Bulk-sender requirements of major mailbox providers

Who counts as a bulk sender?

The large providers draw the line at volume. Google and Yahoo apply their stricter requirements to senders that send close to 5,000 or more messages a day to their users. Microsoft applies its requirements to domains sending more than 5,000 messages a day to its consumer addresses (outlook.com, hotmail.com and live.com).

Three details catch people out:

• The count is per domain, across all your tools. Marketing, product notifications and sales outreach from the same domain add up.
• It only takes one day. Google states that once a domain reaches the threshold, it is treated as a bulk sender permanently, not just on busy days.
• Below the threshold you still need the basics. Authentication, reverse DNS and low complaint rates apply to everyone, and providers can still send poorly authenticated mail to spam.

The requirements at a glance

Sources: Google email sender guidelines, Yahoo sender best practices, Microsoft’s announcement for high-volume senders. ”—” means the provider doesn’t list it as a formal requirement; it is still good practice.

Authentication: SPF, DKIM and DMARC

Authentication is the foundation every provider builds on.

• SPF must pass for the sending IP. Keep the record under the 10-DNS-lookup limit; a record that exceeds it fails for every message.
• DKIM must pass, ideally with a 2048-bit key and with your own domain in the signature, not your sending service’s.
• DMARC must be published at _dmarc.yourdomain.com with at least p=none.
• Alignment: the domain in the visible From address must match the domain that passed SPF or DKIM. This is the requirement most often missed when a marketing or sales tool sends “on behalf of” your domain using its own return-path and its own DKIM domain.

If any of this is unfamiliar, start with SPF, DKIM and DMARC explained, then run the domain health check and the DMARC checker on your sending domain.

Is p=none enough?

For compliance, yes: the providers accept p=none as the minimum. For protection, no: p=none doesn’t stop anyone spoofing your domain. Treat p=none as the start of a path to quarantine and reject once your DMARC reports show every legitimate sender passes in alignment.

One-click unsubscribe

Marketing and subscribed messages from bulk senders must support one-click unsubscribe as defined in RFC 8058. In practice that means two headers:

List-Unsubscribe: <https://example.com/unsub?id=abc123>, <mailto:unsub@example.com?subject=unsub>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

• The HTTPS URL must accept a POST request and unsubscribe the recipient without asking them to log in or confirm.
• The headers must be covered by your DKIM signature.
• A visible unsubscribe link in the body is still expected as well.
• Requests must be honoured within two days.

Most email service providers add these headers automatically for marketing sends. Check a received message’s headers to confirm.

Does cold email need one-click unsubscribe?

The formal requirement covers marketing and subscribed messages from bulk senders. One-to-one sales emails sent from individual mailboxes at low volume generally fall outside it. But a clear, easy way to opt out is still expected, keeps complaint rates down, and is required by laws such as CAN-SPAM for commercial messages. The safest practice is to include a plain-language opt-out line and to honour it immediately.

Spam rate below 0.3%

Google and Yahoo require bulk senders to keep the user-reported spam rate below 0.3%: fewer than 3 “report spam” clicks per 1,000 delivered messages. Google advises keeping it below 0.1% in practice and treats senders above 0.3% as ineligible for mitigation until the rate has been back under the threshold for a sustained period.

The rate is measured against mail delivered to the inbox, so it can rise quickly when a campaign goes to an old or unengaged list. To keep it down:

• Send only to people who expect your mail; remove addresses that haven’t engaged in months.
• Make unsubscribing easier than reporting spam.
• Set expectations at sign-up about what you’ll send and how often.
• Watch the rate daily during large sends. Google Postmaster Tools shows it for your domain once volume is high enough; Microsoft offers SNDS for IP data.

Infrastructure basics: PTR, TLS and formatting

• Reverse DNS (PTR): every IP that sends your mail needs a PTR record pointing to a hostname, and that hostname must resolve back to the same IP. Email service providers handle this for their IPs; check it if you run your own servers.
• TLS: connections that deliver your mail should be encrypted. Modern sending services do this by default.
• Formatting: messages must follow the Internet Message Format standard (RFC 5322). One From address, a valid Message-ID and valid dates. Don’t impersonate another provider’s domain in the From line.

Setting up postmaster dashboards

You can’t manage a spam rate you can’t see. Two free dashboards show how the largest providers view your mail, and both are worth setting up before you reach bulk volumes.

Google Postmaster Tools

Google Postmaster Tools reports on mail sent to personal Google accounts: user-reported spam rate, authentication success, encryption, delivery errors and compliance with the sender requirements.

1. Sign in at postmaster.google.com with any Google account.
2. Add your sending domain, the one in your From address.
3. Verify ownership by publishing the TXT record it gives you.
4. Wait for data. Dashboards only populate once your daily volume to Google users is high enough, so low-volume senders may see little or nothing.

Add each sending domain separately, including secondary domains used for outreach.

Microsoft SNDS

Microsoft’s Smart Network Data Services (SNDS) reports on mail from IP addresses to its consumer services: how much was delivered, complaint rates and spam-trap hits. It is useful if you run your own sending servers or have dedicated IPs. On shared IPs from an email service provider, your provider monitors this for you.

What the dashboards can’t tell you

Both dashboards show aggregate data, with a delay, for one provider each. They don’t show whether a particular campaign landed in the inbox at Yahoo, Zoho, iCloud, Mail.ru, Yandex or GMX, and they don’t cover low volumes. Combine them with placement tests across every provider your recipients use, and with alerts that tell you when something changes rather than waiting for you to look.

What happens if you don’t comply?

Enforcement has been gradual since the rules took effect in 2024 and 2025, and has become stricter over time. The consequences range from temporary errors that slow delivery, to messages placed in spam, to outright rejection with an SMTP error explaining which requirement failed. Microsoft announced that non-compliant mail to its consumer domains is first routed to Junk, with rejection as the later stage.

The practical lesson: don’t wait for bounces. Low inbox placement usually shows up as falling open and reply rates long before any rejection, which is why placement testing matters. An inbox placement test shows where your messages actually land at each provider.

Compliance checklist

Keeping compliant over time

Most compliance failures aren’t present on day one. They appear later: a new tool added to the marketing stack without DKIM, an SPF include that pushes the record past 10 lookups, a campaign to an old list that spikes complaints. Recheck your records whenever you add a sending tool, and monitor them continuously if email matters to your revenue.

RoxInbox’s deliverability monitoring rechecks DNS daily, watches blocklists, shows postmaster data next to your own placement results, and alerts you in email or Slack when something changes.

Written by the RoxInbox team

The people who build and run the RoxInbox warm-up network, placement tests and monitoring. We write from what we see across mailbox providers every day. About the authors