Gmail, Yahoo and Outlook Bulk Sender Rules for Cold Email

What are the bulk sender requirements?

Gmail, Yahoo and Outlook.com require senders of large volumes to authenticate their mail with SPF, DKIM and DMARC, let recipients unsubscribe in one click, and keep spam complaints under 0.3%. Google and Microsoft draw the line at 5,000 messages a day; Yahoo declines to name a number. Gmail began enforcing in February 2024, Outlook.com in May 2025.

For cold email the scope matters more than the list. Google's FAQ says: 'The Email sender guidelines don't apply to messages sent to Google Workspace accounts. Sender requirements and Google enforcement apply only when sending email to personal Gmail accounts.' Microsoft's rules apply to hotmail.com, live.com and outlook.com addresses. A B2B cold email to someone at a company domain is mostly outside both.

Who counts as a bulk sender

Google: 'any email sender that sends close to 5,000 messages or more to personal Gmail accounts within a 24-hour period'. Only mail to personal Gmail accounts counts. 'Close to' is Google's wording; it does not say how close.

Yahoo: 'an email sender sending a significant volume of mail. We will not specify a volume threshold.' Yahoo views a sender 'at the authenticated domain or From header domain level' and says spoofed mail counts toward what it looks at.

Microsoft: 'domains sending over 5,000 emails per day' to Outlook.com, which its announcement defines as the consumer service 'supporting hotmail.com live.com and outlook.com consumer domain addresses'.

How Google counts the 5,000

By primary domain. Google's example: 2,500 messages a day from solarmora.com and 2,500 from promotions.solarmora.com make you a bulk sender, 'because all 5,000 messages were sent from the same primary domain'. Subdomains do not split the count. Separate primary domains, which is how cold email infrastructure is usually built, are counted separately.

Bulk status is permanent

'Bulk sender status doesn't have an expiration date. Email senders that have been classified as bulk senders are permanently classified as such.' A domain that crosses the line once, in one campaign, stays bulk under Google's rules even if it never sends 5,000 a day again. That is a reason to keep cold email off the domain your company uses for everything else.

The three rule sets side by side

Quoted or paraphrased from each provider's own page, read 30 October 2026. 'All' means every sender to that provider's personal mailboxes; 'bulk' means senders over the threshold.

Three rows decide most outcomes. Authentication is binary and cheap: a domain either passes SPF, DKIM and DMARC or it does not. Complaint rate is the one you cannot configure, and it is the one with a hard number: Google's 0.10% is one complaint per 1,000 messages. Unsubscribe is the one cold email most often gets wrong, because sequencers do not all add a List-Unsubscribe header by default.

What happens to mail that fails

Gmail: 'Starting November 2025, Gmail is ramping up its enforcement on non-compliant traffic. Messages that fail to meet the email sender requirements will experience disruptions, including temporary and permanent rejections.'

Yahoo: 'your mail may be sent to the spam folder or rejected.' Enforcement began in February 2024 and is being rolled out 'gradually'.

Microsoft: its own announcement says two different things. The update added on 29 April 2025 reads: 'we have made a decision to reject messages that don't pass the required authentication requirements', with the bounce '550; 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level', taking effect on 5 May. The body of the same post, still live on 30 October 2026, says that after 5 May 2025 'Outlook will begin routing messages from high volume non-compliant domains to the Junk folder' and that rejection will come 'in the future (date to be announced)'.

The two cannot both describe current behaviour. The update is later and more specific, and the 5.7.515 code is the one to look for in your bounce logs. Either way, a domain over 5,000 a day to Outlook.com without passing SPF, DKIM and DMARC loses the inbox.

Why most cold email sits outside these rules

Cold B2B email goes to work addresses: [email protected]. When company.com runs on Google Workspace, Google says its sender guidelines and enforcement do not apply to that message. When it runs on Microsoft 365, the Outlook.com rules, written for consumer hotmail, live and outlook addresses, do not either. The rules in the table bind cold email mainly through the share of any list that is personal addresses, and through the reputation signals those providers share with their business products.

