Who counts as a bulk sender (the 5,000 threshold)
The Google sender requirements — enforced since early 2024 and mirrored by Yahoo — split senders into two groups. The rules for everyone are light: authenticate with SPF or DKIM, keep valid forward and reverse DNS, and stay under the spam-rate line. The stricter set applies to bulk senders, which Google’s FAQ defines as any sender that sends close to 5,000 messages or more to personal Gmail accounts within a 24-hour period.
Two details in that definition matter more than the round number. First, it counts messages to personal Gmail accounts (addresses ending in gmail.com or googlemail.com) — mail to a company’s Google Workspace domain does not count toward the threshold. Second, the count is per primary domain: mail from mail.acme.com and get.acme.com all rolls up to acme.com, so you cannot dodge the threshold by spreading volume across subdomains.
The full requirements list, verified
Here is the consolidated list from Google’s email sender guidelines and Yahoo’s sender best practices, checked against the official pages rather than secondhand summaries:
| Requirement | All senders | Bulk senders (5,000+/day) |
|---|---|---|
| SPF / DKIM | SPF or DKIM required | Both SPF and DKIM required |
| DMARC | Not required | Required — p=none is accepted |
| From: alignment | Recommended | From: domain must align with SPF or DKIM domain |
| TLS in transit | Required (Google) | Required |
| Valid forward + reverse DNS (PTR) | Required | Required |
| Spam rate | Keep below 0.3% | Keep below 0.3%; under 0.1% recommended |
| One-click unsubscribe (RFC 8058) | Not required | Required for marketing/subscribed mail, honored within 2 days |
| Visible unsubscribe link in body | Not required | Required |
How to actually set up SPF, DKIM, and DMARC — records, alignment, rollout — lives in our dedicated SPF, DKIM and DMARC guide; we will not repeat it here. You can verify all three on your domain right now with the free deliverability checker.
The one-click unsubscribe requirement, precisely
This is the most misunderstood rule. “One-click unsubscribe” is not the link in your footer — it is a pair of message headers defined by RFC 8058 that let the mail client render its own native unsubscribe button (the one Gmail shows next to the sender name) and fire it with a single POST request:
List-Unsubscribe: <https://yourdomain.com/unsubscribe/abc123>
List-Unsubscribe-Post: List-Unsubscribe=One-ClickThe rules attached to it: bulk senders must include these headers on marketing and subscribed messages, must also keep a clearly visible unsubscribe link in the message body, and must honor the opt-out within two days — both Google and Yahoo state the two-day window. No login walls, no “manage your preferences” maze before the opt-out takes effect.
BusinessMCP suppresses the contact the moment the POST arrives rather than using the two-day allowance — a fast opt-out is cheaper than the spam report the recipient files when your next email shows up anyway.
One nuance for outbound teams: the headers are formally required for marketing and subscribed mail. Genuine one-to-one correspondence is a different category — but a sequenced cold campaign is not one-to-one correspondence in any meaningful sense, and under CAN-SPAM commercial email needs a working opt-out regardless. BusinessMCP adds the unsubscribe headers and footer link to every outreach email and applies suppression immediately rather than using the two-day grace.
The spam-rate line: 0.3%, and why 0.1% is the real target
The single number that decides most senders’ fate: the user-reported spam rate in Google Postmaster Tools. The requirement is to stay below 0.3%; Google’s recommendation is to stay below 0.1% and avoid ever reaching 0.3%. Yahoo publishes the same 0.3% line, measured on mail delivered to the inbox.
0.3%
The spam-rate line both Google and Yahoo publish — do not touch it
< 0.1%
Google’s recommended operating level
2 days
Maximum time to honor an unsubscribe (Google and Yahoo)
What crossing the line costs you: Google states that senders at or above 0.3% become ineligible for mitigation support — you cannot even file for help until the rate stays below 0.3% for seven consecutive days — alongside the delivery damage itself. And the math is unforgiving at small volume: 3 spam reports on 1,000 delivered messages is 0.3%. At outreach scale, a single bad batch to a stale list can put you over.
What this means for a B2B outbound team
Pulling it together into an operating posture:
- Authenticate fully now — SPF + DKIM + DMARC p=none on your sending domain, even at low volume. Setup walkthrough: SPF, DKIM & DMARC.
- Put outreach on its own domain so its reputation and thresholds are tracked separately from the mail your business runs on — the architecture is covered in cold email infrastructure.
- Keep one-click unsubscribe on everything sequenced and suppress instantly, not within the two-day allowance.
- Watch the spam rate where Google watches it — Postmaster Tools for the Gmail view, plus your platform’s bounce and complaint tracking for everything else.
- Keep volume steady — mailbox providers read sudden spikes as a spam pattern; caps and warmup ramps exist to enforce the shape they want to see.
BusinessMCP handles the mechanical layer on every outreach send — authentication via domain verification, the RFC 8058 headers and footer link, immediate suppression on complaint or bounce, a 200-a-day per-domain ceiling, and warmup ramping for cold domains — which leaves targeting quality as the one input only you control. The broader context (warmup schedules, bounce bands, the law) lives in the deliverability and compliance guide.
Frequently asked questions
Do the Gmail bulk sender rules apply to B2B email sent to company addresses?
The 5,000-a-day threshold specifically counts messages to personal Gmail accounts, so pure B2B volume to company domains rarely triggers formal bulk-sender status. But many work inboxes are Gmail-hosted via Google Workspace and run the same filters, so the practical answer is: meet the requirements anyway. They are cheap to meet and the same signals are evaluated either way.
Is a DMARC policy of p=none really enough for Google and Yahoo?
Yes — both explicitly accept p=none as meeting the bulk-sender DMARC requirement. It satisfies compliance and turns on failure reporting without any risk of blocking legitimate mail. Tightening to quarantine and then reject is still worth doing for anti-spoofing, on your own timeline.
What happens if my spam rate crosses 0.3%?
Deliverability to Gmail degrades, and Google states you lose eligibility for mitigation support until your Postmaster Tools spam rate stays below 0.3% for seven consecutive days. In practice recovery means stopping the campaign that caused it, cutting volume, and rebuilding on your best-targeted, most-engaged recipients — which is much slower than never crossing the line.
Does the one-click unsubscribe header apply to cold outreach?
Google and Yahoo frame the requirement around marketing and subscribed messages, and sequenced outreach is commercial mail — under CAN-SPAM it needs a working opt-out regardless. The safe and honest posture is to include the RFC 8058 headers plus a visible link on every sequenced send, and suppress immediately. That is what BusinessMCP does by default.
Do subdomains have their own 5,000-message threshold?
No. Google counts messages across your primary domain — mail from all subdomains rolls up together. Subdomains are still useful for separating reputation and organizing mail streams, but they are not a way around bulk-sender classification.
Sources
BusinessMCP Team
Every guide is written from running BusinessMCP on its own platform — the match rates, reply rates, and deliverability lessons are from our own data, not recycled blog folklore. About BusinessMCP
Turn your business into one AI-ready MCP server
Connect your tools, install one tracking script, and expose your unified data to any AI agent through a single secure endpoint.
Get started free