By Zain Ismail · October 24, 2026 · 9 min read

Gmail Bulk Sender Requirements 2026: BFCM Email Checklist

Gmail bulk sender requirements explained: SPF, DKIM, DMARC, one-click unsubscribe and the 0.1% spam line, plus a checklist to protect BFCM email.

The Gmail bulk sender requirements haven’t changed since 2024, but the way Google enforces them has. Since November 2025, Gmail says messages that miss its sender rules “will experience disruptions, including temporary and permanent rejections” (Google). That means a Black Friday campaign with broken DMARC alignment or a missing unsubscribe header doesn’t just land in spam. It can bounce.

If you send 5,000 or more messages a day to personal Gmail accounts, even once, Google treats you as a bulk sender permanently. You need SPF, DKIM and DMARC with an aligned From domain, one-click unsubscribe on marketing mail, and a spam rate below 0.1% that never reaches 0.3%. Yahoo and Microsoft’s Outlook.com apply almost the same rules. Below is each requirement, what the providers’ own pages say, and a checklist to finish before BFCM volume starts.

Key takeaways

Bulk status is permanent. Hit about 5,000 messages to personal Gmail accounts in 24 hours once, counted across your primary domain, and you’re a bulk sender for good (Google FAQ). A BFCM spike can put you there.
Authentication must align. SPF and DKIM both pass, DMARC published (p=none is fine), and the From domain matches the SPF or DKIM domain (Google).
One-click unsubscribe is a header, not a footer link. Marketing mail needs RFC 8058 List-Unsubscribe headers plus a visible link, and opt-outs honored within 48 hours (Google) or 2 days (Yahoo).
The real spam target is 0.1%, not 0.3%. Above 0.3%, Google won’t consider you for mitigation until you’ve stayed below it for 7 consecutive days.
Outlook.com rejects too. Since May 5, 2025, Microsoft rejects non-compliant mail from domains sending over 5,000 a day with “550; 5.7.515 Access denied” (dmarcian).

What changed: the enforcement timeline

The rules were announced for February 2024. What changed since is how hard they bite. This timeline combines Google’s FAQ with GMass’s tracking of enforcement (GMass):

Date	What happened
February 2024	Gmail and Yahoo sender requirements take effect; gradual enforcement starts
June 1, 2024	Gmail deadline for one-click unsubscribe on promotional mail; Yahoo starts enforcing List-Unsubscribe the same month
June 2024	Gmail: bulk senders above 0.3% spam rate become ineligible for mitigation
May 5, 2025	Microsoft starts rejecting non-compliant high-volume mail to Outlook.com, Hotmail.com and Live.com
Late 2025	Postmaster Tools v2 with a Compliance Status dashboard replaces the old reputation charts (Blueshift)
November 2025	Gmail ramps up enforcement: temporary and permanent rejections for non-compliant traffic

GMass describes the November 2025 step as the point where messages that fail authentication or trip the spam threshold started getting “5xx permanent rejections at the SMTP level, not just filtered to the spam folder.” That’s GMass’s reading of what it observed; Google’s own wording is “temporary and permanent rejections.”

Who counts as a bulk sender (and why BFCM matters)

Google defines a bulk sender as “any email sender that sends close to 5,000 messages or more to personal Gmail accounts within a 24-hour period.” Three details in its FAQ catch people out (Google):

It’s counted per primary domain. Google’s example: 2,500 messages from solarmora.com plus 2,500 from promotions.solarmora.com makes you a bulk sender, because both roll up to the same primary domain. Sending marketing from a subdomain doesn’t split the count.
It’s permanent. “Senders who meet the above criteria at least once are permanently considered bulk senders.” Bulk status doesn’t expire, and changing how you send doesn’t remove it.
Only personal Gmail accounts count. The rules apply to @gmail.com and @googlemail.com. Mail to Google Workspace accounts is outside the guidelines.

The BFCM risk is volume. EngageLab points out that brands sending 2,000 messages a day for ten months “can surge past 50,000 on Black Friday”, which makes it a bulk sender on the one day that matters most (EngageLab). From then on, it’s bulk all year.

Yahoo doesn’t publish a strict number. Mailgun describes Yahoo’s threshold as “in the ballpark of 5000” (Mailgun), and Bird notes Yahoo “applies its own volume criteria” (Bird). Folderly’s advice is the safe one: don’t assume one provider’s classification controls how another treats your mail (Folderly).

