Gmail and Yahoo bulk sender requirements: a checklist for ecommerce brands

Google's guidelines set requirements for all senders and extra ones for anyone sending more than 5,000 messages a day to personal Gmail accounts¹. The count is messages to Gmail addresses, not your whole list. Yahoo splits its page into requirements for all senders and for bulk senders, but does not give a volume number there². Read both pages before you decide you are below the line.

Our rule: if you are close to the line, act as a bulk sender. A promotion day or a list import can push a normal week over it.

Two cautions. Google's one-click rule covers marketing and subscribed messages¹, so know which of your mail falls into those groups. And none of this covers consent. Who you may email is a legal question, and your lawyer decides it.

Google asks all senders for SPF or DKIM. Senders of more than 5,000 messages a day need SPF and DKIM and DMARC, and the From: domain must align with the SPF or the DKIM domain¹. Google says the DMARC policy for these senders can be set to none¹. Yahoo asks bulk senders for SPF and DKIM and a DMARC policy of at least p=none that passes².

In plain words:

• SPF lists the servers allowed to send mail for your domain.
• DKIM adds a signature so the receiver can check the message was not altered.
• DMARC tells receiving servers what to do with messages that fail those checks, and requires the visible sender domain to align with the authenticated one.

DMARC has three policies: none, quarantine and reject³. Google Workspace help describes a staged rollout: start at none, review the reports, then move to quarantine or reject⁴. Start at none and read the reports. In our experience the first thing you find is often a tool sending mail in your name that nobody remembered.

Checklist:

• Every tool that sends in your name is authenticated: email platform, store platform, helpdesk, review tool.
• DMARC is published for the domain you send from.
• The policy is chosen on purpose, not left blank forever.

Which domain to authenticate, the sending domain or the root domain, comes up in an email platform's community recap of the Google and Yahoo requirements⁵. If you are unsure, ask your email platform which domain it signs with.

One-click unsubscribe is a signal in the List-Unsubscribe email header; RFC 8058 describes how to mark it as one-click⁶. Google lists both headers, List-Unsubscribe and List-Unsubscribe-Post, and requires one-click unsubscribe for marketing and subscribed messages from senders above 5,000 a day¹. Yahoo requires a working one-click List-Unsubscribe header for marketing and subscribed messages from bulk senders².

Checklist:

• The headers are set by your email platform.
• There is also a clearly visible unsubscribe link in the message body. Google and Yahoo both ask for it¹².
• Unsubscribing does not ask for a login, and Yahoo gives senders 2 days to honour a request².
• You send a test to a Gmail address and look for the unsubscribe option in the inbox view.

A footer link alone is not enough. The header is how the mailbox provider offers one-click unsubscribe in its own interface, and the body link is required on top of it. Mailing someone who asked to leave is a reliable way to earn a complaint.

The spam complaint rate is the share of delivered messages that recipients mark as spam. Google says to keep the spam rate reported in Postmaster Tools below 0.10% and to avoid ever reaching 0.30% or higher¹. So there is a limit and a lower target. Treat the limit as a ceiling, not a goal. Yahoo asks senders to keep the spam rate below 0.3%, calculated on mail delivered to the inbox².

Example (illustrative): You deliver 20,000 messages in a day and 40 recipients mark them as spam. That is 0.20%. It is under a 0.30% limit and over a 0.10% target. Under the limit is not the same as fine.

What drives complaints? In our experience, mostly the basics:

• Mailing people who did not expect you, or who forgot signing up.
• A hard-to-find unsubscribe, which sends people to the spam button.
• Frequency or content that does not match what they signed up for.

Cut the segment that complains before you cut the programme.

Google's Postmaster Tools has a spam rate dashboard, showing the share of your messages that recipients mark as spam in Gmail, and a compliance status dashboard for the sender requirements⁷. Use them. Your email platform shows its own view of your mail. Postmaster shows how Google measures your Gmail traffic. The two can disagree, and the second one counts for Gmail.

Checklist:

• Domain verified in Postmaster Tools.
• Spam rate checked weekly, and after every big send.
• Authentication status checked after any change to tools or DNS.

Two different things can look identical in a report. In one email platform forum thread, a sender's open rates fell overnight on Gmail and Hotmail while other providers were unaffected; the reply asked about list changes, reputation in Postmaster Tools and seed tests⁸. In our view, a drop limited to some providers points to deliverability. But there is a second suspect, and it is about measurement.

Apple Mail Privacy Protection (MPP) changes what an "open" means, so an open rate alone cannot tell you which problem you have. Our rule of thumb: look at clicks and placed orders next to opens. If all three fall together, suspect inbox placement, then check authentication and Postmaster Tools. If only opens move, suspect measurement. It is a rule of thumb, not proof.

We can tell you what the providers state. We cannot tell you how a given provider will treat your mail if you miss a requirement, or how fast. We also give no dates here, because the pages change and the dates are not the point. The sensible position is to meet the requirements now and watch Postmaster Tools.

For ZFD: We treat deliverability as part of retention, not a side job for IT. Our view: a checklist like this belongs in the audit before the programme.