Gmail and Yahoo sender requirements: what a small shop must do

What the mailbox providers now require#

Since February 2024, Gmail and Yahoo have enforced written rules for anyone sending them email, with stricter rules for high-volume senders ^S1S4. Microsoft announced comparable rules for Outlook’s consumer addresses in 2025 ^S5. Together these three providers hold a large share of the inboxes a typical online store mails, so the rules decide whether a campaign is delivered, filed as spam or refused.

The rules fall into four groups: prove the mail is really from you (authentication), make leaving easy (unsubscribe), keep complaints low (spam rate), and run a technically sound mail server (DNS, encryption and message format). The sections below take each group in turn, then turn them into a checklist you can work through in an afternoon.

This page covers the providers’ rules. For a plain introduction to deliverability as a whole, start with email deliverability basics.

Who counts as a bulk sender#

Gmail treats you as a bulk sender once you send close to 5,000 messages or more to personal Gmail accounts within 24 hours. Messages from the same primary domain count together, and the status is permanent: sending less afterwards does not remove it ^S2.

Yahoo describes a bulk sender as one sending a significant volume of mail and deliberately publishes no threshold ^S4. Its rules apply to every consumer brand Yahoo Mail hosts, including AOL ^S4. Microsoft’s threshold is 5,000 or more messages to Outlook.com, Hotmail, Live.com and MSN addresses using the same From domain ^S6.

The primary-domain rule matters for shops. Suppose Ninefold, a small knitwear brand, has 9,000 subscribers, half of them on Gmail, and also sends order confirmations from the same domain. A busy Black Friday weekend can push the day’s Gmail total near 5,000, and from then on Ninefold is a bulk sender for good. Because Yahoo sets no number at all, the safest plan is to meet the bulk-sender rules from your first campaign.

Authentication: SPF, DKIM and DMARC#

Gmail asks every sender to publish SPF or DKIM for the sending domain, and bulk senders to publish both ^S1. DKIM keys must be at least 1024 bits for personal Gmail accounts; Google recommends 2048 bits where your DNS provider supports it ^S1. Yahoo sets the same split: SPF or DKIM for everyone, both for bulk senders ^S3.

Bulk senders also need a DMARC record. A policy of p=none is accepted by Gmail, Yahoo and Microsoft, so you can start in monitoring mode ^S1S3S6. What all three insist on is alignment: the domain in the visible From address must match the domain that passed SPF or DKIM. Sending as hello@ninefold.com through a provider that signs only with its own domain passes DKIM but fails DMARC.

Yahoo strongly recommends adding a rua tag to the DMARC record so aggregate reports reach you ^S3. Those reports show which services send in your name, which is useful before you ever tighten the policy. For the record syntax, see SPF, DKIM and DMARC explained and how to set up DMARC.

One-click unsubscribe and the two-day rule#

Bulk senders must support one-click unsubscribe on marketing and subscribed messages and show a clearly visible unsubscribe link in the body ^S1S3. Transactional mail such as order confirmations and password resets is exempt ^S2. Gmail gave senders until June 1, 2024 to add it, and Yahoo began enforcing it the same month ^S2S4.

One-click is defined by RFC 8058. Each message carries a List-Unsubscribe header with an HTTPS address and a second header, List-Unsubscribe-Post: List-Unsubscribe=One-Click. Both headers must be covered by a valid DKIM signature, and the unsubscribe must complete from a single POST request, without a confirmation page ^S7. Yahoo highly recommends the POST method and still accepts a mailto address ^S3.

The request then has to take effect quickly. Yahoo requires unsubscribes to be honored within two days ^S3. Gmail recommends 48 hours and lists slower handling as a sender issue it checks for ^S2S8.

Spam rate limits and technical basics#

Your spam complaint rate is the share of delivered messages that recipients mark as spam. Gmail and Yahoo both require it to stay below 0.3% ^S1S3. Gmail adds a working target: keep it below 0.10% and avoid ever reaching 0.30% ^S1. Gmail measures the rate on mail delivered to the inbox, so it can rise even when total volume is small ^S8.

The remaining rules are usually handled by your email provider rather than by you, but they are worth confirming:

• Valid forward and reverse DNS (a PTR record) for the sending IP addresses ^S1S3.
• TLS encryption when the message is transmitted, required by Gmail since December 2023 ^S1.
• Messages formatted to RFC 5322, and no From headers that impersonate Gmail ^S1.

How enforcement has tightened#

Microsoft now documents a rejection for domains that miss its rules, returned as error 550 5.7.515 with the message that the sending domain does not meet the required authentication level ^S6. In practice, a sender that ignores the rules no longer just sees lower open rates; some messages are refused outright.

Checklist for a small shop#

To confirm Gmail’s view of your domain, add it to Google Postmaster Tools. Its Compliance status dashboard marks each requirement as compliant, needs work or no data found ^S8. Low-volume senders often see no data, which is normal.

Meeting the requirements with Tellnod in Claude or ChatGPT#

Tellnod is an MCP connector that lets a shop write, preview and send email from Claude or ChatGPT. Most of the checklist is handled before a campaign can be sent:

• Ask “Set up ninefold.com as my sending domain”. Tellnod returns the SPF, DKIM and DMARC records to add and checks them for you. Until they verify, you can send from an address named after your shop on Tellnod’s shared domain, such as hello@ninefold.tellnodmail.com, for up to 500 recipients per campaign and 1,000 emails a month.
• Ask “Show me the results of last week’s campaign”. The results card lists delivered, opens, clicks, unsubscribes and bounces, so a rise in unsubscribes or bounces is visible right after a send.
• Every campaign gets one-click unsubscribe headers, a visible unsubscribe link and your postal address, and unsubscribed and bounced contacts are removed from each audience.
• New accounts ramp up gradually, and sending pauses automatically if complaints pass 0.1%.

Before anything goes out, you see the real email on desktop and mobile, then a confirmation card with the audience, the exclusions and the send time. The AI can prepare a send but cannot confirm it; you approve every send on the approval card. Setup instructions are on the connect page, and plans start free on the pricing page.

FAQ#