Gmail, Yahoo and Outlook bulk sender rules: a guide for Indian brands

If your brand sends newsletters, offers or order updates to customers with Gmail, Yahoo or Outlook addresses, the rules for getting into the inbox changed between 2024 and 2025. They are no longer suggestions. Since November 2025, Gmail has been delaying and rejecting mail that does not meet its sender requirements, and Microsoft rejects non-compliant bulk mail to Outlook.com, Hotmail and Live addresses.

Most Indian customer lists are dominated by Gmail addresses, so this matters even for mid-sized D2C brands, clinics and education businesses. Here is what the rules say and how to meet them.

Who counts as a bulk sender

Gmail defines a bulk sender as anyone who sends close to 5,000 or more messages to personal Gmail accounts within 24 hours. Two details catch people out:

The count covers all mail from your primary domain, including subdomains. Your newsletter tool, CRM, helpdesk and Shopify notifications all add up.
Once you are treated as a bulk sender, you stay one. Dropping below 5,000 a day later does not reset your status.

Microsoft uses the same 5,000-per-day line for its consumer domains (outlook.com, hotmail.com, live.com). Yahoo does not publish a fixed number and expects its rules to be followed by anyone sending at meaningful volume.

The practical answer: if you send marketing email at all, meet the bulk sender rules. They are good practice at any volume.

The requirements at a glance

Requirement	Gmail	Yahoo	Outlook
SPF and DKIM both set up	Yes (bulk)	Yes (bulk)	Yes (5,000+/day)
DMARC record, at least p=none	Yes	Yes	Yes
From domain aligned with SPF or DKIM	Yes	Yes	Yes
One-click unsubscribe on marketing mail	Yes, RFC 8058	Yes, RFC 8058	Strongly recommended
Spam complaint rate	Below 0.3%	Below 0.3%	Expected to stay low
Valid forward and reverse DNS, TLS	Yes	Yes	Expected

SPF, DKIM and DMARC in plain terms

SPF lists the servers allowed to send mail for your domain. DKIM adds a cryptographic signature that proves the message was not altered and came from a domain you control. DMARC tells mailbox providers what to do when a message fails those checks and sends you reports about who is sending as you.

Alignment is the part most setups miss. The domain in the visible From address (for example, offers@yourbrand.in) must match the domain that passed SPF or DKIM. If your email platform signs with its own domain instead of yours, DKIM passes but does not align, and DMARC fails. Always set up custom DKIM (sometimes called domain authentication) in your email tool.

Example DNS records

These are illustrative. Your email platform will give you the exact values.

; SPF: one record only, listing every service that sends as you
yourbrand.in.                 TXT    "v=spf1 include:_spf.google.com include:sendgrid.net ~all"

; DKIM: published by your email platform, usually as a CNAME or TXT
s1._domainkey.yourbrand.in.   CNAME  s1.domainkey.u1234567.wl.sendgrid.net.

; DMARC: start with monitoring, then tighten
_dmarc.yourbrand.in.          TXT    "v=DMARC1; p=none; rua=mailto:dmarc-reports@yourbrand.in; adkim=r; aspf=r"

Common mistakes we see in audits of Indian domains:

Two SPF records. Adding a second v=spf1 record when a new tool is added. Only one is allowed; merge them.
Too many lookups. SPF allows a maximum of 10 DNS lookups. Brands using Google Workspace, Zoho, a CRM, a helpdesk and two marketing tools often go over the limit, which causes SPF to fail.
No DMARC at all, or a DMARC record on the wrong host (it must be at _dmarc).
Forgotten senders. The billing system or the agency’s old tool is still sending invoices from your domain without authentication.

Moving DMARC beyond p=none

p=none meets the minimum requirement, but it does not protect your brand from spoofing. Read your DMARC aggregate reports for a few weeks, fix every legitimate source that fails, then move to p=quarantine and later p=reject. A reporting tool makes the XML reports readable.

One-click unsubscribe (RFC 8058)

Marketing and promotional messages must include a one-click unsubscribe that works without the subscriber logging in or confirming anything. This is done with two email headers:

List-Unsubscribe: <https://mail.yourbrand.in/u/7f3a9c>, <mailto:unsubscribe@yourbrand.in?subject=unsubscribe>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

When a Gmail or Yahoo user clicks “Unsubscribe” next to your sender name, the mailbox provider sends a POST request to your HTTPS link and the person is removed. Points to check:

The HTTPS URL must accept a POST request and unsubscribe the person without further steps.
Both headers should be covered by your DKIM signature.
Unsubscribes must be processed within two days.
Keep a visible unsubscribe link in the email body as well.

Most established email platforms add these headers automatically. If you send through your own SMTP setup or a custom application, check the raw headers of a test email yourself.

Transactional email (OTPs, order confirmations, shipping updates) does not need one-click unsubscribe, but do not slip promotional content into those messages.

Keep your spam rate under 0.3%

Gmail and Yahoo both use a spam complaint threshold of 0.3%: three complaints per thousand delivered messages. Google’s guidance is to stay below 0.1% and never reach 0.3%. Going over it repeatedly makes inbox placement much harder to win back.

What moves this number in practice:

Consent. Purchased lists, scraped lists and “everyone who ever filled a form” lists produce complaints. Send only to people who asked to hear from you.
Expectations. Tell subscribers at signup what you will send and how often, then stick to it.
Sunset policy. Stop mailing people who have not clicked or purchased in 6 to 12 months, or run a re-permission campaign first.
Festive season discipline. Diwali and end-of-season sales tempt brands to email the whole database daily. Complaint rates spike and January deliverability suffers.
Clear sender name. Use a From name people recognise, such as your brand name, not a person’s first name they have never heard of.

Use Google Postmaster Tools

Google Postmaster Tools is free and shows how Gmail sees your domain. Google replaced the old interface with Postmaster Tools v2 in late 2025. The old Domain Reputation and IP Reputation dashboards were retired, and v2 includes a Compliance status dashboard that shows whether your domain meets each sender requirement.

To set it up:

Sign in at postmaster.google.com with a Google account.
Add your sending domain and verify it with a TXT record.
Check the spam rate and compliance status weekly, and after every large campaign.

Data only appears once you send enough daily volume to Gmail users, so smaller senders may see gaps.

Microsoft offers Smart Network Data Services (SNDS) for IP-level data, and Yahoo runs a sender hub with its own guidance and complaint feedback loop.

A compliance checklist

What happens if you do nothing

Non-compliant mail is now temporarily deferred or permanently rejected by Gmail, and Outlook returns errors such as 550 5.7.515 Access denied for bulk mail that fails authentication. Your platform may show these as bounces. Revenue from email drops without an obvious cause, and order confirmations can be caught in the same problem if they share a domain with your campaigns.

If you are not sure where your domain stands, our free audit checks your SPF, DKIM, DMARC and unsubscribe setup and tells you what to fix first.