Google and Yahoo sender requirements: what a small business must do

What changed, and when?

Google and Yahoo both began enforcing new rules in February 2024 for anyone sending email to their users (for Google, that means personal Gmail accounts). The rules weren't new ideas. They turned long-standing best practices (authenticate your mail, make unsubscribing easy, don't annoy people) into requirements with consequences.

Enforcement has tightened since. Google's sender FAQ says that from June 2024, bulk senders with a user-reported spam rate above 0.3% became ineligible for mitigation, and that starting November 2025 Gmail is "ramping up its enforcement on non-compliant traffic," with messages that fail the requirements facing temporary and permanent rejections (Google sender guidelines FAQ).

For a small service business, the effect is simple. If your quotes, invoices or seasonal emails are sent in a way that breaks these rules, more of them can land in spam or be rejected before they reach Gmail and Yahoo customers.

What must every sender do?

Google's email sender guidelines and Yahoo's Sender Hub best practices set a baseline that applies even if you send ten emails a week:

If you send through Google Workspace, Microsoft 365 or an established email platform, the provider normally handles the server-side items (TLS, reverse DNS, message format); confirm it in their documentation. The parts you own are your domain's DNS records and your spam rate.

Who counts as a bulk sender?

Google's FAQ defines a bulk sender as "any email sender that sends close to 5,000 messages or more to personal Gmail accounts within a 24-hour period." Three details matter:

• It counts messages to personal Gmail accounts (gmail.com and googlemail.com), not your whole list.
• It counts everything from your primary domain, not just one tool. Google's example adds mail from a subdomain such as promotions.example.com to mail from example.com. Marketing email, invoices and notifications from the same domain add together.
• It doesn't wear off. Google says senders who meet the definition even once are permanently considered bulk senders, and changing your sending practices later doesn't remove the status.

Yahoo uses the word "bulk" without a number. Its sender FAQ says a bulk sender is one sending "a significant volume of mail" and that it will not specify a volume threshold.

Most small contractors never come close. But a company that emails a list of 20,000 past customers in one day crosses Google's line if a quarter of those addresses are personal Gmail accounts (5,000 of 20,000), and from then on it is held to the bulk rules permanently. Since Yahoo publishes no number at all, the easy answer is to meet the bulk requirements anyway. None of them is hard, and Google recommends SPF, DKIM and DMARC for every domain.

What else must bulk senders do?

On top of the baseline, bulk senders to Gmail and Yahoo must:

• Authenticate with both SPF and DKIM, not one or the other.
• Publish a DMARC record. Both providers accept a policy of p=none.
• Align the From domain with either the SPF domain or the DKIM domain, so the address customers see is the one being authenticated.
• Support one-click unsubscribe on marketing and promotional messages, using the List-Unsubscribe headers. Yahoo highly recommends the POST method defined in RFC 8058 and accepts a mailto method; Google says mailto and plain URL links don't meet its one-click requirement.
• Keep a visible unsubscribe link in the message body as well. Both providers ask for one, and it can point to a preferences page.
• Honor unsubscribes quickly. Yahoo requires bulk senders to honor them within 2 days. Google's FAQ recommends fulfilling them within 48 hours, and lists not doing so among the issues that make a sender ineligible for delivery support.
• Keep the spam rate below 0.3%, and per Google, ideally below 0.1%.

If SPF, DKIM, DMARC and alignment sound like alphabet soup, our guide on SPF, DKIM and DMARC explains each record with examples.

How does one-click unsubscribe work?

One-click unsubscribe is not the "unsubscribe" link in your footer, although you still need that. It is a pair of email headers (List-Unsubscribe and List-Unsubscribe-Post) that the reader never sees. They let Gmail or Yahoo offer their own unsubscribe option at the top of the message, next to your name. When someone uses it, the mailbox provider sends a request to your email platform, which removes the address with no login, no "are you sure" page and no preference center. Google says it shows that button only for messages that pass its automated eligibility checks, so correct headers alone don't guarantee it appears.

