Gmail, Yahoo, and Outlook sender requirements, explained for outbound teams

Who counts as a bulk sender

Google applies its bulk-sender rules to senders of close to 5,000 messages or more to personal Gmail accounts within 24 hours. Messages from the same primary domain count together, and bulk status does not expire, even if volume later falls. [1][2]

Microsoft applies its requirements to domains sending more than 5,000 messages a day to Outlook.com, its consumer service for outlook.com, hotmail.com, and live.com addresses. Yahoo publishes separate lists for all senders and for bulk senders, but its best-practices page does not give a numeric threshold. [3][4]

Two consequences matter for outbound. Volume is counted per primary domain, not per mailbox, so spreading traffic across mailboxes on one domain does not keep it under the line. And because Gmail’s status is permanent, a single high-volume day can change the rules a domain lives under from then on. [2]

The requirements side by side

The shared core is small: authenticate, align, keep complaints low, and let people leave in one step. Microsoft adds hygiene recommendations for high-volume senders—a real From or Reply-To address on the true sending domain that can receive replies, a clearly visible unsubscribe link, and regular removal of invalid addresses. [3]

Sources [1][2][4][3]

What happens when you miss them

Google says messages that do not meet its requirements may receive temporary or permanent failure codes or be sent to spam. Its SMTP error reference shows what that looks like in practice: unauthenticated mail is refused with 550 5.7.26, and mail from an IP without a matching PTR record with 550 5.7.25. [2][5]

Microsoft originally planned to send non-compliant high-volume mail to Junk, then updated its announcement to reject it from May 5, 2025, with “550; 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level.” [3]

Spam rate carries its own penalty at Gmail. Senders at or above 0.3 percent become ineligible for mitigation until they stay below it for seven consecutive days. Postmaster Tools is where that rate appears, and it shows data only after the domain is verified and daily volume is high enough to populate the dashboards. [2][6]

Why low-volume outbound should comply anyway

Most cold outreach never approaches 5,000 messages a day to one provider, and that is not a reason to skip the list. Google applies SPF or DKIM, valid forward and reverse DNS, TLS, standard formatting, and the 0.3 percent spam-rate ceiling to every sender, not only bulk senders. Yahoo’s all-sender list covers the same ground. [1][4]

The bulk additions are also cheap. DMARC at a monitoring policy, aligned authentication, and a one-click unsubscribe header cost a few DNS records and a correctly built message. Skipping them saves almost nothing and leaves a new domain looking less accountable than it is.

The threshold also moves with success. A domain that grows into bulk volume should not need a migration project on the day it crosses the line—especially at Gmail, where the status is permanent. [2]

How Actually Agentic handles each requirement

Here is how the current design maps to the list. The unsubscribe path follows RFC 8058: the one-click POST changes state, and a plain GET never does. [7]

• Authentication: each managed sending domain publishes SPF, DKIM, and DMARC, and the control plane verifies those records, along with MX and the return path, before warm-up begins.
• Reverse DNS: forward DNS and PTR alignment for the provider-operated sending path are verified before warm-up, and DNS and IP checks must pass again before launch approval.
• Unsubscribe: every message carries List-Unsubscribe with one-click POST. The POST records a durable suppression and cancels queued follow-ups in the same transaction; a GET only shows a confirmation page, because security scanners open links automatically.
• Complaints: any complaint that reaches the system suppresses the recipient and pauses the campaign for review—far stricter than a 0.3 percent ceiling.
• Format and identity: messages include a plaintext alternative, standard headers, a unique bounce return path, the approved sender identity, and the campaign’s physical postal address.
• Volume: new mailboxes ramp from five campaign messages a day, and the current planning default is 20 per mailbox per sending day.

What configuration cannot do for you

Some of the work is operational rather than code. Before accepting real customers, Actually Agentic’s runbook requires enrolling sending domains in Google Postmaster Tools and Yahoo’s complaint feedback program where eligible, and routing their notices to staffed abuse and postmaster mailboxes. Gmail’s spam rate appears in Postmaster Tools at the domain level, so it has to be watched there alongside the complaints the system receives directly. [6]

Requirements also change. The pages cited here were checked when this article was reviewed; recheck them before relying on a number. Actually Agentic is prelaunch, and meeting every requirement still does not guarantee inbox placement, which depends on reputation, content, and how recipients respond. [8]