That is not a loophole. A company's Workspace or Microsoft 365 tenant still filters inbound mail, with its own settings and Google's or Microsoft's spam models underneath, and none of it is published. The practical reading is that the consumer rules are the published floor: a domain that fails SPF, DKIM or DMARC, or draws complaints, is unlikely to do better at a company inbox than at a personal one.

Where the 5,000 line actually bites cold email

On personal-address lists, and on the primary domain. A cold email setup spread over many separate domains at 15 to 30 emails per inbox, as the inbox-count page works through, stays far under 5,000 per domain: even 100 inboxes on one domain at 30 a day is 3,000, and only the share going to personal Gmail counts. Running cold email from subdomains of your main domain is different, because Google adds subdomains to the primary domain's count.

What the complaint thresholds mean in emails

Complaint rates are small fractions of large numbers, so it helps to turn them into people. Google's dashboards measure against mail delivered to the inbox; the figures below assume every email is delivered.

At 1,000 emails a month to Gmail addresses, a second spam report puts a sender over Google's 0.10% target and a fourth over its 0.30% limit. Recipients do not need much prompting. In a 588-point Hacker News discussion of the Gmail and Yahoo rules, one commenter wrote that if an email lacks a one-click unsubscribe 'I just mark it as spam', and another that marking unwanted mail as spam is 'easier than finding the tiny 8-point link at the bottom'. For a cold email to a personal address, the spam button is the default unsubscribe.

The caps on the sending side

The receiving providers' rules sit on top of limits the sending platforms put on each inbox. These bind before any receiver sees the mail, and for cold email on new Microsoft tenants they are lower than the volume most plans assume. From Google's and Microsoft's own documentation, read 30 October 2026:

A 30-mailbox Microsoft tenant gets 14,906 external recipients a day once it is older than 60 days, but about 1,490 in its first 30 days, roughly 50 a mailbox. On Google, a domain with three inboxes on the $8.40 flexible plan pays $25.20 a month and passes the $100 threshold in its fourth month, then waits up to 75 days more for trial limits to lift; at 15 to 30 cold emails a day per inbox the 500-a-day trial cap is not the one that binds. The inbox provider census sets these against what resellers charge.

Per inbox the arithmetic is harsher. One inbox sending 30 cold emails a day to personal Gmail addresses over 22 days sends 660 a month, so a single spam report is 0.15%, already above Google's 0.10%, and two reports is 0.30%. At 15 a day, 330 a month, one report alone reaches 0.30%. Google's Postmaster Tools reports by domain, so ten such inboxes on one domain, 6,600 emails, bring the same two reports down to 0.03%. That is the honest case for spreading volume: it dilutes complaints per domain, it does not reduce them.

The rules have also moved faster than most summaries show. Gmail's rules started on 1 February 2024 and its step-up to rejections came 21 months later. Yahoo enforced List-Unsubscribe 4 months after its other rules. Microsoft announced on 2 April 2025 and changed its enforcement 27 days later. CAN-SPAM's 10-business-day opt-out window has not changed, and Yahoo's 2-day window for bulk senders is the stricter of the two.

The law underneath: CAN-SPAM

The providers' rules are contract terms for getting into their inboxes. CAN-SPAM is US law and applies whatever the volume. The FTC's compliance guide says the law 'makes no exception for business-to-business email', and that each separate email in violation is subject to penalties of up to $53,088. The figure is per email, so the statutory maximum for a 100-email sequence step that breaks the rules is $5,308,800, for 500 emails $26,544,000, and for 1,000 emails $53,088,000.

• No false or misleading header information, and no deceptive subject lines.
• Identify the message as an advertisement, and include a valid physical postal address.
• Tell recipients how to opt out, and honour opt-outs within 10 business days. Yahoo's bulk rule is stricter, at 2 days.
• You remain responsible for email someone else sends on your behalf, such as an agency.