Gmail bulk sender requirements, one by one

These are the requirements Google lists for senders of 5,000 or more messages a day to Gmail accounts (Google Email sender guidelines):

Requirement	All senders	Bulk senders
Authentication	SPF or DKIM	SPF and DKIM, plus DMARC (p=none allowed)
From alignment	Not required	From domain aligned with SPF or DKIM domain
Forward and reverse DNS (PTR)	Required	Required
TLS for transmission	Required	Required
Spam rate (Postmaster Tools)	Below 0.3%	Below 0.3%; Google’s FAQ says aim below 0.1%
RFC 5322 message format	Required	Required
One-click unsubscribe	Not required	Required for marketing and subscribed messages, plus a visible unsubscribe link

SPF, DKIM and DMARC alignment

Google says messages that aren’t authenticated “might be marked as spam or rejected with a 5.7.26 error.” Personal Gmail accounts require a DKIM key of at least 1024 bits, and Google recommends 2048 bits. For DMARC to pass, “the authenticating domain must be the same domain that appears in the message From: header.”

Alignment is where most programs break. EngageLab explains why: SPF and DKIM can both pass while DMARC still fails, because the email platform signs with its own domain instead of yours. The fix is to authenticate your own sending domain inside your email platform, so DKIM is signed with your domain.

On DMARC policy, start at p=none with reporting turned on. LeadHaste recommends reading the reports for two to four weeks before tightening the policy, because they show every service sending as your domain, including ones you forgot about (LeadHaste). Don’t move to quarantine or reject in the week before Black Friday.

One-click unsubscribe (RFC 8058)

Google’s guidelines say bulk senders’ marketing and subscribed messages must include both of these headers:

List-Unsubscribe-Post: List-Unsubscribe=One-Click
List-Unsubscribe: <https://yourdomain.com/unsubscribe/...>

The standard behind this, RFC 8058, adds rules your unsubscribe endpoint must follow: the POST request “MUST NOT include cookies, HTTP authorization, or any other context information,” and the sender “MUST NOT return an HTTPS redirect,” because redirected POSTs have historically not worked reliably (RFC 8058). If you built a custom unsubscribe page behind a login or a redirect, it fails this test.

A link in the footer alone doesn’t count. Yahoo’s FAQ is direct: “you must implement the list-unsubscribe header (preferably according to RFC 8058)” (Yahoo Sender Hub FAQ). Both Google and Yahoo exempt transactional mail such as order confirmations and password resets.

Timing matters too. Google’s Postmaster compliance checks flag unsubscribe requests that “aren’t honored within 48 hours.” Yahoo asks you to honor unsubscribes within 2 days.

Spam rate: the 0.1% line

Google’s FAQ: “keep your user-reported spam rate below 0.1% and prevent it from reaching 0.3% or higher.” The impact is graduated, so even rates above 0.1% hurt inbox placement for bulk senders. Above 0.3%, you’re ineligible for mitigation, and Google says you become eligible again only “when their spam rates remain below 0.3% for 7 consecutive days.”

Put in numbers, 0.1% is one complaint per 1,000 messages. If a Black Friday send pushes you over 0.3%, the 7-day rule means you could spend all of Cyber Week without access to mitigation.

Yahoo and Outlook.com: what’s different

Rule	Gmail	Yahoo	Outlook.com / Hotmail / Live
Bulk threshold	About 5,000/day to personal Gmail, per primary domain	No fixed public number	Over 5,000/day
SPF + DKIM	Both must pass	Both	Both must pass
DMARC	At least p=none, aligned	At least p=none, must pass; relaxed alignment OK	At least p=none, aligned with SPF or DKIM
One-click unsubscribe	Required (RFC 8058 headers)	Required; POST method highly recommended, mailto acceptable	Functional, visible unsubscribe link; RFC 8058 not explicitly required
Honor opt-outs	Within 48 hours	Within 2 days	No figure in these sources
Spam rate	Below 0.1%, never 0.3%	Below 0.3%	No figure in these sources
What happens if you fail	Temporary/permanent rejections or spam folder	Negative impact on delivery	Rejection: “550; 5.7.515 Access denied”

Sources for the table: Google’s guidelines and FAQ, Yahoo’s Sender Best Practices, Microsoft’s requirements as reproduced by dmarcian and Mailgun. Mailgun is the source for Microsoft not explicitly requiring RFC 8058.

One more Yahoo detail: it calculates spam rate “based on mail delivered to the inbox,” so your own complaint math may differ from Yahoo’s. Yahoo also recommends separating marketing mail from transactional and user mail by IP or DKIM domain, because each has its own reputation.

