Revenue Strategy & OperationsExplainer3 min readUpdated September 2026

Google and Yahoo Bulk Sender Rules for Cold Email

Since February 2024, Gmail and Yahoo have required senders of large volumes of mail to authenticate with SPF, DKIM and DMARC, offer one-click unsubscribe on marketing and subscribed messages, and keep spam complaints low. Google treats about 5,000 messages a day to personal Gmail accounts as bulk, but the spam-rate and authentication expectations apply more widely.

For cold email teams, the rule that bites most isn't volume. It's the complaint rate: if enough recipients click "report spam," your mail starts landing in junk for everyone on that domain. Confirm the current wording on Google's and Yahoo's sender guidelines, since both providers update them.

Vendors Covered in this Article

Disclosure: We may earn a commission if you buy through some links on this page. It doesn't change what we recommend.

Do small cold email teams need to care about these rules?

Yes, for two reasons. First, the bulk threshold is counted per sending domain across all your tools, so a sales team using a sequencer, a CRM and a marketing platform can add up faster than expected. Second, Google's baseline expectations (valid authentication, a low spam rate, properly formatted messages) apply to every sender, not only the large ones.

Other mailbox providers have moved in the same direction, so treat the Gmail and Yahoo rules as the floor for all your outbound rather than a Gmail-only exception.

What should you set up before you send anything?

Work through this list in order:

  1. Send cold email from a separate domain or subdomain, not your primary company domain, so a reputation problem doesn't hit your invoices and customer replies.
  2. Publish an SPF record that includes every tool sending on that domain's behalf.
  3. Turn on DKIM signing in each sending tool, using a key published in your DNS.
  4. Publish a DMARC record. Start with a monitoring policy and reporting address, then tighten it as you confirm all legitimate senders pass.
  5. Make sure the visible From domain aligns with the domain that passes SPF or DKIM.
  6. Add a one-click unsubscribe header and honor unsubscribes quickly (Google's guidance is within two days).
  7. Register the domain in Google Postmaster Tools so you can see reputation and spam-rate data.

Your sequencing tool may handle some of these. Instantly and lemlist both offer sending setup and unsubscribe options, but confirm in the settings which headers are actually attached to your messages rather than assuming.

How is the spam rate measured, and what do you do when it climbs?

The spam rate is the share of messages delivered to the inbox that recipients report as spam, and you'll see it in Postmaster Tools once you have enough volume. Google's guidance is to keep it below one-tenth of one percent and never let it reach three-tenths.

Say you send 2,000 messages to Gmail recipients in a week and six people mark them as spam, which works out to 0.30%, the level you're told never to reach. Nothing about that is unusual for a badly targeted list.

If the rate rises, pause the campaign and look at three things in order: who you targeted (are they a fit for the offer?), what you said (does the first line explain why you're writing?), and how easy it is to opt out. A visible, working unsubscribe link reduces spam reports because unhappy recipients have somewhere else to click.

For context, one large platform dataset puts the average cold email reply rate at 3.43 percent1. Most people you email won't answer, and a small fraction reporting spam is enough to matter, so precision beats volume.

Does one-click unsubscribe fit with cold outreach?

The requirement is written for marketing and subscribed mail, and cold outreach is marketing in nature, so the safe approach is to include the header and honor every opt-out. Treat an unsubscribe as permanent for that address, and share suppression across every tool you use. Otherwise a contact opts out in one sequence and receives mail from another.

Deliverability tools such as Mailreach can monitor inbox placement and warm-up activity, which helps you spot a problem before Postmaster Tools shows it. They don't replace authentication or good targeting.

Which mistakes cause most bulk sender failures?

Watch for these:

  • Authenticating the sending tool's domain but not the domain shown in the From line, so alignment fails.
  • Adding a new tool without updating the SPF record, which breaks authentication for everything.
  • Sending from the primary company domain and putting customer email at risk.
  • Ignoring bounces, which signal bad list quality and hurt reputation.
  • Keeping unsubscribe lists in separate tools that don't sync.
  • Ramping volume in a jump instead of a steady climb, especially on a new domain.

The deliverability checklist walks through DNS records in detail, and the Google Workspace and Yahoo compliance guide covers the admin side. When you're ready to plan sequences, see follow-up timing.

Executive Capability Standard

What Good Looks Like

Every domain that sends outbound passes SPF, DKIM and DMARC alignment, offers a working one-click unsubscribe, and stays well under Google's spam-rate line.

Building The Capability (5-Stage Skill Ladder)

1. Learn:Read Google's and Yahoo's current sender guidelines and note which requirements apply at your volume.
2. Do Manually:Publish SPF, DKIM and DMARC for your sending domain and send a test to check headers and alignment.
3. Delegate:Assign one person to watch Postmaster Tools weekly and to own the suppression list.
4. Automate:Sync unsubscribes and bounces across every sending tool and alert when spam rate or bounce rate crosses your limit.
5. Buy:Add a deliverability monitoring or warm-up tool once you're running several inboxes at steady volume.

How to Get Started

Disclosure: We may earn a commission if you buy through some links on this page. It doesn't change what we recommend.

Frequently Asked Questions

What counts as a bulk sender for Gmail?

Google describes a bulk sender as one that sends about 5,000 or more messages in a day to personal Gmail addresses. The count covers your whole primary domain, so add up every tool that sends on its behalf.

Do the rules apply if I send cold emails one at a time?

Baseline rules such as authentication and a low spam rate apply to all senders. Sending one at a time doesn't exempt you if the volume across your domain crosses the bulk threshold or recipients report your messages.

Is DMARC required if I only send a few hundred emails a day?

Google requires DMARC for bulk senders, but setting it up anyway is sensible. It protects your domain from spoofing and gives you reports on who is sending as you, which helps as your volume grows.

Should I use a separate domain for cold email?

Usually yes. A separate domain or subdomain keeps a reputation problem away from your main domain, which carries customer and invoice email. Authenticate it fully and ramp volume gradually.

Sources

Where we quote a benchmark, we show its source. Other figures in this guide are estimates or general guidance, so check them against your own numbers.

  1. Average cold email reply rate. Woodpecker Cold Email Statistics (20M+ cold emails sent via platform), 2026.

Related Guides