.
What should you set up before you send anything?
Work through this list in order:
- Send cold email from a separate domain or subdomain, not your primary company domain, so a reputation problem doesn't hit your invoices and customer replies.
- Publish an SPF record that includes every tool sending on that domain's behalf.
- Turn on DKIM signing in each sending tool, using a key published in your DNS.
- Publish a DMARC record. Start with a monitoring policy and reporting address, then tighten it as you confirm all legitimate senders pass.
- Make sure the visible From domain aligns with the domain that passes SPF or DKIM.
- Add a one-click unsubscribe header and honor unsubscribes quickly (Google's guidance is within two days).
- Register the domain in Google Postmaster Tools so you can see reputation and spam-rate data.
Your sequencing tool may handle some of these. Instantly and lemlist both offer sending setup and unsubscribe options, but confirm in the settings which headers are actually attached to your messages rather than assuming.
How is the spam rate measured, and what do you do when it climbs?
The spam rate is the share of messages delivered to the inbox that recipients report as spam, and you'll see it in Postmaster Tools once you have enough volume. Google's guidance is to keep it below one-tenth of one percent and never let it reach three-tenths.
Say you send 2,000 messages to Gmail recipients in a week and six people mark them as spam, which works out to 0.30%, the level you're told never to reach. Nothing about that is unusual for a badly targeted list.
If the rate rises, pause the campaign and look at three things in order: who you targeted (are they a fit for the offer?), what you said (does the first line explain why you're writing?), and how easy it is to opt out. A visible, working unsubscribe link reduces spam reports because unhappy recipients have somewhere else to click.
For context, one large platform dataset puts the average cold email reply rate at 3.43 percent1. Most people you email won't answer, and a small fraction reporting spam is enough to matter, so precision beats volume.
Does one-click unsubscribe fit with cold outreach?
The requirement is written for marketing and subscribed mail, and cold outreach is marketing in nature, so the safe approach is to include the header and honor every opt-out. Treat an unsubscribe as permanent for that address, and share suppression across every tool you use. Otherwise a contact opts out in one sequence and receives mail from another.
Deliverability tools such as Mailreach can monitor inbox placement and warm-up activity, which helps you spot a problem before Postmaster Tools shows it. They don't replace authentication or good targeting.
Which mistakes cause most bulk sender failures?
Watch for these:
- Authenticating the sending tool's domain but not the domain shown in the From line, so alignment fails.
- Adding a new tool without updating the SPF record, which breaks authentication for everything.
- Sending from the primary company domain and putting customer email at risk.
- Ignoring bounces, which signal bad list quality and hurt reputation.
- Keeping unsubscribe lists in separate tools that don't sync.
- Ramping volume in a jump instead of a steady climb, especially on a new domain.
The deliverability checklist walks through DNS records in detail, and the Google Workspace and Yahoo compliance guide covers the admin side. When you're ready to plan sequences, see follow-up timing.
What Good Looks Like
Every domain that sends outbound passes SPF, DKIM and DMARC alignment, offers a working one-click unsubscribe, and stays well under Google's spam-rate line.
Building The Capability (5-Stage Skill Ladder)
How to Get Started
Disclosure: We may earn a commission if you buy through some links on this page. It doesn't change what we recommend.
Fits when you're running multiple sending inboxes and want setup and unsubscribe handling in one sequencer.
Fits when personalization matters more than sheer volume and you want sequencing with sending controls.
Fits when you want inbox placement and warm-up monitoring to catch reputation problems early.
Frequently Asked Questions
What counts as a bulk sender for Gmail?
Google describes a bulk sender as one that sends about 5,000 or more messages in a day to personal Gmail addresses. The count covers your whole primary domain, so add up every tool that sends on its behalf.
Do the rules apply if I send cold emails one at a time?
Baseline rules such as authentication and a low spam rate apply to all senders. Sending one at a time doesn't exempt you if the volume across your domain crosses the bulk threshold or recipients report your messages.
Is DMARC required if I only send a few hundred emails a day?
Google requires DMARC for bulk senders, but setting it up anyway is sensible. It protects your domain from spoofing and gives you reports on who is sending as you, which helps as your volume grows.
Should I use a separate domain for cold email?
Usually yes. A separate domain or subdomain keeps a reputation problem away from your main domain, which carries customer and invoice email. Authenticate it fully and ramp volume gradually.
Sources
Where we quote a benchmark, we show its source. Other figures in this guide are estimates or general guidance, so check them against your own numbers.
- Average cold email reply rate. Woodpecker Cold Email Statistics (20M+ cold emails sent via platform), 2026.
Related Guides
Cold Email Deliverability Checklist: SPF, DKIM and DMARC
A checklist for setting up and verifying SPF, DKIM and DMARC for cold email, with the common DNS mistakes that break authentication.
Google and Yahoo Bulk Sender Rules, Step by Step
The exact SPF, DKIM, DMARC and one-click unsubscribe steps that keep outbound sales email compliant with Google and Yahoo's bulk sender rules.
Cold Email Follow-Up Timing: A Sequence You Can Copy
How many follow-ups to send, how many days to wait between them, what each email should say, and when to stop a cold email sequence.
Building a B2B Prospect List Without ZoomInfo
How to build a targeted B2B prospect list without ZoomInfo: define the filter, pick sources, verify contacts and size the list from your win rate.
A Churn Reduction Playbook for Small B2B SaaS Companies
A practical order of operations for reducing B2B SaaS churn: diagnose it, fix onboarding and failed payments, build save plays and measure retention.
Designing Partner Program Tiers: Criteria, Benefits and Rules
How to structure partner program tiers: entry criteria, benefits and obligations for each level, margin math and rules for moving partners up or down.