Gmail and Yahoo's sender requirements, first rolled out together in 2024 and refined since, changed what "good enough" authentication looks like for anyone sending meaningful volume, and I still see accounts get caught out by pieces of this checklist that quietly slipped through the cracks. If you send 5,000 or more emails a day to either provider, these aren't optional anymore, they're the baseline for getting delivered at all, so let's go through what's actually required.
Gmail and Yahoo define a "bulk sender" as anyone sending roughly 5,000 or more emails a day to their respective domains, counted across a rolling window rather than a single send, so it catches senders who might not think of themselves as high volume if they're spread across several smaller campaigns. If you're under that threshold, these specific requirements aren't strictly enforced against you yet, but I'd still treat them as best practice regardless of volume, because everything on this checklist improves deliverability whether you're required to follow it or not, and providers have been known to lower thresholds over time rather than raise them.
This is the requirement that trips up the most senders, not because the concepts are hard, but because DMARC in particular is easy to configure incorrectly without realizing it. You need SPF and DKIM both correctly configured and passing, plus a DMARC record published for your sending domain, at minimum at policy p=none so you're monitoring, though I'd push clients toward p=quarantine once they've confirmed their legitimate mail is passing cleanly. Beyond that, your From address domain needs to align with either your SPF or DKIM domain, DMARC alignment, which is exactly the piece a custom Return-Path setup helps with; see custom Return-Path domain setup and SPF, DKIM, and DMARC setup if you haven't got this fully configured yet.
Bulk senders now need to support one-click unsubscribe via the List-Unsubscribe and List-Unsubscribe-Post headers, which is what powers the unsubscribe option Gmail and Yahoo show directly next to the sender name, not buried in your email footer. This has to actually work, honoring the request within two days according to Google's stated guidance, and it needs to be a genuine one-click action, not a redirect to a preference center that requires additional steps or a login. Most modern ESPs support this natively now, but it's worth confirming yours does and that it's actually enabled, rather than assuming it's on by default.
Gmail's Postmaster Tools reports a spam rate metric, and the guidance is to keep it under 0.10 percent, with 0.30 percent treated as a hard ceiling that risks blocking or significant filtering if you cross it, even briefly. This is measured through Gmail's own reporting, not something you can check elsewhere, so if you're sending real Gmail volume, Postmaster Tools access is close to mandatory for actually monitoring this rather than guessing. Crossing that threshold even once on a single send can trigger a period of degraded placement that outlasts the send itself, which is part of why list hygiene and permission-based sending matter so much more now than they used to.
Treat this as ongoing maintenance rather than a one-time setup, since Gmail and Yahoo have both shown they'll keep adjusting requirements as spam tactics evolve. Check Postmaster Tools regularly if you're a Gmail sender, confirm your unsubscribe flow actually works by testing it yourself every so often, and keep your DMARC policy monitored rather than set once and forgotten, since a legitimate change to your sending setup, a new tool, a new subdomain, can quietly break alignment if you're not watching for it. Across the accounts I've audited since these requirements rolled out, the ones still struggling almost always have one specific piece, usually DMARC alignment or the spam rate threshold, that they assumed was fine and never actually verified.
Officially they apply once you cross roughly 5,000 emails a day to Gmail or Yahoo, but the practices themselves, proper authentication, working unsubscribe, low spam rate, improve deliverability at any volume, so I'd follow them regardless.
Non-compliant bulk senders can see messages rejected outright, temporarily deferred, or routed straight to spam, and Gmail has been enforcing this actively rather than just issuing warnings.
Google Postmaster Tools shows this directly if you've verified your sending domain there; it's free and it's the only reliable source for this specific number.
Run the free Inbox Scorecard at /scorecard for a quick read, or book a full audit at /audit and I'll go through the whole checklist against your actual setup.