There is an invisible border in email. On one side, an ordinary sender nobody looks at. On the other, a bulk sender, subject to rules that are written down, measured, and lately enforced.
That border carries a number: five thousand.
Most companies cross it without knowing, on a Tuesday morning, by sending one more newsletter than usual.
What Google publishes, in black and white
The Gmail documentation is explicit: “A bulk sender is any email sender that sends close to 5,000 messages or more to personal Gmail accounts within a 24-hour period.”
Three clarifications matter more than the number itself.
First, the count only covers personal Gmail accounts. Your recipients at @company.com hosted on Google Workspace do not enter the calculation.
Second, sends from a domain and its subdomains add up. Google spells it out: “When we calculate the 5,000-message limit, we count all messages sent from the same primary domain.” Splitting your sending between news.example.com and info.example.com does not take you below the threshold.
Third, and this is the point nobody reads: bulk sender status does not expire. “Bulk sender status doesn’t have an expiration date. Email senders that have been classified as bulk senders are permanently classified as such. Changes in email sending practices will not affect permanent bulk sender status once it’s assigned.”
You take it once, you keep it, even if you drop back to three hundred messages a month.
What the status imposes
The list fits in six lines, and each one is grounds for rejection.
SPF or DKIM authentication for everyone, plus a valid DMARC record for bulk senders. The alignment required is relaxed: “only one of these needs to be aligned to meet the sender alignment requirements”.
A valid reverse DNS record for the sending IP address, consistent with the forward lookup.
A TLS connection for SMTP transport. Google writes: “Gmail requires all bulk email senders to use TLS/SSL for SMTP connections.”
One-click unsubscribe in promotional messages, honoured within 48 hours. A mailto link does not satisfy the requirement, and the specification governing that button is more demanding than its name suggests.
And above all a spam rate kept below 0.10 percent, never reaching 0.30 percent. That is the only number that really decides your fate.
November 2025: the end of the warning phase
For nearly two years these rules mostly produced warning notices. Then Google wrote this, and has left it online since:
“Starting November 2025, Gmail is ramping up its enforcement on non-compliant traffic. Messages that fail to meet the email sender requirements will experience disruptions, including temporary and permanent rejections.”
A permanent rejection is not a message filed under junk. It is a message that never arrives, and a non-delivery report nobody in your company reads.
Microsoft took the number, not the penalty
Microsoft announced aligned requirements in April 2025 for domains exceeding 5,000 messages a day to Outlook.com and Hotmail: SPF, DKIM, DMARC at p=none minimum, aligned on SPF or DKIM.
Enforcement began on 5 May 2025. But in an update published six days before the deadline, Microsoft swapped rejection for junk folder placement. That retreat is worth reading closely: it says something about an operator’s real ability to follow through on a threat.
Yahoo publishes no figure at all
On the question of volume, Yahoo’s answer is remarkably terse: “A ‘bulk’ sender is classified as an email sender sending a significant volume of mail. We will not specify a volume threshold.”
We will not specify a volume threshold. That refusal is not an oversight, and it concerns you more than the two previous figures.
The three operators, side by side
| Yahoo | Microsoft | ||
|---|---|---|---|
| Published threshold | 5,000 / 24 h | None, explicit refusal | 5,000 / day |
| Published spam rate | 0.1% target, 0.3% ceiling | 0.3% | Not published |
| Minimum DMARC | Valid record | p=none, quarantine or reject recommended | p=none |
| One-click unsubscribe | Required, 48 h | Required, 2 days | Working link, no standard or deadline |
| TLS explicitly required | Yes | Not published | Not published |
| Announced penalty | Temporary and permanent rejections | Non-compliance | Junk folder |
Three companies filtering the same global mail system, and three different levels of transparency. That is the first fact to absorb: there is no general compliance, only compliance per recipient.
What to do tomorrow morning
Count your sends to personal Gmail accounts over your busiest twenty-four hours of the year, not your average. That peak decides your status, and it never gives itself back.
Then check the six requirements one by one, reading your own headers rather than your provider’s dashboard. A report showing “compliant” without showing the Authentication-Results header proves nothing.
If your sending goes out from your own server, with your own credentials, you keep control of that reputation. That is Sestaro’s position on deliverability: verifying your SPF, DKIM and DMARC records, and never generating a key on your behalf.
And accept the uncomfortable idea: these rules are not best practices. They are the access conditions to a private infrastructure, written by its owner, revisable without notice.
Sources
- Google Workspace Admin Help. Email sender guidelines FAQ
- Gmail Help. Email sender guidelines
- Google (3 October 2023). New Gmail protections for a safer, less spammy inbox
- Yahoo Sender Hub. Frequently Asked Questions
- Yahoo Sender Hub. Best Practices
- Microsoft Defender for Office 365 Blog (2 April 2025, updated 30 April 2025). Strengthening Email Ecosystem: Outlook’s New Requirements for High-Volume Senders
LaFactory works email on the evidence: headers, DNS records, rejection logs. No open rate promises, ever. Get in touch for a deliverability audit.