On Microsoft, sources disagree on one point. Mailgun’s original post said non-compliant mail would go to Junk first and be blocked later; its May 1, 2025 update and dmarcian both quote Microsoft’s decision to reject instead. Treat rejection as the current rule.

How to check your status before BFCM

Postmaster Tools v2

Google’s Postmaster Tools is free and shows your Gmail spam rate and compliance. Blueshift reports that v2 retires the old Domain and IP Reputation charts and replaces them with a Compliance Status dashboard showing Pass or Needs work for authentication, unsubscribe and spam rate. It uses rolling averages, so it’s a safety net, not a live log. If your domain isn’t verified there yet, do it now: you can’t see a problem you’re not measuring.

Read the bounce codes

5.7.26 (Gmail): authentication failed. Check SPF, DKIM and DMARC alignment.
550; 5.7.515 (Outlook.com): your sending domain doesn’t meet Microsoft’s authentication level.
Rate limiting (Gmail): Google’s FAQ lists rate-limit messages too, for example when DKIM authentication didn’t pass.

Watch frequency

EngageLab notes Gmail’s Manage Subscriptions view lists every brand a subscriber gets mail from, sorted by most frequent senders, next to a one-click unsubscribe button. It cites MailerLite data showing the median unsubscribe rate across campaigns rising from 0.08% to 0.22%. The more often you send, the higher you sit on that list. Ramp volume in October rather than doubling it on Black Friday.

From my accounts: BFCM email that didn’t break

For Oboz, BFCM email and SMS across 6 campaigns brought in $74,127, with 40%+ open rates and 1,023 new subscribers (about double 2022). Lifecycle flows across the brands I’ve worked on brought in over $1M in total, including a $786,646 welcome series for TreeStuff. The full breakdown is in my email lifecycle case study.

None of that works if the mail doesn’t reach the inbox, which is why deliverability belongs in October prep, not November firefighting. If you want a step-by-step plan for the season, my free BFCM Email Playbook covers it. If you’re also running paid ads into BFCM, read my posts on Meta’s October changes and Google Ads policy updates.

Your pre-BFCM deliverability checklist

Check	Pass looks like	Where
SPF passes for every service that sends as your domain	All senders listed in one SPF record	DNS; DMARC reports
DKIM signed with your domain, 1024-bit minimum (2048 recommended)	d= matches your From domain	ESP domain settings; message headers
DMARC record published with reporting	p=none or stricter, rua address set	DNS
One-click unsubscribe headers on marketing mail	Both List-Unsubscribe and List-Unsubscribe-Post present; no redirect or login	Raw headers of a test email
Unsubscribes processed fast	Within 48 hours (Gmail) / 2 days (Yahoo)	ESP suppression list
Spam rate	Under 0.1% in Postmaster Tools	Postmaster Tools v2
Marketing separated from transactional	Different IP or DKIM domain	ESP setup
List hygiene	Unengaged and bounced contacts suppressed before the big sends	ESP segments

Want this applied to your accounts? Get in touch with Zain. I reply on WhatsApp, email and LinkedIn.

FAQ

What are the Gmail bulk sender requirements?

Senders of about 5,000 or more messages a day to personal Gmail accounts must authenticate with SPF, DKIM and DMARC (p=none is allowed), align the From domain with SPF or DKIM, support one-click unsubscribe on marketing mail, keep spam rates below 0.3% (target 0.1%), use TLS, have valid forward and reverse DNS, and follow RFC 5322 formatting.

Does bulk sender status ever expire?

No. Google says senders who hit the threshold even once are permanently considered bulk senders, and changing how you send won’t remove the status.

Is an unsubscribe link in the footer enough?

No. Gmail and Yahoo both require the List-Unsubscribe header for one-click unsubscribe on marketing mail. Keep the footer link too: Google also requires a clearly visible unsubscribe link in the message body.

Do the rules apply to transactional emails?

One-click unsubscribe doesn’t apply to transactional mail like order confirmations and password resets. Authentication and spam-rate rules still apply to everything you send, and a high spam rate hurts delivery of every message type.

What does the 5.7.26 error mean?

Gmail returns 5.7.26 when a message isn’t properly authenticated. Check that SPF and DKIM pass and that DMARC passes with the From domain aligned.

Want this applied to your accounts? Get in touch with Zain. I reply on WhatsApp, email and LinkedIn.

Sources

Want this applied to your accounts?

Get in touch