If you send more than 5,000 emails per day to Gmail or Yahoo addresses, you are a bulk sender under Google and Yahoo's 2024 rules - and the requirements are not optional. You must authenticate with SPF, DKIM, and a DMARC policy. You must support one-click unsubscribe (RFC 8058). You must keep your spam complaint rate below 0.3 percent. Miss any of these and your mail gets filtered or rejected outright. This guide covers exactly what compliant bulk sending looks like in 2026.
Short answer: Bulk sender compliance means three things: full email authentication (SPF + DKIM + DMARC with at least p=none and aligned identifiers), a working one-click unsubscribe header on every marketing message, and a 30-day spam complaint rate under 0.3 percent (with 0.1 percent as the safe target). Cross the 5,000 daily threshold without these in place and your inbox placement collapses inside a week.
What Changed in February 2024 (and Why It Still Matters)
In October 2023, Google and Yahoo announced jointly that bulk senders would need to meet new authentication and engagement standards starting February 2024. Enforcement ramped through 2024 and is now fully in effect. The rules apply to anyone sending more than 5,000 messages per day to Gmail addresses (the equivalent threshold applies at Yahoo). Microsoft followed with similar requirements in 2025.
The shift was significant because it moved authentication from "recommended best practice" to "hard gate." Before 2024, a domain with no DMARC record could still land in the Gmail inbox if its content and engagement signals looked clean. After 2024, the same domain gets rejected at the SMTP layer or dumped into spam regardless of content.
If you run cold outbound at any scale - agency campaigns, founder-led prospecting, a sales team with rotating mailboxes - you are either compliant or you are bleeding deliverability without knowing it.
The 5,000-Message Threshold (and Why It Doesn't Save You)
The official rule says the strictest requirements kick in at 5,000 messages per day to Gmail addresses. Below that threshold, a relaxed set of rules applies. The temptation is to think: "I only send 2,000 per day, I'm fine." That thinking is wrong for three reasons.
First, the 5,000 count is cumulative across your sending domain, not per mailbox. If you run 10 inboxes on one domain at 300 emails per day each, you have crossed the threshold. Most agencies running outbound at scale hit 5,000 daily before they realize it.
Second, the "relaxed" rules below 5,000 still require SPF or DKIM (one of them), valid forward and reverse DNS, and a sub-0.3 percent spam complaint rate. So even small senders are bound by most of the same standards.
Third, mailbox providers like Gmail use the bulk sender rules as a signal for everyone. Even if you technically fall under the threshold, having weak authentication tells the filter you are an amateur sender. You will sit in promotions or spam regardless.
Volume math for agencies: 10 sending inboxes at 40 emails per day each equals 400 emails daily per agency mailbox cluster. Run that across 15 clients and you are at 6,000 daily messages from your sending infrastructure. Bulk sender rules apply to your aggregate volume from a given domain or related domain set, not the client's perspective. Plan for compliance from message one, not message 5,001.
DMARC Enforcement and Authentication Alignment
The headline requirement from Google and Yahoo is DMARC. You need a published DMARC record on your sending domain, and your messages must achieve DMARC alignment - meaning the domain in your From header has to match (or be a subdomain of) the domain authenticated by SPF or DKIM.
A correct minimum DMARC record looks like this:
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.comThe policy p=none is enough to satisfy the bulk sender rule. It tells receivers to monitor and report but not to block on DMARC failure. This is the safe starting point. Many senders stay on p=none indefinitely because it provides compliance plus visibility without breaking legitimate mail that uses your domain (calendar invites, transactional email from third parties, etc.).
The trap people fall into is publishing a DMARC record without checking alignment. Your DMARC record can be perfect, but if your SPF authenticates mailgun.org while your From header is you@yourdomain.com, you fail alignment and the message fails DMARC. The fix is to use a custom return-path domain (sometimes called bounce domain or envelope-from) that matches your sending domain, and to publish a DKIM signature using your sending domain as the d= value.
Practical checklist for DMARC compliance:
- SPF record covers every IP or service that sends as your domain, with 10 or fewer DNS lookups in the chain
- DKIM signature is applied by your sending service using a 2048-bit key, with the d= domain matching your sending domain (or a subdomain)
- DMARC record published at
_dmarc.yourdomain.comwith at leastp=noneand arua=reporting address - Alignment verified by sending a test to
mail-tester.comor checking headers in a real Gmail inbox fordmarc=pass
One-Click Unsubscribe (RFC 8058)
The second hard requirement is one-click unsubscribe, formally specified in RFC 8058. You must include two headers in every commercial or marketing message: a List-Unsubscribe header with a mailto and HTTPS URL, and a List-Unsubscribe-Post header signaling that the URL accepts a one-click POST.
