Google bulk sender guidelines, plus Outlook.com and Yahoo rules

What Google's sender guidelines require

Google's "Bulk sender guidelines" are now called the Email sender guidelines, and part of them applies to every sender, whatever their volume. They cover mail sent to personal Gmail accounts, meaning addresses ending @gmail.com or @googlemail.com:

Google also says sending to personal Gmail accounts needs a DKIM key of at least 1,024 bits, and recommends 2,048 bits. Messages that are not authenticated may be marked as spam or rejected with a 5.7.26 error.

Two scope points catch people out. The guidelines do not apply to mail sent to Google Workspace accounts, so mail to a business that uses Gmail for work is not judged by these rules. They do apply to Google Workspace users sending to personal Gmail addresses, so moving to Google Workspace does not exempt you.

Who counts as a bulk sender

Google defines a bulk sender as one that sends close to 5,000 messages or more to personal Gmail accounts within 24 hours. Three details matter:

• It counts by primary domain. Mail from example.co.uk and news.example.co.uk is added together, because both share the primary domain example.co.uk.
• It is permanent. Google says a sender that meets the threshold once is classified as a bulk sender for good, and changing your sending habits later does not remove the status.
• New domains are enforced faster. Google says domains that had not sent more than 5,000 messages a day to Gmail since 1 January 2024 are on an accelerated enforcement timetable.

An ordinary business can cross the line without running a mailing list of its own. Every system that sends as your domain counts: the marketing platform, the CRM, invoicing and payroll tools, the helpdesk and website forms. A seasonal campaign or a large customer notification can be enough. The safest approach is to meet the bulk requirements whatever your volume, because they are good practice anyway.

How Gmail enforces the rules

Google describes enforcement as gradual and progressive, and its FAQ says that from November 2025 Gmail ramped up enforcement on non-compliant traffic, including temporary and permanent rejections. Rejected messages carry an error code that names the problem:

Codes beginning 4 are temporary (rate limiting); codes beginning 5 are permanent blocks. Spam rate is handled differently: Google says to keep the user-reported rate below 0.1% and stop it reaching 0.3%, and bulk senders above 0.3% are not eligible for mitigation until they have stayed below it for seven consecutive days.

Register your domain in Google Postmaster Tools. Google has added a Compliance status dashboard there, which shows whether you meet each requirement.

Outlook.com and Yahoo rules compared

Microsoft and Yahoo apply similar rules to their consumer mailboxes. They overlap, but they are not identical:

Microsoft's position on what happens to non-compliant mail has moved. Its original announcement said such mail would go to Junk first, with rejection later; its 29 April 2025 update says messages that fail are rejected with the error 550 5.7.515, while its postmaster site still describes Junk routing. Treat either outcome as possible and fix the cause. Microsoft also recommends valid From and Reply-To addresses, list hygiene and transparent mailing practices.

Compliance checklist

This checklist covers all three providers. Work through it for every domain and subdomain that sends mail:

1. List every sending service: Microsoft 365 or Google Workspace, marketing and CRM platforms, invoicing, payroll, helpdesk, website forms and any on-premises servers.
2. Publish one SPF record per domain that includes every service and stays within the ten DNS lookup limit.
3. Turn on DKIM for each service using your own domain, not the provider's default, ideally with 2,048-bit keys.
4. Publish DMARC with at least p=none and a reporting address, so you can see what passes and what fails.
5. Check alignment for each service: the domain in the From address must match the domain that passed SPF or DKIM.
6. Set up one-click unsubscribe in every platform that sends marketing or subscribed mail, and remove people promptly when they ask.
7. Check TLS and reverse DNS for anything you host yourself; Microsoft 365, Google Workspace and mainstream sending platforms handle these for you.
8. Register in Google Postmaster Tools and watch the spam rate and compliance dashboard.

To check a single message, send one to a Gmail address, open it and choose More, then Show original. The header view shows whether SPF, DKIM and DMARC passed and which domains they used.

Why marketing platforms and CRMs fail alignment

Alignment failures often come from third-party platforms rather than the main mail system. Many services send with their own domain in the envelope address and sign with their own DKIM key by default. SPF and DKIM can both pass, yet DMARC still fails because neither passing domain matches your From address.

The fix is the platform's domain authentication or custom sending domain option, which usually means adding a DKIM record (and sometimes a custom return-path) for your domain. Microsoft recommends putting services you do not directly control on a subdomain such as news.example.co.uk, so their reputation does not affect your staff's mail. Each subdomain gets its own SPF record and its own lookup budget, and it inherits your main DMARC policy unless you give it one of its own.

p=none meets the rule but does not protect you

All three providers accept a DMARC policy of p=none. That meets the deliverability requirement and gets you reports, but it asks receivers to take no action against spoofed mail. Criminals can still send messages that appear to come from your exact domain.

Treat the sender rules as the reason to start, then finish the job: use the reports to fix every legitimate sender and move to quarantine and reject. Our page on the "DMARC policy not enabled" warning sets out a safe path, and our sister site's DMARC guide covers the record itself.

How we help

Forever Systems can audit every domain and sending service you use, help fix SPF, DKIM and alignment for each platform, set up DMARC reporting so you can see where you stand against the Google, Microsoft and Yahoo rules, then help you move on to enforcement. Where a hosted tool makes sense, we supply options such as Valimail and IRONSCALES DMARC per domain; pricing is confirmed at quote. Contact us if mail to Gmail, Outlook.com or Yahoo is being rejected or sent to spam.