In February 2024, Gmail and Yahoo stopped asking nicely. What used to be best practices - authentication, easy unsubscribe, low complaint rates - became hard requirements for anyone sending bulk email, and messages that fail them are increasingly rejected outright rather than filtered to spam. Enforcement has tightened every year since, and in 2026 the grace periods are over. This guide explains what the rules actually say, what changed recently, and which parts you need to act on versus which parts a sending platform should be handling for you.
Who counts as a bulk sender
The threshold is 5,000 or more messages per day to a provider's consumer addresses - Gmail addresses for Google's rules, Yahoo addresses for Yahoo's. Two details make it stricter than it sounds. It is measured across your whole organizational domain, so all subdomains count together. And the classification is permanent: one high-volume day is enough to make you a bulk sender for good, even if your volume drops afterwards. If you run a store with any meaningful list, assume the bulk rules apply to you.
Senders below the threshold are not off the hook - a baseline applies to everyone: SPF or DKIM at minimum, valid reverse DNS, TLS in transit, and a spam rate that stays low. The bulk rules simply add more on top.
The requirements, in plain language
- SPF and DKIM, both. The two DNS records that prove mail from your domain is authorized and untampered. If the acronyms are new, our plain-language explainer covers them in ten minutes.
- A DMARC policy. At minimum
p=none, published in DNS, with your visible From domain aligned with the domain that authenticated the message. - One-click unsubscribe. Marketing messages must carry RFC 8058 headers (
List-UnsubscribeandList-Unsubscribe-Post) so recipients can leave with a single click at the top of the inbox, without a preference-center detour. Requests must be honored quickly - the tolerated window is now two days, and re-adding someone who unsubscribed is penalized. - Spam complaints below 0.3 percent. That is the hard ceiling. The realistic operating target is 0.1 percent, because sitting between the two already costs you inbox placement.
One exemption worth knowing: one-click unsubscribe applies to marketing and promotional mail, not to transactional messages like order confirmations, shipping notices or password resets. Those exist because the recipient did something, and providers do not ask you to put an opt-out on a receipt.
What changed in 2026
The rules themselves are stable; the enforcement is not. Messages from bulk senders without compliant unsubscribe headers now face rejection at delivery time rather than quiet spam foldering. The unsubscribe honor window shrank from ten days to two. And both providers now track whether unsubscribes are actually honored, not just whether the header is present. The practical effect: a sender who half-implemented the rules in 2024 and got away with it will see hard bounces in 2026.
What you have to do yourself
Two things are genuinely yours. First, authenticate your sending domain: SPF, DKIM and DMARC are DNS records only you can publish. In MailingPlatform the domain settings generate the exact records and verify them live, so this is an afternoon task, not a project.
Second, keep complaints low - and that is a list quality question, not a technical one. Send to people who asked to hear from you, make leaving easy, and stop mailing contacts who have gone silent. A win-back flow with an exit into a sunset segment handles the silent ones gracefully. Double opt-in at signup keeps mistyped and fake addresses off the list in the first place.
What your platform should handle
The rest is infrastructure, and if you are doing it manually your platform is underdelivering. MailingPlatform adds the RFC 8058 one-click unsubscribe headers to every marketing send, processes unsubscribes immediately rather than within the two-day window, keeps suppressed contacts suppressed across your account, and routes mail through authenticated infrastructure with aligned domains. Complaint and bounce signals feed back automatically, so a problem shows up in your dashboard before it shows up as a blocked campaign.
The senders who struggle with these rules are the ones treating them as a checklist to pass once. Treat them as what they are - a description of how a respectful sender behaves - and compliance is mostly a side effect. Start with the DNS records, verify them, and let the platform carry the rest.