Google, Yahoo and Microsoft Bulk Sender Rules for Cold Email: SPF, DKIM, DMARC, One-Click Unsubscribe and Spam Rate

What do Google, Yahoo and Microsoft require?

The sources: Google's sender guidelines and FAQ, Yahoo's sender best practices, and Microsoft's Tech Community post. Three details are easy to miss. Google's FAQ counts all subdomains together under the primary domain when working out whether you are a bulk sender, and says that once a sender reaches the threshold it keeps bulk-sender status permanently. Google's page also applies the requirements to messages going to personal Gmail accounts. And Google says mailto links and plain web-page links do not satisfy one-click unsubscribe, while Yahoo's page says a mailto is acceptable. If you want to satisfy both, build the HTTPS version.

Do these rules apply if I send fewer than 5,000 a day?

Partly, and in the ways that matter most. Google's list of requirements for all senders includes setting up SPF or DKIM, valid forward and reverse DNS records, a TLS connection, keeping the spam rate below 0.3%, formatting messages to RFC 5322, and not impersonating Gmail From headers. Yahoo's page also asks every sender for SPF or DKIM, a spam rate below 0.3% and valid DNS records. The DMARC and one-click requirements are the ones that begin at 5,000.

A small cold email operation of five inboxes sending 30 messages each sends about 150 a day, far under the line. Three reasons to meet the 5,000-a-day rules anyway. The spam-rate thresholds apply to every sender. DMARC and one-click unsubscribe cost little to add. And if you grow, or if several subdomains share one primary domain, you may cross the line without noticing. Our post on how many cold emails per day covers volume.

What do SPF, DKIM and DMARC each do?

• SPF lets a domain owner publish in DNS which hosts may send mail for it. RFC 7208 caps the DNS-querying terms in a record at 10 per evaluation (Section 4.6.4), and going over the cap produces a permanent error, so a record that stacks many include entries from many tools can fail. Check it before you add a new sending tool.
• DKIM signs each message with a private key; the receiver fetches the public key from your DNS using the selector and domain in the signature. It is defined in RFC 6376. Your sending platform usually generates the key; you publish the DNS record it gives you.
• DMARC ties them together. It lets the domain owner say what receivers should do with mail that fails SPF and DKIM for the domain in the visible From address: none (monitor), quarantine (treat as suspicious) or reject. It checks alignment, meaning the From domain must match a domain that passed SPF or DKIM. The current specification is RFC 9989 (May 2026), which obsoletes the older RFC 7489 that most guides still cite. Start with p=none and a rua address to receive reports, as Yahoo recommends, and tighten later.

How does one-click unsubscribe work?

RFC 8058 defines it. Your message includes a List-Unsubscribe header with one HTTPS link and a List-Unsubscribe-Post header whose only permitted value is List-Unsubscribe=One-Click. The mail provider sends an HTTPS POST to your link. The request carries no cookies or login, and your server must not answer with a redirect. The message must have a valid DKIM signature covering both headers, and the link should include an opaque identifier that your server checks, so nobody can forge opt-outs for other people.

Should cold email use a separate domain?

Cold email tools commonly describe sending from secondary domains, so that a problem does not damage your main company domain; Instantly's help article is one example. That is practice, not a rule in any of the pages above, and it has a catch: Google counts subdomains toward the same primary domain for bulk-sender status, so a subdomain trick does not split your volume. A different registered domain does. Whichever you choose, the sending domain needs its own SPF, DKIM and DMARC records, and your website and a real person should be reachable from it, because recipients will look.

We are building cold email into MAJ Leads now, so this is the checklist the sending setup has to pass, not a report on live sending. Where the product stands today is on how it works, and plans are on pricing.