ON THIS PAGE
By Efe Berke Colaker, Founder at GetleadReviewed by the Getlead editorial team for accuracy. Last updated August 2026.
Before 2024 you could send badly configured email and mostly get away with it. That era ended when Google and Yahoo published bulk sender requirements. And it closed completely in May 2025 when Microsoft started rejecting non compliant mail with a permanent error.
The rules themselves are short. What trips teams up is assuming they are a one off setup task, when one of the three is a continuous requirement tied to how good your list is.
Who the rules actually apply to
The headline threshold is 5,000 messages a day sent to personal accounts at a given provider. Read that carefully, because two details decide whether you are in scope.
- It counts messages to personal Gmail or Yahoo accounts, not to business mailboxes on Workspace or Microsoft 365.
- It counts per sending domain to that one provider, so 3,000 to Gmail and 3,000 to Yahoo is under both thresholds while still being 6,000 sends.
- Crossing it once puts the domain in scope. It is not a monthly average.
- Authentication requirements below the threshold are still enforced in practice through filtering, just not through hard rejection.
For B2B outbound the honest answer is that the threshold is a distraction. If you are running cold email at any real volume you should meet all three requirements from day one. Because the filtering consequences below the threshold are just as expensive and much harder to diagnose.
The three requirements, in plain terms
The first three are a single afternoon of DNS work and then they are done. Publishing them is the cheapest deliverability improvement available. And it is still the most common thing missing when a cold email program underperforms for no visible reason.
Alignment is the part people miss
DMARC does not just require SPF and DKIM to pass. It requires alignment: the domain in the From header has to match the domain that authenticated. A message can pass SPF for the sending platform's domain, fail alignment for yours, and be treated as unauthenticated.
Check alignment on a real message rather than trusting a green tick in a dashboard. Send to a personal Gmail account, open the original message headers, and confirm SPF and DKIM both show your sending domain.
Domain alignment is the requirement that the domain shown in the From header matches the domain that passed SPF or DKIM, which is what DMARC evaluates.
For example, a message sent through a platform that passes SPF for its own domain while showing your brand in the From line fails alignment. So it counts as unauthenticated no matter how many green ticks the sending tool displays.
The 0.3% ceiling and why it is the hard one
Authentication is a task. The complaint rate is a habit. Google publishes 0.3% as the ceiling and recommends staying under 0.1%. That means three complaints per thousand delivered messages puts you at the limit and one per thousand is the number to aim at.
Complaints track relevance and list quality far more than copy. A well written message to someone who has no business receiving it still gets marked as spam. That is why the fix for a complaint problem is almost always upstream, in segmentation and verification, not in the subject line.
You cannot manage what you cannot see
Register the sending domain with Google Postmaster Tools and Microsoft SNDS. Both are free and both give you the complaint and reputation view that your sending tool cannot. Without them you are inferring deliverability from open rates, which are unreliable, and by the time replies drop the damage is already weeks old.
What changed when Microsoft joined
In May 2025 Microsoft began enforcing the same baseline for high volume senders to Outlook, Hotmail and Live addresses, returning 550 5.7.515 on non compliant mail. That code is a permanent rejection, not a temporary defer, so the message is gone rather than queued.
The practical effect for B2B senders is that the last soft target disappeared. Teams used to route around Gmail strictness by leaning on other providers. There is no provider left where an unauthenticated domain quietly works.
The order to implement it in
Order matters, because doing these in the wrong sequence means sending real volume while your reputation is still forming.
- Buy a separate sending domain. Keep the corporate domain out of cold outbound entirely.
- Publish SPF, DKIM and DMARC on it, starting DMARC at p=none while you watch the reports.
- Register the domain in Google Postmaster Tools and Microsoft SNDS before the first campaign.
- Warm the mailboxes for two to three weeks before they carry campaign volume.
- Verify the first list, then send at low volume and watch bounce and complaint rates.
- Scale volume only while both metrics stay flat. Any jump means stop and fix the list.
Steps one and four are where impatience costs the most. A new domain sending hundreds of messages on day one looks exactly like a throwaway spam domain. Because that pattern is what throwaway spam domains produce. Warm the mailboxes on a schedule instead, and verify the first list before it goes anywhere near a campaign.
Why two to three weeks of warm-up
Reputation is built from a history of accepted, opened and replied to mail. A brand new domain has none, so filters have nothing to weigh you against except the pattern of the send itself. Warm-up supplies that history in miniature: small volumes, real interactions, gradually increasing over days.
