Gmail Bulk Sender Requirements Explained

Gmail bulk sender requirements apply if you send close to 5,000 or more messages a day to personal Gmail accounts. You need SPF, DKIM, a DMARC policy with alignment, one-click unsubscribe, TLS and low spam rates.

The rules are easy to summarise and surprisingly easy to get slightly wrong. This guide walks through each requirement, shows the DNS and header syntax, and explains how to verify that your domain passes.

Who counts as a bulk sender for Gmail?

Google defines a bulk sender as a sender that sends close to 5,000 messages or more to personal Gmail accounts within a 24-hour period. Mail from subdomains of the same primary domain is counted together, and once a domain is classed as a bulk sender, Google keeps treating it that way.

Two practical points follow:

• Counting is by domain, not by tool. Your newsletter platform, CRM, billing system and helpdesk all add to the same total if they send as example.com or its subdomains.
• Smaller senders are not exempt from everything. Google expects every sender to Gmail to have at least SPF or DKIM, valid DNS records and a sane message format. The full set below is mandatory for bulk senders and sensible practice for everyone. Because the threshold is "close to" 5,000, do not wait until you cross it.

What are the Gmail bulk sender requirements?

Bulk senders must authenticate with both SPF and DKIM, publish a DMARC record with at least p=none, and align the visible From domain with SPF or DKIM. They must also offer one-click unsubscribe on marketing mail, use TLS, have valid forward and reverse DNS, and keep spam complaint rates low.

In checklist form:

• SPF and DKIM both pass for the sending domain.
• DMARC record published for the From domain, policy of at least p=none.
• Alignment: the From domain matches the SPF domain, the DKIM d= domain, or both.
• Forward and reverse DNS: sending IPs have a PTR record, and the hostname resolves back to the IP.
• TLS for message transmission.
• Valid message format following RFC 5322, and no impersonation of Gmail From headers.
• One-click unsubscribe for marketing and subscribed messages, using the headers from RFC 8058, plus a visible unsubscribe link in the body.
• Low spam rate as reported in Google Postmaster Tools.
• ARC headers if you operate a mailing list or forwarder that modifies messages.

For how these rules sit alongside Yahoo's, see the email sender compliance page.

How do you set up SPF, DKIM and DMARC for Gmail?

Publish an SPF TXT record listing every service that sends as your domain, enable DKIM signing at each sending platform, and add a DMARC TXT record at _dmarc. Then confirm that at least one of SPF or DKIM passes and aligns with the From domain.

A minimal SPF record looks like this:

example.com.  IN  TXT  "v=spf1 include:_spf.mailprovider.example ip4:203.0.113.10 -all"

Remember the SPF limit of 10 DNS lookups. Every include, a, mx and redirect counts toward it, and lookups inside nested includes count too, so one vendor's include can consume several. Exceeding the limit produces a permanent error that fails SPF.

DKIM is published per selector. The record below is for a selector named s1:

s1._domainkey.example.com.  IN  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkq..."

Strongly prefer signing with your own domain (d=example.com) rather than your email platform's default domain. Gmail only needs DKIM to pass and the From domain to align with either SPF or DKIM, so a vendor-signed message can still comply if SPF aligns. But a message signed by the vendor's domain passes DKIM without aligning, which leaves DMARC dependent on SPF, and SPF commonly breaks when mail is forwarded. Your own d= domain keeps DMARC passing in that case.

A starter DMARC record that satisfies Gmail's minimum is:

_dmarc.example.com.  IN  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

The rua tag asks receivers to send aggregate reports, which is how you discover every system sending as your domain. Gmail only requires p=none, but a monitoring-only policy does not stop spoofing. Plan to move to quarantine and then reject once your legitimate sources all align. A tool such as DMARC monitoring turns the raw XML reports into something you can read.

How does one-click unsubscribe work?

One-click unsubscribe means the message carries two headers, List-Unsubscribe and List-Unsubscribe-Post, so Gmail can show an unsubscribe button that sends an HTTPS POST to your server. Your system must remove the recipient without a login or extra confirmation, and Google asks that requests be honoured within two days.