What the headers look like in practice:
List-Unsubscribe: <mailto:unsubscribe@yourdomain.com>, <https://yourdomain.com/unsubscribe?id=abc123>
List-Unsubscribe-Post: List-Unsubscribe=One-ClickThe behavior must be: when a recipient clicks the Gmail or Yahoo native "Unsubscribe" link at the top of the email, the mailbox provider sends a POST request to your URL with the body List-Unsubscribe=One-Click, and you must process the opt-out within two days. No login required. No confirmation page. No "are you sure?" upsell. Click and gone.
Most cold email tools handle this automatically now, but the requirement applies to your sending infrastructure, not the recipient's perception. If you are stitching together SMTP relays or running a custom sender, you have to implement the headers and the endpoint yourself.
A note on cold versus marketing email: technically, one-click unsubscribe is required for "commercial or relationship messages" sent to bulk thresholds. In practice, treat every cold email as in-scope. The cost of including the header on a message that did not strictly require it is zero. The cost of omitting it from a message that did is a deliverability collapse.
The 0.3 Percent Spam Complaint Ceiling
The third hard rule is the spam complaint rate. Google publicly states that bulk senders should maintain a spam complaint rate under 0.3 percent. Above that and you trigger filtering. Above 0.1 percent and you are already in the warning zone.
Spam complaint rate is the percentage of recipients who explicitly mark your message as spam, calculated against the total messages delivered to that mailbox provider over a rolling window (typically 30 days). It is reported directly to senders through Google Postmaster Tools for Gmail volume and through similar tools at other providers. A rate of 0.3 percent means 3 complaints for every 1,000 delivered messages.
The complaint rate is the metric you can least afford to ignore because it compounds. Every spam complaint reduces engagement scoring for your domain. Engagement scoring drives placement decisions. Worse placement reduces real opens and replies. Lower engagement triggers more complaints from frustrated recipients who never saw your earlier messages. Once the spiral starts, recovery takes weeks, not days.
How to keep complaints under 0.1 percent in practice:
- Target precision matters more than volume. A 5,000-message campaign to a tight ICP generates fewer complaints than a 1,000-message blast to a loosely targeted list. Lists matter more than copy.
- Honor unsubscribes immediately. A second send to someone who unsubscribed is a near-guaranteed complaint.
- Suppress hard-bounce addresses across domains. If
jane@acme.combounced from one inbox last week, do not send to her from a different inbox tomorrow. Maintain a global suppression list. - Make the unsubscribe path obvious. If the only way out is to mark as spam, that is what people will do.
- Watch Google Postmaster Tools weekly. Spam rate, IP reputation, and domain reputation are visible there in near-real-time for any domain sending meaningful volume to Gmail.
Sending Behavior That Survives the New Rules
Compliance is the floor, not the ceiling. Even with perfect DMARC, working one-click unsubscribe, and a 0.05 percent complaint rate, your sending behavior can still tank deliverability. Here is what holds up at scale.
Sender rotation across multiple domains and inboxes. Running 5,000 daily messages through a single mailbox is suicide regardless of compliance. The mature pattern is 6 to 10 secondary domains, 2 to 3 inboxes per domain, and 40 to 50 messages per inbox per day. This distributes reputation risk and keeps any single inbox below the volume that triggers throttling.
Warm-up running continuously, not just on launch. A new inbox needs 3 to 4 weeks of warm-up before real outbound. After that, keep warm-up running in the background at low daily volume. It maintains a baseline of positive engagement signals that protects the inbox during slower campaign weeks.
Volume ramps, not spikes. Increase a domain's daily volume by at most 20 to 30 percent week over week. A sudden jump from 200 to 2,000 daily looks like a compromised account even when your authentication is perfect.
List hygiene before every campaign. Verify the list with a service that catches role accounts, catch-alls, and known spam traps. Removing 10 to 20 percent of a freshly built list as unsendable is normal. Sending to a dirty list is the fastest way to burn a warm domain.
Send from your primary brand domain when: messages are transactional, the recipient knows you, volume is under 50 per day, or the message is a one-to-one reply. Brand domain reputation is too valuable to risk on cold outbound.
