Gmail Bulk Sender Requirements: What You Need to Know in 2026

Your campaign shows “delivered” in Klaviyo. Three days later, a subscriber emails support asking where their order confirmation went. You pull the bounce log and find a string of SMTP errors you’ve never seen before: 550, not deferred, not filtered, refused outright.

That’s Gmail’s bulk sender enforcement, and since November 2025 it doesn’t warn you first. In a dataset of 14,101 ecommerce sending domains InboxEagle checked between 11 June and 11 September 2026, 23.4% had no DMARC record at all, the one requirement in Gmail’s rule that no ESP publishes automatically on a store’s behalf.

What Gmail’s bulk sender requirements actually are

If you send 5,000 or more messages a day to Gmail accounts, Gmail requires four things:

• SPF and DKIM, configured and passing.
• DMARC, published at your sending domain, aligned with your From domain, at a minimum policy of p=none.
• One-click unsubscribe (RFC 8058 List-Unsubscribe and List-Unsubscribe-Post headers) on marketing mail, honored within 48 hours.
• A spam complaint rate that stays below 0.3%, with 0.1% as the working ceiling, not the target.

Yahoo applies the same core checks. If you searched for “Yahoo sender requirements bulk email authentication unsubscribe 2026”, the answer is the same set of items as Gmail: SPF and DKIM, DMARC at p=none or higher, one-click unsubscribe, and a low complaint rate. Yahoo made them mandatory in February 2024, so they are not a 2026 rule change. Yahoo’s own wording is on its sender best practices page.

This post covers the DMARC requirement in depth, since it’s the one most ecommerce domains are still missing and the one with the most moving parts. For the other two, our Gmail spam rate threshold guide breaks down exactly what 0.1% and 0.3% mean and how Gmail measures them, our spam complaint rate guide covers where that number actually comes from, and our List-Unsubscribe header study found a 4.86x spam-risk gap between senders with and without the header.

The DMARC requirement, specifically

Gmail’s bar for DMARC is low on paper: a published record at _dmarc.yourdomain.com, set to at least p=none, with SPF or DKIM aligning to your visible From domain. What is DMARC? covers what that policy layer actually does if you need the fundamentals, and SPF, DKIM and DMARC explained covers how the three records interact.

The part that trips up ecommerce senders isn’t the policy value, it’s alignment. If you send through an ESP’s shared domain, SPF and DKIM can both pass while your DMARC still fails, because the authenticated domain never matches the domain your customers see in the From field. A basic checker reporting “SPF: pass, DKIM: pass” tells you nothing about whether DMARC itself is passing.

The enforcement timeline: from filtering to rejection

February 2024: Google and Yahoo made bulk sender requirements mandatory for anyone sending 5,000 or more messages a day. Non-compliant mail was filtered toward spam or deferred, a temporary failure your ESP could retry.

November 2025: Gmail began ramping up enforcement on non-compliant traffic, moving from educational warnings to temporary and permanent rejections for a growing share of it. A missing or misaligned DMARC record stopped being a deliverability footnote and became a delivery problem: the message doesn’t land in spam, it doesn’t land anywhere.

Gmail wasn’t the only provider that moved. Microsoft applied an equivalent requirement to Outlook, Hotmail, and Live.com starting May 5, 2025, with non-compliant bulk mail sent to Junk first and rejected later (550 5.7.515). Between the two, a meaningful share of any B2C list is now covered by enforcement, not just a filtering guideline.

If you are already seeing Gmail rejections, Gmail deliverability troubleshooting walks through the codes. For the complaint-rate side of the same rules, see Gmail’s spam rate thresholds. For what this costs you specifically on the mail that still gets delivered rather than outright rejected, our DMARC failure and spam folder study found DMARC-failing mail landing in spam more than twice as often as DMARC-passing mail, across InboxEagle’s monitored brands.

Do you actually send 5,000 a day?

Gmail’s threshold is 5,000 messages to Gmail accounts in a single day, not a sustained daily average. That’s a lower bar than it sounds. A brand with a modest subscriber list that sends one campaign to its full list in a day can cross 5,000 Gmail-addressed sends on that day alone, even if its typical daily volume looks nowhere close to that.

That’s a meaningful share of the active ecommerce brands InboxEagle monitors. Against that population, the 23.4%-of-14,101-domains figure above is a reasonable read on how many ecommerce senders are missing the DMARC requirement specifically: a brand running an active email program, which describes the domains in that dataset, is very likely to cross the threshold on at least one send day.

What happens if you’re non-compliant

Before November 2025, the consequence of missing DMARC was mostly reputational: lower trust signal, more spam-folder placement, nothing that stopped the mail outright. That’s no longer the full picture.

Non-compliant bulk mail to Gmail now risks a rejection, temporary or permanent, rather than quiet filtering. A permanent error shows in your ESP as a hard bounce, not a retry-later failure, and the recipient never sees it, not in their inbox, not in spam. For a Black Friday send, a welcome series, or any flow where a single missed email has a real cost, that’s a materially different risk than “might land in Promotions instead of the inbox.”

How to check your compliance

1. Confirm you’re actually in scope. If any single campaign reaches 5,000 or more Gmail-addressed recipients, you’re in scope from that point on, not just on days you cross it again.
2. Check SPF and DKIM. Confirm your SPF record includes your ESP and stays under the 10-lookup limit, and that DKIM is signing with a valid key.
3. Check your DMARC record. Confirm a record exists at _dmarc.yourdomain.com, is valid, and is set to at least p=none with a working rua= address. Compare DMARC checker tools if you want to see how different free options handle this check.
4. Check unsubscribe headers and complaint rate. Confirm your ESP adds the RFC 8058 headers, and that your complaint rate stays under 0.3%, ideally under 0.1%.

The bottom line

• Gmail’s bulk sender rule covers SPF, DKIM, DMARC, one-click unsubscribe, and complaint rate. This post covers DMARC; the other three have their own guides linked above.
• The threshold is 5,000 messages in a single day, not an average. Most active ecommerce senders cross it on campaign days whether or not their typical daily volume looks that high.
• Since November 2025, non-compliant mail risks outright rejection, not just spam placement. That changes the cost of getting this wrong from “lower open rate” to “the email never arrived.”
• DMARC is the gap most ecommerce domains still have. 23.4% of 14,101 domains InboxEagle checked had no record at all, the one requirement nothing sets up for you automatically.

Methodology

The domain-level DMARC statistic (23.4% of 14,101 ecommerce sending domains missing a DMARC record) comes from InboxEagle’s monitoring infrastructure, checked between 11 June and 11 September 2026, and is reported in full in our companion study on missing DMARC records. The dataset draws from InboxEagle’s monitored brands, which skew majority-ecommerce, rather than a random sample of the internet. Treating this population as largely subject to Gmail’s bulk sender rule rests on Gmail’s threshold being a single-day peak rather than a sustained average, not on a direct volume measurement. Enforcement dates and requirement details are sourced from Google’s own sender guidelines, linked throughout.