Google Yahoo sender requirements explained for cold email

Your campaign hits send. An hour later, bounces start rolling in, all from Gmail addresses, all flagged with an authentication error you’ve never seen before. Nothing changed on your end. Google changed the rules.

That’s the reality for cold email teams right now. Google, Yahoo and Microsoft have each published explicit sender requirements, and they enforce them automatically, with no warning before your mail starts getting rejected or dumped into junk.

In this article, I’ll walk you through google yahoo sender requirements in plain terms: what Google demands from every sender, what extra rules kick in once you’re classified as a bulk sender, where Yahoo and Microsoft differ, and what all of this actually means for a cold outbound team sending from multiple mailboxes on a shared domain.

I’ll also give you a compliance checklist you can run today, and show you how to handle authentication, unsubscribe links and bounce monitoring without needing a dedicated deliverability hire. By the end, you’ll know exactly which rules apply to you and which ones you can safely ignore.

What the sender requirements are

Google, Yahoo and Microsoft all require the same three things from anyone sending email to their users: authenticate your mail, keep spam complaints low, and make it easy for recipients to opt out. The specifics vary by provider and by volume, but those three pillars show up in every set of rules.

Email senders must meet the requirements described by Google to send email to Gmail personal accounts. Yahoo enforced its own version on a similar timeline, and Microsoft matched Google and Yahoo with enforcement starting May 5, 2025.

Each provider publishes its own guidelines, and the details matter. The rest of this article walks through each provider’s rules, puts them side by side, and explains what they actually mean if you run cold outbound. For a broader look at what drives inbox placement, see our email deliverability guide.

Google requirements for all senders

Every sender mailing personal Gmail addresses (@gmail.com, @googlemail.com) has to meet a baseline, regardless of volume.

Set up SPF or DKIM email authentication for your sending domains. You need at least one of the two. Senders must ensure that sender domains or IP addresses have valid forward and reverse DNS records (PTR records). Use a TLS connection for transmitting email.

Keep your user-reported spam rate below 0.1% and prevent it from reaching 0.3% or higher. You can track this in Google Postmaster Tools. Google also emphasizes the importance of RFC 5322 for message formatting, and you should not impersonate the Gmail From: headers.

If any of these terms are unfamiliar, our guide to email authentication breaks down SPF, DKIM and how they work together.

Extra rules for bulk senders

Google classifies a domain as a bulk sender when it sends close to 5,000 or more messages in a 24-hour period to personal Gmail accounts. The threshold is counted against personal Gmail recipients across the same primary domain. That means subdomains and multiple mailboxes all roll up into one count.

Bulk senders must pass both SPF and DKIM (not just one). For messages sent directly to personal Gmail accounts, the organizational domain in the sender From: header must be aligned with either the SPF organizational domain or the DKIM organizational domain. You also need a published DMARC record with at least p=none.

To meet the one-click unsubscribe requirement, you must use List-Unsubscribe email headers in all commercial, promotional messages, as described in RFC 8058. A visible unsubscribe link in the message body is also required, and unsubscribe requests must be honored within two days.

One detail that catches teams off guard: a domain becomes a bulk sender permanently after it meets the Gmail threshold once. There is no quiet month that resets the classification.

Yahoo requirements

Yahoo’s sender requirements mirror Google’s core: authenticate with SPF and DKIM, publish DMARC for bulk senders, keep complaint rates below 0.3%, and honor one-click unsubscribe within two days.

The main difference is the threshold. Yahoo classifies a bulk sender as one sending a significant volume of mail and states plainly that it will not specify a threshold. In practice, industry consensus aligns Yahoo with Google’s 5,000 per day figure, but Yahoo has never confirmed that number officially.

Yahoo’s bulk sender requirements cover both SPF and DKIM, a DMARC policy of at least p=none that passes, working one-click unsubscribe with a visible in-body link and a two-day processing window, a spam complaint rate below 0.3%, and valid forward and reverse DNS. Yahoo also monitors complaints through its own Sender Hub, not Google Postmaster Tools.

Microsoft requirements for Outlook.com

Effective May 5, 2025, any domain sending more than 5,000 emails per day to Microsoft’s consumer mailboxes has to authenticate with SPF, DKIM, and DMARC, or its mail is rejected outright at the SMTP layer. If your messages land in Outlook.com inboxes (including hotmail.com, live.com, and outlook.com addresses), you need to comply.

