Grow your ecommerce store · Email marketing · 3 min read
Gmail and Yahoo Bulk Sender Rules for Online Stores
Short answer
If your store sends 5,000 or more emails a day to Gmail addresses, you must authenticate your domain with SPF, DKIM and DMARC, align the From address with one of them, offer one-click unsubscribe, and keep spam complaints under 0.3% (ideally under 0.1%); Yahoo and Outlook ask for much the same, and smaller senders still need SPF or DKIM.
Key takeaways
- Gmail's bulk sender threshold is 5,000 messages a day to personal Gmail accounts; once you cross it, the stricter rules apply to your domain.
- The core setup is SPF, DKIM and a DMARC record, all on the domain in your From address.
- Marketing emails need a one-click unsubscribe header and a visible unsubscribe link.
- Google wants spam complaints below 0.1% in Postmaster Tools and treats 0.3% as the line you must not reach.
- Since late 2025, mail that fails these rules is more likely to be rejected outright, not just sent to spam.
If your campaigns suddenly land in spam, or your email platform shows bounces you've never seen before, sender rules are the first thing to check. Since February 2024, Gmail and Yahoo have required bulk senders to prove who they are and make unsubscribing easy. Outlook added similar rules in 2025, and Google's enforcement got stricter from late 2025. Here's what applies to an online store and how to set it up.
Who counts as a bulk sender?
Google treats any domain that sends 5,000 or more messages a day to personal Gmail accounts as a bulk sender, and the label sticks once you've crossed it.
That number counts all mail from your domain, including campaigns, flows and order emails. A store with 20,000 subscribers sending one campaign crosses it easily, because most consumer lists are heavy on Gmail addresses. Microsoft uses the same 5,000-a-day figure for Outlook.com and Hotmail. Yahoo doesn't publish a threshold but asks bulk senders for the same basics.
If you're below the line, the lighter rules still apply: authenticate with SPF or DKIM, keep complaints low and send well-formed mail.
What do Gmail, Yahoo and Outlook require?
All three want an authenticated domain, a DMARC record, a working unsubscribe and low complaint rates.
| Requirement | Gmail (5,000+/day) | Yahoo | Outlook (5,000+/day) |
|---|---|---|---|
| SPF and DKIM | Both | Both | Both |
| DMARC record | Yes, p=none is enough | Yes | Yes, p=none at minimum |
| From domain aligned | With SPF or DKIM | Yes | Yes |
| One-click unsubscribe | Marketing mail | Marketing mail | Functional unsubscribe link expected |
| Spam rate | Under 0.1%, never 0.3% | Under 0.3% | Low complaints expected |
Google's own guidance sets two figures: keep spam rates reported in Postmaster Tools below 0.1%, and avoid ever reaching 0.3%. Mail that misses the rules can be delayed, sent to spam or rejected.
How do you set up SPF, DKIM and DMARC?
Add the DNS records your email platform gives you to your store's domain, then publish a DMARC record that starts at p=none.
A plain-English version of each:
- SPF lists which servers may send mail for your domain.
- DKIM adds a signature to each message that proves it came from your domain and wasn't changed.
- DMARC tells mailbox providers what to do when SPF or DKIM fail, and sends you reports.
Most stores set this up in one sitting:
- In Shopify Email, Klaviyo, Mailchimp or your platform, find the domain authentication or sending domain page.
- Copy the CNAME or TXT records it shows into your domain's DNS settings, wherever your domain is managed.
- Add a DMARC TXT record at
_dmarc.yourdomain.com, starting withv=DMARC1; p=none; rua=mailto:plus an address for reports. - Wait for DNS to update, then use the platform's "verify" button.
- Send a test to a Gmail account, open the message menu and choose "Show original" to confirm SPF, DKIM and DMARC say PASS.
Use one sending address on your own domain, such as hello@yourstore.com. Sending marketing from a free Gmail or Yahoo address will fail DMARC at the big providers.
What counts as one-click unsubscribe?
One-click unsubscribe is a header in the email that lets Gmail and Yahoo show their own unsubscribe button, which removes the person without a login or survey.
Your email platform adds the header for marketing mail once your domain is set up. You still need a visible unsubscribe link in the body. Google's sender FAQ asks bulk senders to process unsubscribes within two days. Don't hide the link in gray six-point text; a person who can't find it presses "Report spam", and that hurts far more than a lost subscriber.
How do you keep spam complaints low?
Send to people who expect your email, at a pace they agreed to, and remove people who stopped opening.
The rule changes made list hygiene a deliverability issue, not just a tidiness one. The habits that matter most:
- Use confirmed opt-in for pop-up signups, so typo and bot addresses never join.
- Say in the signup form what you'll send and how often.
- Sunset subscribers who haven't opened or clicked in four to six months, after one win-back email.
- Never import purchased or scraped lists.
- Watch complaint rates in Google Postmaster Tools, which is free once you verify your domain.
Our guide to ecommerce email marketing strategies covers segmentation and frequency, and abandoned cart emails in Shopify shows a flow that earns opens without extra campaigns.
What happens if you ignore the rules?
Unauthenticated or high-complaint mail is increasingly rejected outright, so customers never see it, not even in spam.
Rejections show up as bounces in your email platform. If bounce rates jump after a send, check authentication first, then complaint rates. Fixing DNS records takes an afternoon. Rebuilding a sender reputation after weeks of complaints takes much longer, which is why it pays to set this up before your list is big enough to need it.
Frequently asked questions
Do these rules apply to small Shopify stores?
The full bulk sender list applies at 5,000 or more messages a day to Gmail. Every sender, however small, still needs SPF or DKIM, a low spam rate and properly formatted mail. Setting up all three records is worth doing early, because your list will grow.
Does Shopify Email or Klaviyo handle authentication for me?
They handle part of it. Both ask you to authenticate your own sending domain by adding DNS records they generate. Until you do, mail may go out from a shared domain, which ties your deliverability to other senders.
What DMARC policy should I start with?
Start with p=none, which Google accepts and which only asks for reports. Once reports show that all your legitimate mail passes, you can move to quarantine and later reject for stronger protection against spoofing.
Do order confirmations need an unsubscribe link?
One-click unsubscribe is required for marketing and subscribed messages. Transactional emails such as order confirmations and shipping updates are exempt, though they still need authentication.
Sources and further reading
Platform features, prices and policies change. Check the official help pages linked above before you act on a detail that matters to your store.