Two to three weeks is the working range for a new domain. Shorter than that and the first real campaign is still the domain's largest ever send, which is the exact shape filters treat as suspicious. Longer rarely hurts, and for a domain you plan to use for years it is a trivial delay.
What failure actually looks like
Failure is rarely announced. In descending order of how obvious it is:
- Hard rejection: 550 5.7.515 or similar in your logs. Unmissable, and the easiest to fix.
- Spam foldering: delivery reported as successful, replies near zero. This is the common one.
- Throttling: the provider accepts a trickle and defers the rest, so campaigns take days to finish.
- Domain reputation collapse: everything from the domain suffers, including invoices and support replies, which is why the corporate domain should never be in the send path.
The second one is why bounce rate alone is a poor health check. Our sends to SMTP verified lists bounce at 0.51%, comfortably under the roughly 3% level where reputation suffers. But a clean bounce rate says nothing about whether the delivered messages reached an inbox or a spam folder.
Watch replies per thousand delivered as the real signal. When that number drops while volume holds steady, you have a placement problem, and the checklist above is where you start looking.
The five setup mistakes we see most
These are the ones that survive a confident yes when someone says the domain is configured.
- SPF passing for the platform, not for you. The record authorizes the sending tool but the From domain does not align, so DMARC treats the message as unauthenticated.
- Multiple SPF records on one domain. More than one record is a permanent error under the specification, and it fails silently rather than loudly.
- DKIM configured on the root domain only while mail is sent from a subdomain, or the reverse. The signing domain has to match what recipients see.
- DMARC published with no reporting address. You get the compliance tick and none of the visibility, which is most of the value.
- Unsubscribe handled by a link in the body only. The one click header is a separate mechanism, and the header is what the provider checks.
Each of these produces the same symptom: delivery looks fine, replies are thin, and nothing in the sending tool reports a problem. That is why header inspection on a real message beats any dashboard. And why Postmaster Tools is worth the ten minutes it takes to verify the domain.
If the setup checks out and placement is still poor, the problem has moved upstream to the list. At that point verification and segmentation are the levers, not DNS.
Sources and method
First-party data (Getlead, 2026): the verification split of 43.4% confirmed valid, 23.9% invalid, 16.7% catch-all and 16.0% unknown comes from 383,368 addresses analyzed through live SMTP verification. The 0.51% bounce rate and 35.8% open rate come from 34,973 tracked sends. Both are aggregated and anonymized at campaign level, and the full method is published in our cold email benchmark study.
External sources: bulk sender requirements including the 0.3% spam complaint ceiling, authentication rules and one click unsubscribe (Google Workspace sender guidelines, 2026); Microsoft enforcement with error 550 5.7.515 from May 2025; and one click unsubscribe as specified in RFC 8058.
Provider policies change without notice. Figures here were checked in August 2026. If you find one that has moved, tell us and we will correct it.
Frequently asked questions
What are the Gmail and Yahoo bulk sender requirements?
Authenticate with SPF, DKIM and DMARC on the sending domain with DMARC at least at p=none, keep the spam complaint rate under 0.3% with 0.1% as the target. And offer one click unsubscribe under RFC 8058 on marketing mail, honored within 48 hours. Microsoft enforces the same baseline and rejects non compliant mail with error 550 5.7.515.
Do the rules apply if I send fewer than 5,000 emails a day?
The hard threshold is 5,000 messages a day to personal accounts at a single provider, counted per sending domain. Below it you avoid automatic rejection, but filtering still applies, so unauthenticated mail is quietly foldered instead of rejected. For cold email, meet all three requirements regardless of volume.
What is error 550 5.7.515?
It is the permanent rejection Microsoft returns for high volume senders that fail its authentication requirements, introduced in May 2025. Because it is a permanent failure rather than a temporary defer, the message is dropped rather than retried.
What spam complaint rate is safe?
Under 0.1% is the operational target and 0.3% is the hard ceiling. At 0.3% you are at the limit, which is only three complaints per thousand delivered messages. So on small sends a handful of annoyed recipients is enough to breach it.
Does DMARC need to be set to reject?
No. The minimum requirement is a published DMARC record with p=none, which monitors without affecting delivery. Moving to quarantine and then reject is good practice once the reports show all legitimate mail aligning, but it is not the entry requirement.
How do I check whether I am compliant?
Send a message to a personal Gmail account and inspect the original headers: SPF and DKIM should both pass and both should show your sending domain, not just the platform's. Then register the domain in Google Postmaster Tools and Microsoft SNDS to see complaint rate and reputation over time.