In February 2024, Gmail and Yahoo turned long-standing "best practice" advice into a hard wall: bulk senders who don't meet the new rules see their messages quietly diverted to spam, or rejected outright. The thresholds are tighter than most teams realise, and the requirements aren't obvious from the public announcements. Here's exactly what changed and how to comply.
Who counts as a 'bulk sender'?
Gmail's threshold is 5,000 messages per day to Gmail accounts from the same domain. Yahoo's is the same to Yahoo accounts. The day is rolling, not calendar.
If you operate a SaaS that sends transactional + marketing email from a single domain, you cross 5K/day faster than expected — a mid-size B2B SaaS doing receipts, password resets, weekly digests, and cold outreach can hit 5K Gmail addresses inside a Tuesday.
The 5K threshold is the floor for enforcement. The rules themselves apply to everyone — they're the new baseline for deliverability. If you're below 5K, you won't get blocked, but your inbox placement will quietly degrade.
The 5 requirements, in plain terms
1. Authenticate every message with SPF, DKIM, and DMARC
All three. DKIM is the load-bearing one for cold outreach — SPF alone isn't enough because forwarders break it. DMARC must be published at minimum p=none, with a valid reporting address. Without it, receivers can't tell your real mail from spoofed mail.
We cover the setup in the SPF / DKIM / DMARC guide.
2. Ship a List-Unsubscribe header (RFC 8058 one-click)
Every bulk message must include both:
List-Unsubscribe: <mailto:unsubscribe@yourdomain.com>, <https://yourdomain.com/u/abc123>
List-Unsubscribe-Post: List-Unsubscribe=One-ClickThe List-Unsubscribe-Post line is the new part. It signals to Gmail's automated "Unsubscribe" button that your URL accepts a POST with that exact body — the receiver POSTs, you unsubscribe the user, no confirmation page allowed. The whole round trip takes a click.
If your tool only ships the old List-Unsubscribe header (or worse, ships nothing and relies only on a visible link in the body), you're not compliant. Gmail will keep showing the automated Unsubscribe button on your messages — but underneath, the receiver knows you don't honour it and adjusts your reputation accordingly.
3. Keep your spam complaint rate under 0.3%
Gmail's threshold for trouble: 0.3%. Their target for good standing: 0.1%. The rate is measured per-domain, over a rolling window of recent volume.
One in three hundred recipients clicking "Mark as spam" is enough to start a slide. Three things move this number more than anything else:
- List quality. Sending to people who can't place who you are produces complaints regardless of copy.
- Frequency. A second email within 48 hours of the first doubles complaints. Wait 5+ days between follow-ups.
- Subject line honesty. "RE: your enquiry" when there was no enquiry is the fastest way to a complaint.
4. Send from a domain you actually own (no shared-pool senders)
The From: header must match the authenticated domain (DMARC alignment). You can't use a free mailbox or a sender service's pooled domain as your visible From: address. This is why "send through your own SMTP" is now a hard recommendation, not a preference — pooled-IP senders inherit each other's reputation for better and worse.
5. Use TLS for transport
Every connection between your SMTP and the receiver must be encrypted with TLS. This is a 99% solved problem — every major SMTP host uses STARTTLS by default — but check that you haven't accidentally disabled it on a self-hosted relay.
What actually gets enforced (and what's a soft hint)
The five rules above aren't enforced equally. From observed behaviour:
- Authentication failures are hard-enforced. Messages without DKIM-aligned authentication get filtered or rejected immediately.
- Missing List-Unsubscribe headers hurt your sender reputation gradually. You won't get a bounce; your inbox rate just slides week over week.
- Complaint rate is the killer over the long term. Above 0.3%, expect bulk filtering of your domain within days, not weeks. Reputation takes 4–6 weeks to recover.
- Domain ownership matters mostly for DMARC alignment — if you set
p=rejectand the From: doesn't align with the authenticated domain, the message bounces.
Checklist before your next campaign
- Send one test message to yourself on Gmail and on Yahoo. Open "Show original" — confirm SPF, DKIM, and DMARC all say PASS.
- In the same view, search the raw source for
List-Unsubscribe. The header should appear once, with both amailto:and anhttps://URL inside angle brackets, and theList-Unsubscribe-Postline right below it. - Click the automated "Unsubscribe" button at the top of the Gmail message. The receiver should POST to your URL and the address should be flagged as unsubscribed in your tool within seconds. If nothing happens visibly, your headers are wrong.
- Look at your DMARC aggregate reports for the last 2 weeks. "dmarc=fail" on legitimate sends means a sender isn't aligning. Fix before tightening the policy.
- Pull your last 30 days of campaigns and compute the actual complaint rate. Below 0.1% — you're fine. Between 0.1% and 0.3% — review list quality. Above 0.3% — stop sending until you understand why.
What ProspectFlow does by default
Every outbound message ships with the full RFC 8058 stack — visible Unsubscribe link in HTML + text, List-Unsubscribe and List-Unsubscribe-Post headers — without any configuration. Opt-outs are honoured tenant-wide within seconds: the moment a recipient clicks Unsubscribe (or Gmail's automated button POSTs to us), they're excluded from every future campaign you ever run, including the one currently in the queue.
We also catch hard bounces from your IMAP and flag the corresponding prospects so dead addresses stop being retried — which is the other side of keeping your domain's reputation clean. Authentication (SPF/DKIM/DMARC) lives on your domain, not ours, so you remain in control of that.