Google and Yahoo's Bulk Sender Rules, Explained

Since February 2024, Google and Yahoo have required senders to properly authenticate their email — and it isn't limited to big marketing platforms. If you send email from your own domain at all, including from a small business or a personal domain, these rules affect you. Here's what they actually require, in plain terms.

Who has to comply

The strictest requirements apply to "bulk senders" — anyone sending more than about 5,000 messages a day to Gmail or Yahoo addresses combined. In practice, most small businesses don't hit that volume. But Google and Yahoo apply the baseline requirements — valid SPF or DKIM, and a DMARC record — much more broadly, and non-compliant mail from any domain is increasingly likely to be marked as spam or rejected outright, bulk sender or not.

The three things you need

• SPF (Sender Policy Framework) — a DNS record listing which mail servers are allowed to send email as your domain. Without it, anyone can forge a "from" address using your domain and receiving servers have no way to tell.
• DKIM (DomainKeys Identified Mail) — a cryptographic signature added to outgoing mail, proving it was actually sent by your mail server and wasn't altered in transit.
• DMARC (Domain-based Message Authentication, Reporting and Conformance) — a policy record that tells receiving mail servers what to do when a message claims to be from your domain but fails SPF and DKIM. This is the one people get wrong most often — having a DMARC record isn't the same as having one that does anything. A record set to p=none exists, technically satisfies "do you have DMARC," and provides no real protection against spoofing. p=quarantine or p=reject are what actually stop forged mail.

What happens if you don't comply

Non-compliant mail doesn't usually bounce outright — it just quietly starts landing in spam, or gets silently dropped. Most businesses don't find out until customers say "I never got your email" or an invoice goes unanswered for weeks. By the time it's noticed, it can take days for a DNS fix to fully take effect and reputation to recover.

How to check where you stand

You can check all of this manually via DNS lookup tools, but the records are unforgiving of small syntax mistakes and are genuinely tedious to verify by hand across SPF, DKIM, and DMARC together — which is the whole reason this kind of checker exists.