What to set up before sending

• SPF and DKIM on every sending domain, both, not either. It costs $0 and is required for bulk senders by all three providers.
• DMARC at p=none at minimum, aligned with the From: domain. Yahoo says senders 'should be implementing a DMARC enforcement policy (p=quarantine or p=reject) regardless'.
• A List-Unsubscribe header with one-click (RFC 8058) plus a visible link. Required for Gmail and Yahoo bulk senders, and the cheapest way to turn a would-be complaint into an unsubscribe.
• Separate primary domains for cold email, not subdomains of your main domain, because Google counts subdomains into the primary domain's 5,000 and bulk status never expires.
• Valid forward and reverse DNS for sending IPs, which Google and Yahoo require of every sender. Inboxes bought from Google, Microsoft or a reseller of their seats inherit theirs.

How to check you meet the rules

• Send a message to a personal Gmail address, open it, choose 'Show original', and read the SPF, DKIM and DMARC lines: each should say PASS.
• Register each sending domain in Google Postmaster Tools and watch the spam rate against 0.10% and 0.30%. Yahoo's Complaint Feedback Loop does the same job for Yahoo.
• Search bounce logs for 550 5.7.515 from Outlook.com, which is Microsoft's code for failed authentication under these rules.
• Check that your sequencer adds a List-Unsubscribe header, by reading the raw headers of a sent message rather than the settings page.

What changes after you comply

Compliance gets mail considered, not delivered. Every provider says so in its own words: Google pairs the requirements with 'avoid sending unwanted or unsolicited email'; Yahoo says it uses all the information it has, content and IP included, to judge a sender. Once authentication passes, complaints and engagement decide placement, and those depend on the list and the message.

The rules also tighten over time. Gmail stepped its enforcement up to temporary and permanent rejections from November 2025. Microsoft moved from Junk to rejection within one blog post. Recheck these pages twice a year, and when a provider's page and a vendor's summary of it disagree, the provider's page is the one that is enforced.

Who writes the pages that rank for this

On 30 October 2026 the results for 'gmail bulk sender requirements' were QuickMail, Mailsoftly, Paved, Mailster, Emailchaser, Scrubby, CliffsNotes and Sendmarc: email senders, deliverability services and a homework site. Each of them sells sending, deliverability or authentication, which is a reason to state the requirements as broadly as possible. The three facts that change what a cold emailer should do are narrower: Google's sentence excluding Workspace recipients, its primary-domain rule, and Microsoft's contradiction about what happens to failing mail.

What this page does not know

This page does not know how company inboxes on Google Workspace and Microsoft 365 treat cold email that would fail the consumer rules. Measuring it needs the same message, sent from a passing and a failing domain, to a seed list of company mailboxes on both platforms with default filtering, over several weeks. Google and Microsoft do not publish that behaviour, no deliverability vendor has published a controlled test of it, and this page has not run one. Until someone does, treat the consumer rules as the minimum for every recipient, and run your own seed test with a handful of business addresses you control.

It also does not know how close to 5,000 'close to' is in Google's definition, whether Microsoft is currently rejecting or junking non-compliant mail at Outlook.com, or whether Google treats a cold sales email as a 'marketing message' for the one-click unsubscribe rule. Ask your sending platform which behaviour it observes in its bounce data, and add the header regardless.

Do the bulk sender rules apply to cold email?

Partly. They apply in full to cold email sent to personal Gmail, Yahoo, Hotmail, Live and Outlook.com addresses, and to any domain that sends 5,000 a day to Gmail or Outlook.com. Google says its rules do not apply to mail sent to Workspace business accounts, and Microsoft's are written for its consumer service. But passing SPF, DKIM and DMARC, offering one-click unsubscribe and keeping complaints under 0.10% cost almost nothing, and CAN-SPAM applies to every cold email regardless. Meet the bulk rules on every domain from the first send.