Skip to content

Learn

What Gmail, Yahoo and Outlook ask of senders

Gmail, Yahoo and Outlook.com each publish rules for mail sent to their users. Here is what each one asks, what happens when you miss a rule, and which parts colding does for you.

Whose rules, and who they cover

Each provider's rules are about mail sent to its own users. Google's cover personal Gmail accounts, the addresses that end in @gmail.com or @googlemail.com, and not Google Workspace accounts. Yahoo's cover every domain and brand that Yahoo Mail hosts, AOL included. Microsoft's cover Outlook.com, its service for hotmail.com, live.com and outlook.com addresses.

They apply whatever mailbox you send from. Google says all senders, including Google Workspace users, must meet its rules when they write to a personal Gmail account.

Each provider asks more of big senders. Google counts you as a bulk sender once you send close to 5,000 messages or more to personal Gmail accounts in a day, adding up all the mail from one primary domain. Once you cross that line, you stay a bulk sender. Microsoft's rules are for domains that send more than 5,000 emails a day. Yahoo doesn't give a number.

colding's largest plan sends up to 15,000 outreach emails a day, so a workspace can cross Google's line. Whichever side of it you are on, set up SPF, DKIM and DMARC from the start. The bulk rules ask for all three, and the essay on the three records shows how.

The rules, side by side

Here is what each provider asks, one rule at a time, with a link to its own words. Where a rule is only for bulk senders, the line says so.

SPF and DKIM

Google
Every sender: SPF or DKIM. Bulk senders: SPF and DKIM.
Yahoo
Every sender: SPF or DKIM at a minimum. Bulk senders: both.
Outlook.com
Past 5,000 emails a day, SPF and DKIM must both pass.

DMARC

Google
Bulk senders: a DMARC record, whose policy can be set to none, and a From address aligned with the SPF or the DKIM domain.
Yahoo
Bulk senders: a valid DMARC policy with at least p=none, and a From address aligned with the SPF or the DKIM domain.
Outlook.com
Past 5,000 emails a day: at least p=none, aligned with SPF or DKIM.

Spam rate

Google
Every sender: below 0.3%. The guideline goes further: stay below 0.1% and never reach 0.3%.
Yahoo
Every sender: below 0.3%.
Outlook.com
No number given.

Unsubscribe

Google
Bulk senders, on marketing and subscribed mail: one-click unsubscribe and a clearly visible link in the body. Google recommends acting on a request within 48 hours.
Yahoo
Bulk senders, on marketing and subscribed mail: one-click unsubscribe and a clearly visible link in the body. Act on a request within 2 days.
Outlook.com
Not a rule. It is one of Microsoft's recommendations: an easy, clearly visible way to opt out, especially for marketing or bulk mail.

Google also asks every sender for valid forward and reverse DNS records, which tie the sending server's IP address to its name, and for a TLS connection, which encrypts the mail on its way. Yahoo asks for the same records. With colding, your mail leaves through your own mailbox's server, so these two belong to whoever runs it. In most cases, that is your mail provider.

What the spam rate measures

Google defines the spam rate as the share of your messages delivered to an engaged recipient's inbox and then marked as spam. Postmaster Tools, Google's dashboard for senders, shows it for mail signed with DKIM. Yahoo also counts it on mail delivered to the inbox.

So 0.1% means one email marked as spam for every 1,000 that reached an inbox. The number can look good when things are bad: Google warns that when Gmail sends many of your messages to spam, the rate might seem low, because fewer of them reach an inbox where someone can mark them. And on a day you send little, the dashboard might not show all the data.

Postmaster Tools also has a compliance view that says whether your mail meets Google's rules. Only Google sees what Gmail counted, so that is the place to check.

One-click unsubscribe

One-click unsubscribe lets a person leave your list from inside their mail app, without opening a page. It takes two headers: lines at the top of an email that the mail app reads and the person doesn't see. Google's guidelines show them like this:

List-Unsubscribe: <https://example.com/unsubscribe/example>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

When the person unsubscribes, their provider sends a POST request to that address. Why a POST, rather than opening the address? RFC 8058 explains that anti-spam software often fetches everything in an email's headers on its own. If opening the address unsubscribed someone, that software would unsubscribe people who never asked. The standard's answer is an HTTPS POST, which the mail app sends only when the person asks.