The headers look like this:

List-Unsubscribe: <https://example.com/unsub?id=abc123>, <mailto:unsub@example.com?subject=unsubscribe>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

Implementation notes:

• RFC 8058 requires the DKIM signature to cover both List-Unsubscribe and List-Unsubscribe-Post. Signing only one does not meet the RFC.
• The HTTPS endpoint must accept a POST and act on it directly. A page that only displays a confirmation form does not meet the requirement.
• The requirement targets marketing and subscribed mail. Purely transactional messages such as password resets and receipts are not the target, though many senders add the headers consistently anyway.

What spam rate should you stay under?

Google asks bulk senders to keep the user-reported spam rate in Postmaster Tools below 0.10% and to avoid ever reaching 0.30%. These are Google's published thresholds. Staying under them depends on sending to engaged, consenting recipients and removing unsubscribes quickly.

Authentication alone does not keep you under those figures, because spam rate reflects how recipients react. Ways to keep it down:

• Send only to people who opted in, and remove addresses that repeatedly bounce.
• Make the unsubscribe path easier than the spam button.
• Keep the From name, subject and content honest and consistent with what people signed up for.
• Warm up new domains and IPs gradually rather than sending a full list on day one.

What happens if you don't meet the Gmail requirements?

Gmail can defer non-compliant mail with temporary errors (4xx SMTP codes), reject it permanently (5xx codes), or route it to spam. Temporary errors are a warning sign: they tell you which requirement is failing while you can still fix it.

Postmaster Tools also includes a compliance status view for domains with enough sending volume. It shows which requirements your domain meets and which it does not, so check it before and after you change DNS. Keep in mind that Postmaster Tools only reports on domains you have verified and that send enough mail to Gmail.

How do you check that your domain meets the requirements?

Check each layer separately: look up your SPF, DKIM and DMARC records, send a test message to a Gmail account, and open "Show original" to see the SPF, DKIM and DMARC results. Then review aggregate reports to catch senders you did not know about.

A practical order of work:

1. Run your domain through the free domain scanner to see whether the basic records exist and parse correctly.
2. Use the DMARC lookup tool to confirm your _dmarc record is valid and see the policy and reporting addresses it publishes.
3. Collect aggregate reports for a couple of weeks and fix any source that fails alignment.
4. Tighten the DMARC policy gradually towards p=reject.

If you would rather not run that rollout yourself, yourDMARC offers a managed service where its team handles the move to p=reject. Plans are listed on the pricing page.

Common mistakes that cause Gmail rejections

• Third-party platforms signing with their own domain. DKIM passes but is not aligned, so DMARC relies on SPF alone.
• SPF over the 10-lookup limit after adding yet another SaaS vendor, often through nested includes.
• Missing PTR records on dedicated sending IPs.
• Unsubscribe headers not signed, or an endpoint that needs a login.
• Forgetting subdomains. Mail sent as news.example.com still counts towards your domain's volume and needs its own working authentication.

Key takeaways

• Gmail bulk sender requirements apply when a domain sends close to 5,000 messages or more in 24 hours to personal Gmail accounts, and subdomains count toward that total.
• Bulk senders need SPF and DKIM, plus a DMARC record of at least p=none with the From domain aligned to SPF or DKIM.
• Marketing mail needs one-click unsubscribe via List-Unsubscribe and List-Unsubscribe-Post headers, both covered by the DKIM signature.
• Sign DKIM with your own domain where you can; it is not strictly required but makes DMARC resilient to forwarding.
• Use TLS, valid PTR and forward DNS, and a correctly formatted message.
• Keep the spam rate below 0.10% and never reach 0.30% in Postmaster Tools.
• Non-compliance can bring temporary and permanent rejections; check the Postmaster Tools compliance view.
• Verify with the domain scanner and DMARC lookup, then review the compliance guidance.