Send from a secondary domain when: the message is cold outbound, you are running sequences, you cross any meaningful daily volume, or you are sending on behalf of a client. Treat secondary domains as expendable infrastructure that protects the brand domain.
How ACA Handles Compliant Bulk Sending
ACA is built on a bring-your-own-infrastructure model. You connect your own sending mailboxes (Google Workspace, Microsoft 365, or SMTP) and your own AI API keys. The platform orchestrates the sequences, but the sending reputation belongs to you. This matters for compliance because every authentication record, every DMARC alignment, every spam complaint signal ties back to infrastructure you control, not a shared pool you cannot fix.
Sender rotation is native. You can attach an unlimited number of mailboxes to a single campaign and ACA distributes sends across them with per-inbox daily limits, randomized timing windows, and automatic pausing when an inbox shows reputation warning signs. If one mailbox stalls, the sequence keeps moving through the rest of the pool without manual intervention.
The platform inserts one-click unsubscribe headers automatically on outbound messages, handles the POST endpoint, and writes opt-outs to a global suppression list that applies across every campaign and every mailbox in your workspace. An unsubscribe from a Tuesday campaign blocks the recipient from every campaign for the rest of time, regardless of which client or which sequence the next send would have come from.
For agencies running outbound for multiple clients, workspace isolation means each client's domains, mailboxes, and reputation are walled off from each other. One client's deliverability problem cannot bleed into another client's sending. Combined with multi-channel routing across LinkedIn, WhatsApp, Instagram, Telegram, and SMS, the practical effect is that you are not betting the entire campaign on email alone. When email volume needs to slow, the sequence keeps moving through other channels.
For the broader picture of how this fits into hands-off outbound operations, see ACA Campaigns and the agency solution overview.
Frequently Asked Questions
Do Google's bulk sender rules apply to me if I send fewer than 5,000 emails per day?
Partially. The strictest rules (DMARC alignment, one-click unsubscribe, sub-0.3 percent complaint rate) are technically required at the 5,000 daily Gmail messages threshold. But Gmail and Yahoo apply softer versions of the same standards to all senders. If you skip authentication or ignore complaints under the threshold, you will see worse inbox placement even before you legally have to comply. Treat the rules as universal.
What DMARC policy should I use - p=none, p=quarantine, or p=reject?
Start at p=none for at least 4 weeks while you collect aggregate reports through the rua= address. The reports show you every source sending as your domain. Once you confirm only your authorized sources are sending and they all pass alignment, move to p=quarantine. After another clean 4 weeks, move to p=reject. Going straight to p=reject on a new policy is how legitimate calendar invites and third-party transactional mail get accidentally blocked.
Does the one-click unsubscribe requirement apply to cold email?
Google's documentation says the requirement applies to commercial and marketing messages from bulk senders. Cold outbound generally fits that definition. In practice, include the header on every cold email regardless of whether you think you cross the threshold. The cost of inclusion is zero and the cost of omission is filtering.
How do I monitor my spam complaint rate?
For Gmail volume, register your sending domains in Google Postmaster Tools and check it weekly. It shows spam rate, domain reputation, IP reputation, and authentication pass rates directly. For Yahoo and Microsoft volume, use their respective postmaster tools or rely on aggregate metrics from your sending platform. Set an internal alert at 0.1 percent so you have time to react before crossing 0.3 percent.
Can I use a shared sending IP for compliant bulk email?
Yes, if the shared pool has a clean reputation, but it is a real risk. On a shared IP, your reputation is tied to every other sender on that IP. One bad actor pushes you into filtering even when your own behavior is clean. For agency-scale outbound, dedicated IPs or distributed sending across many small-volume mailboxes give you more control. The latter is what most modern outbound stacks use.
What happens if my domain crosses 0.3 percent spam complaint rate?
Gmail begins filtering your messages into spam at higher rates and shows a warning in Postmaster Tools. The complaint rate is measured on a rolling 30-day window, so a single bad campaign affects placement for weeks. Recovery requires pausing aggressive volume, fixing the targeting or content issue that drove complaints, and rebuilding engagement over the following 30 to 60 days. The faster you react, the shorter the recovery window.
Do I need a separate sending domain from my main brand domain?
Yes, always. The standard pattern is to keep your brand domain (the one your website is on) for transactional and one-to-one mail only, and to use secondary domains for cold outbound. If a secondary domain gets blacklisted, you swap it out without affecting business email or website credibility. Most agencies run 4 to 10 secondary domains in rotation.