Google's FAQ says one-click unsubscribe is required only for marketing and promotional messages; transactional messages such as password resets, reservation confirmations and form submission confirmations are excluded. For a service business, that usually means your seasonal campaign needs it and a plain invoice email doesn't. Google adds that recipients, not Google, determine the nature of the messages they receive, so an "invoice" stuffed with promotions can still draw spam reports.

Major email marketing platforms generally add these headers for you; confirm it in your platform's documentation. Where you need to check is mail sent from your CRM or website: if it sends marketing (a review request with an offer, a seasonal promotion), it needs the headers too, and the unsubscribe has to reach the same list your marketing tool uses.

What about email sent from your CRM and website?

This is where small businesses often get caught. The marketing platform is set up properly because its onboarding forced you to do it. But the quote emails from your field software, the "new request" notifications from your website form, and the receipts from your payment processor all send as your domain too, often through servers you have never thought about.

Each of those tools needs to be included in your SPF record or sign with DKIM for your domain, or Gmail sees mail claiming to be you that fails authentication. Google says unauthenticated messages might be marked as spam or rejected. Once you publish DMARC at quarantine or reject, Google says it generally applies that policy, so the failing mail goes to spam or is rejected.

A few specific things to check:

• Quote and invoice emails. Send one to a personal Gmail address and use "Show original" to see whether SPF, DKIM and DMARC pass for your domain.
• Website form notifications. Many website forms send "from" your own address through the web host's server, which is a classic authentication failure. A form that feeds your CRM directly avoids this.
• Review requests and follow-ups. If your CRM sends anything promotional, it needs one-click unsubscribe, and unsubscribes there must reach your marketing list.

If you are moving to a new CRM, make domain authentication part of the setup checklist. Our guide on switching CRMs covers the rest of that list.

How can you tell if you have a problem?

Signs that your mail is failing these requirements: customers say they never got the quote; replies drop off suddenly after a campaign; your platform reports a jump in bounces with messages mentioning authentication or policy; Postmaster Tools shows a rising spam rate. Any one of these is a reason to test your records the same day rather than waiting for the next campaign.

How do you keep your spam rate low?

Google defines spam rate as the percent of your messages delivered to engaged recipients' inboxes that those recipients then mark as spam. It shows the rate in Google Postmaster Tools, which you set up by adding and verifying your domain; Google notes the dashboards may not show all data on days when your volume is low. The limit is 0.3%, which means three complaints per thousand messages, and Google wants you under 0.1%, one per thousand. That is not many.

• Mail only people who know you. Past customers and people who asked to hear from you. Yahoo tells senders not to buy mailing lists or use pre-checked opt-in boxes.
• Say who you are in the From name and first line. Google's display name guidelines say the name should identify the sender and not carry subject or sales content. "Sam at Example Exteriors" fits that; "LAST CHANCE: Exterior Deals" doesn't.
• Send what you promised, when it is relevant. A gutter reminder in spring, not a generic newsletter every week. Yahoo asks senders to keep to the frequency people signed up for.
• Clean the list. Google suggests considering unsubscribing people who don't open or read your messages, and automatically unsubscribing addresses with multiple bounces. Yahoo asks senders to remove invalid recipients promptly.
• Raise volume gradually. Google lists increasing sending volume gradually among the practices it checks before showing its unsubscribe button. If you are about to email your whole list for the first time, ask your platform about sending it in batches.

What should a small business check this week?

1. Look up your domain's SPF record. Confirm there is exactly one and it lists every service that sends as you. The free email domain check reads it, along with your DKIM and DMARC records.
2. Confirm DKIM is turned on and signing with your domain in your mailbox provider and each email tool.
3. Publish a DMARC record with at least p=none and a reporting address.
4. Check that marketing emails carry one-click unsubscribe headers and that unsubscribes sync to your CRM.
5. Set up Google Postmaster Tools and watch your spam rate after each campaign.
6. Make sure your campaigns also follow CAN-SPAM, which is federal law, separate from these provider rules. Our contractor email marketing guide covers it.

This guide explains the mailbox providers' published rules as of October 2026. Nothing here is legal advice. For questions about CAN-SPAM or your consent practices, talk to a lawyer.

Our business email service sets up and checks the authentication records, and our email marketing service sends campaigns that meet the bulk sender rules from day one.

Frequently asked questions