Who counts as a bulk sender?

Broadly, anyone sending around 5,000 or more messages per day to addresses at a single provider. The count is per provider, so 5,000 messages to Gmail addresses makes you a bulk sender to Google regardless of what else you send. Crossing the threshold once can be enough to have the requirements applied to you, and there is no notification when it happens.

What is a one-click unsubscribe and why is it required?

It is an unsubscribe that completes in a single action from inside the recipient's mail client, without them visiting a website or confirming anything. Technically it requires both a List-Unsubscribe header and a List-Unsubscribe-Post header as specified in RFC 8058. It is required because the alternative — a recipient who cannot easily opt out — presses the spam button instead, and that damages your reputation far more.

What spam complaint rate is acceptable?

Google specifies staying below 0.3% and recommends remaining under 0.1%. In practice 0.3% is where enforcement begins rather than a safe operating level. At 0.1%, one complaint per thousand messages, you have very little margin — which is why list quality matters more than any technical setting.

How quickly must I honour an unsubscribe?

Within two days. That is considerably tighter than the ten business days CAN-SPAM allows, so if you have been working to the CAN-SPAM timeline you are now non-compliant with the provider requirements. The practical answer is to process opt-outs immediately and automatically.

Does this apply to cold outreach?

Yes, if you cross the volume threshold. The requirements are about sending behaviour, not about whether the recipient opted in. Cold outreach at volume is subject to exactly the same authentication, unsubscribe and complaint-rate rules — and typically generates higher complaint rates, which makes the 0.3% ceiling harder to stay under.

Google & Yahoo Bulk Sender Requirements Checklist

In 2024 Google and Yahoo moved a set of long-standing best practices into enforced requirements. The change was significant because it converted advice into a pass/fail gate: mail from senders who do not meet the bar is filtered or rejected, and there is no warning phase.

Do these rules apply to you?

The threshold is roughly 5,000 messages per day to a single provider. Two details matter:

It is counted per provider. Five thousand messages to Gmail addresses makes you a bulk sender to Google, irrespective of your total volume.
It is measured on your sending domain, so splitting across several domains genuinely does reduce per-domain volume — though it does not exempt you from doing the right thing.

Crossing the threshold once can be sufficient for the requirements to apply, and nobody tells you when it happens. Assume they apply.

Requirement 1: authenticate properly

SPF and DKIM must both be configured and passing, and you must publish a DMARC record. The DMARC policy may be p=none — the requirement is that the record exists, not that you enforce rejection.

Critically, authentication must align with your visible From domain. Passing SPF on a sending platform's own domain does not satisfy this. If you are unsure what alignment means, it is covered in detail in our SPF, DKIM and DMARC guide.

Requirement 2: one-click unsubscribe

This is the requirement most senders fail, because a visible unsubscribe link in the message body is not sufficient. What is required is a header-level mechanism that lets the recipient opt out from within their mail client, in one action, with no confirmation page.

Two headers are needed, per RFC 8058:

List-Unsubscribe: <https://example.com/unsubscribe?id=abc>, <mailto:[email protected]>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

The second header is the one people omit. Without it the client will not render the native unsubscribe control, and you are not compliant regardless of the first header being present.

The endpoint must accept a POST and process the opt-out without further interaction. A landing page saying "click here to confirm" defeats the purpose and does not qualify.

Requirement 3: honour opt-outs within two days

Two days, not ten business days. If your process involves exporting unsubscribes weekly and reconciling them by hand, that process is now non-compliant.

The only sensible implementation is automatic: an opt-out enters a suppression list immediately and every subsequent send is checked against it. Storing suppression entries as hashes rather than plain addresses is worth doing — it lets you honour the opt-out permanently without retaining readable contact details for someone who asked not to be contacted.

Requirement 4: keep complaints below 0.3%

This is the requirement that cannot be solved with configuration.

Google specifies staying under 0.3% and recommends under 0.1%. To put that in perspective: at 0.1%, sending 10,000 messages allows you ten complaints. Ten people pressing "report spam" is not many.

Nothing technical fixes a high complaint rate. It is a function of who you are emailing and whether they want to hear from you. The levers that actually work:

Remove unengaged recipients rather than continuing to mail them. Someone who has not opened anything in six months is a complaint waiting to happen.
Make the unsubscribe obvious. Counter-intuitively, a prominent unsubscribe link lowers complaint rates, because the alternative people reach for is the spam button.
Set expectations at signup about frequency and content, and then meet them.
Never mail a purchased or scraped list. It is the fastest route to exceeding the threshold, and it is prohibited by our terms.

Compliance checklist

Requirement	How to verify
SPF passing and aligned	Check the Authentication-Results header on a test message
DKIM signing and aligned	Same header; confirm the signing domain matches your From domain
DMARC record published	DNS TXT lookup on _dmarc.yourdomain.com
List-Unsubscribe-Post present	View the raw source of a received campaign message
Opt-outs processed in under 2 days	Unsubscribe from your own campaign and try to re-send to yourself
Complaint rate under 0.3%	Google Postmaster Tools

Set up Postmaster Tools

Google Postmaster Tools is the only way to see your actual complaint rate as Google measures it. It is free, takes a DNS record to verify, and shows domain reputation, spam rate and authentication success over time. Without it you are guessing at the one metric with a hard threshold attached.

Google and Yahoo Bulk Sender Requirements: What You Must Have in Place

Quick Summary (AI Answer Box)