The DMARC policy can be p=none at minimum, but the From domain must align with SPF or DKIM. Non-compliant emails are sent to junk folders or rejected entirely.

Microsoft also recommends working unsubscribe links, valid From and Reply-To addresses, and list hygiene. For now, Microsoft 365 addresses are not part of this change. That matters for cold email teams: most B2B recipients sit on Microsoft 365 tenants with their own filtering rules, so these consumer-focused requirements apply mainly when you are reaching personal Outlook, Hotmail or Live addresses.

Requirements side by side

What the rules mean for cold email teams

Here is where most guides written for ecommerce marketers stop being useful. Cold outbound has its own dynamics, and the sender requirements interact with them in specific ways.

Thresholds count per domain, not per mailbox. If you run multiple mailboxes on one domain and each sends enough email to push the combined total past 5,000 a day, your domain has hit the bulk threshold. Spreading volume across mailboxes on the same domain does not keep you under it. This is why cold teams use multiple sending domains and keep daily volume low per mailbox. For guidance on safe sending limits, see how many emails you can send a day.

A visible unsubscribe option still helps cold senders. The one-click List-Unsubscribe header requirement targets commercial and promotional messages that recipients opted into. Cold email sits in a different category. That said, including a visible unsubscribe link in the body gives recipients an alternative to hitting the spam button, which directly protects your complaint rate.

Complaint rates move fast at low volume. At low daily volume, every single complaint weighs more. A handful of spam reports on a small send can push you past the 0.3% ceiling quickly. This is why list quality and relevance matter more for cold senders than for newsletter operators sending to large audiences.

Warm-up protects new domains. A brand-new domain with no sending history has no reputation. Sending cold email from it on day one is a fast way to get flagged. Gradual warm-up builds a positive reputation before you start real outreach. Our guide on how to warm up an email account covers the process step by step.

This is not legal advice. Anti-spam laws like CAN-SPAM, GDPR and CASL have their own consent and opt-out requirements that exist independently of provider rules. Consult a qualified attorney for guidance on your specific situation.

Compliance checklist

Run through this list for every sending domain and mailbox before you launch a campaign:

• •

  SPF record published and passing

• •

  DKIM signing active for every sending service on the domain

• •

  DMARC record published (at least p=none with a rua= address you monitor)

• •

  From domain aligned with SPF or DKIM

• •

  PTR record valid for every sending IP

• •

  TLS enabled on all SMTP connections

• •

  Unsubscribe link included in every email

• •

  Removal requests processed within two days

• •

  Spam complaint rate monitored weekly

• •

  Email lists verified before sending

To watch your spam rate, register your sending domains in Google Postmaster Tools. It shows your daily spam rate as reported by Gmail users. If you see the rate climbing toward 0.1%, pause and investigate before it crosses 0.3%.

How to meet sender requirements with lemlist

You can buy sending domains and mailboxes directly inside lemlist (Settings > Buy domains & emails, then choose Google, Outlook or SMTP). When you do, SPF, DKIM and DMARC records are set up automatically. No manual DNS editing required.

Every new mailbox you add appears in lemwarm for warm-up. lemwarm exchanges real emails with real inboxes at a controlled pace to build sender reputation before you start outreach.

To add an unsubscribe link, open any email step in your sequence and click + Add > Add unsubscribe link. You can choose per campaign whether clicking the link unsubscribes just that email address or the entire contact. lemlist also maintains a team-level unsubscribe list that covers emails, domains, phone numbers and LinkedIn URLs, so opt-outs carry across campaigns.

Before sending, verify your email list. lemlist flags verification statuses and triggers a bounce alert when your bounce rate hits 10%. If it reaches 50% after 100 leads contacted, the campaign pauses automatically. That protects your domain from the kind of bounce spike that tanks reputation overnight.

You can also pace new leads added to a campaign, use a custom tracking domain for link and open tracking, or disable tracking entirely on a per-campaign basis to keep your emails as clean as possible.

Final takeaway

Google, Yahoo and Microsoft all enforce the same core idea: prove you are who you say you are, respect the inbox, and let people opt out. Cold email teams that authenticate every domain, keep complaint rates low, and warm up before scaling will stay on the right side of these rules. The technical setup is straightforward once you know what each provider expects.

Build your first signal-based sequence in lemlist.