Yahoo refuses to publish its threshold, and that is information

by Francis Rozange | Sep 8, 2026 | Email Marketing

Abstract 3D render: a sealed opaque glass vault beside a blank unmarked measuring scale

Google publishes a threshold: five thousand messages a day. Microsoft publishes the same. Yahoo, asked about its own, answers this:

“A ‘bulk’ sender is classified as an email sender sending a significant volume of mail. We will not specify a volume threshold.”

A significant volume. We will not specify a threshold.

The temptation is to read that sentence as carelessness, or as a sign of documentation less polished than the competition’s. It is the opposite: it is the most considered sentence in the whole corpus.

A published threshold is an optimisable threshold

When Google announces 5,000 messages in 24 hours, it gives honest senders a clear rule. At the same moment it also gives a target to anyone who wants to stay just underneath.

Google has, in fact, closed the most obvious door: sends from a domain and its subdomains add up, and bulk sender status, once acquired, never expires. Two locks added because the number was public.

Yahoo never had to fit those locks. You cannot work around a threshold you do not know.

The cost of that choice is real, and it falls entirely on you: at Yahoo, you cannot declare yourself compliant. You can only be tolerated, and find out afterwards.

What Yahoo does publish is very precise

The silence covers volume only. On everything else, Yahoo’s documentation is more explicit than Microsoft’s.

The complaint rate must stay below 0.3 percent, exactly as at Google. That convergence between two competitors is the most solid fact in the file.

All senders must implement SPF and DKIM. Bulk senders must additionally publish a valid DMARC policy, at minimum p=none. Yahoo strongly recommends going further, to p=quarantine or p=reject, without requiring it.

The DKIM key must be at least 1024 bits, with 2048 recommended. That is an exact restatement of what the standard has said since 2018, and a useful reminder: many keys in production are shorter.

Reverse DNS records must be valid, meaningful and non-generic. A PTR of the form ip-91-121-33-12.provider.net passes the technical check and fails the “meaningful” test.

Unsubscribes must be honoured within two days, and the POST method of one-click unsubscribe is “highly recommended”.

Finally, the complaint feedback loop only works with DKIM-signed messages, and it is domain-based. Without DKIM you will never learn who complained at Yahoo.

The silence on TLS

Google writes in black and white that it requires TLS for bulk senders’ SMTP connections. On Yahoo’s best practices, FAQ and SMTP error code pages, we found no equivalent requirement.

We refrain from concluding that Yahoo accepts plaintext. The absence of a sentence in a piece of documentation does not prove the absence of the rule: it proves the absence of the sentence. That is a distinction this trade often forgets, and it applies equally to the figures everyone repeats without having read them.

Transparency is not a virtue, it is a strategy

Put the three operators side by side and you get three doctrines.

Google publishes a great deal, which lets it demand a great deal: you cannot hold a rejection against someone who wrote down their terms.

Microsoft publishes a threshold and an authentication requirement, with no complaint rate and no unsubscribe standard, and turned its announced rejection into junk folder placement six days before the deadline.

Yahoo publishes its technical requirements and keeps to itself the one variable a sender could adjust.

None of the three postures is more legitimate than the others. These are private infrastructures writing their own access conditions, and revising them when they see fit.

What to do tomorrow morning

Stop reasoning in terms of compliance and reason in terms of margins.

Compliance assumes a stable, public reference framework. You do not have one: you have three, one of them partly secret and one revisable without notice.

What holds in all three cases is short: complete and aligned authentication, a complaint rate kept far below the ceiling, a list where every address has an origin and actually exists, and an exit that works first time.

The rest is tuning to a threshold, and tuning to a threshold fails the day the threshold moves. That day always comes.

Sources

LaFactory works email on the evidence: headers, DNS records, rejection logs. No open rate promises, ever. Get in touch for a deliverability audit.