The standard and the providers add a few conditions:

Google doesn't reject an email just because it lacks one-click. But it says unwanted messages without it are more likely to be reported as spam, and the spam rate is a rule it does enforce.

What happens when you miss a rule

Google says it is ramping up its enforcement, and that mail that misses the rules will see disruptions, including temporary and permanent rejections. A refused email comes back with a code and a reason. These codes, from Google's list, name a record:

4.7.27
SPF didn't pass.
4.7.30
DKIM didn't pass.
4.7.31
The domain has no DMARC record, or its record sets no policy.
4.7.32
The From address isn't aligned with the domain that SPF or DKIM checked.

These codes are temporary: Gmail asks the sending server to try again later. The same list has the codes for mail Gmail blocks outright.

Past 5,000 emails a day, Microsoft's post says it decided to reject mail that fails its rules, with this error:

550 5.7.515
Access denied. The sending domain doesn't meet the required authentication level.

A note in the same post says such mail will first go to Junk, and be rejected on a date still to be announced. Either way, it doesn't reach the inbox.

What colding does for you

colding meets some of these rules on every campaign email, with nothing to set up:

  • Every campaign email carries both one-click headers, with an HTTPS address. When someone unsubscribes, their address goes on your suppression list the moment the request arrives, and no campaign email goes to it again. Opening the address in a browser only shows a page with a button, and nothing changes until the person presses it.
  • A reply that asks to stop does the same, in English, Portuguese or Spanish.
  • Warmup and campaigns stop using a mailbox whose domain has been missing SPF or DMARC for 72 hours. The essay on the three records says what colding checks.
  • A campaign pauses by itself when 0.1% of its emails are marked as spam, or 5% bounce, over 7 days, once 50 have gone out. The spam limit is the one Google asks you to stay under. Neither Google nor Yahoo names a bounce rate, so the bounce limit comes from Amazon SES, a sending service that places an account under review at a bounce rate of 5% or more. Amazon says providers use high bounce rates to spot senders with bad practices.
  • Before a launch, and while a campaign runs, the list check counts the leads whose address is known to be invalid. Once a campaign has 50 leads it can still email, a share of 4% or more refuses the launch or pauses the campaign.
  • Each mailbox has a daily cap, and a new mailbox starts low. The essay on new mailboxes explains why.

Other parts stay with you, because they live outside colding:

  • DKIM signing. Your mail provider signs your email and picks the headers the signature covers, the two unsubscribe headers among them. If you aren't sure it covers them, ask your provider.
  • Your DNS records. colding reads them and never changes them.
  • The line under each email. A campaign ends its emails with a link, with a sentence that asks for a reply, or with nothing. If your emails are marketing, pick the link: Google and Yahoo ask bulk senders for a visible one in the body.
  • Your spam rate. Only Postmaster Tools shows what Gmail counted.

What colding can't see

colding counts a spam complaint only when a report of it arrives. Gmail and Outlook.com send no such report to a sender using an ordinary mailbox, so for mail to them, colding sees no complaints at all. The automatic pause can't act on what it never sees. A campaign that never paused for spam has not proved a low spam rate.

Yahoo does send reports, through its Complaint Feedback Loop, to any address you control. Sign up, and have the reports sent to a mailbox you connected to colding with a password. colding reads each one: the person goes on your suppression list, campaigns stop writing to them, and the report counts toward the automatic pause.

A checklist

  1. Set up SPF, DKIM and DMARC on the domain you send from, with DMARC at p=none to start.
  2. Add your domain to Google Postmaster Tools. Once you send enough for it to show data, read the spam rate and the compliance view there.
  3. Sign up for Yahoo's Complaint Feedback Loop, with a mailbox colding reads as the address for its reports.
  4. If your emails are marketing, end each one with a link to unsubscribe.
  5. If a server refuses your email with one of the codes above, fix the record it names before you send more.

Read how campaigns work in colding.

Sources

We read these pages on October 5, 2026. They are in English. If a provider has changed its page since, the provider's page is right and this essay is out of date.

Keep reading