Google and Yahoo sender rules

Google and Yahoo announced a joint baseline in October 2023 and began enforcing it in February 2024. Gmail then escalated in November 2025: "Messages that fail to meet the email sender requirements will experience disruptions, including temporary and permanent rejections." Spam Resource dates that FAQ addition to early November 2025 and reads it as a move from selective to consistent enforcement.

Two facts shape how these rules hit cold email:

1. The rules govern mail to personal accounts only. Google: "The Email sender guidelines don't apply to messages sent to Google Workspace accounts."
2. The "bulk" threshold is counted per primary domain. A cold-email operation spreads volume across dozens or hundreds of domains, so each one stays far below it.

The rules are still binding on the "all senders" tier, and they set the vocabulary (0.3%, 5,000/day, one-click) that the whole market quotes.

#The rules, side by side (as of October 2026)

Sources: Google sender guidelines, Google FAQ, Yahoo best practices.

#What "bulk sender" means

Gmail. A bulk sender is "any email sender that sends close to 5,000 messages or more to personal Gmail accounts within a 24-hour period". Three details matter:

• Primary domain aggregation. "Messages sent from the same primary domain count toward the 5,000 limit." Google's example: 2,500 from solarmora.com plus 2,500 from promotions.solarmora.com makes a bulk sender. Subdomains don't split the count. Separate registered domains do, which is exactly what cold-email infrastructure uses.
• It is permanent. "Senders who meet the above criteria at least once are permanently considered bulk senders."
• New domains are watched harder. A new domain is one that hasn't sent 5,000/day to personal Gmail since January 1, 2024, and enforcement for them runs "on an accelerated timetable".

Yahoo refuses to publish a number: "A 'bulk' sender is classified as an email sender sending a significant volume of mail. We will not specify a volume threshold." It evaluates at the authenticated-domain or From-domain level, and spoofed mail counts toward your total.

#The complaint threshold

Google is explicit that the effect is graduated, not a cliff:

• "Keep spam rates reported in Postmaster Tools below 0.10% and avoid ever reaching a spam rate of 0.30% or higher."
• "Even today, user-reported spam rates greater than 0.1% have a negative impact on email inbox delivery for bulk senders."
• Since June 2024, bulk senders above 0.3% are ineligible for mitigation (Google's help with delivery problems). They become eligible again once the rate stays below 0.3% for 7 consecutive days.
• Spam rate is calculated daily.

The 0.3% is measured on mail to personal Gmail and shown in Postmaster Tools. For cold domains sending mostly to business recipients, Postmaster usually shows nothing (see Reputation and blocklists). The number is still the right internal target: about 3 complaints per 1,000 delivered is the ceiling, 1 per 1,000 the goal.

#November 2025: from notices to rejections

Gmail's enforcement table now maps each failure to a consequence (FAQ):

Rejections come with explicit codes and reasons. The FAQ lists, for example, rate-limiting "because DKIM authentication didn't pass" and "because the sending domain doesn't have a DMARC record" (Google). For a sequencer these codes are the most reliable deliverability telemetry available and should be parsed and surfaced, not buried in a bounce log.

#What still binds cold email

Even at 50 sends per domain per day to business recipients, these apply in practice:

• Authentication and alignment. Failing them at Gmail personal now risks hard rejection, and the same signals feed the classifier for Workspace recipients. See Authentication: SPF, DKIM, DMARC, BIMI, ARC and one-click unsubscribe.
• Rate behaviour. Google's volume guidance (no bursts, no sudden doubling) applies to everyone. Gmail rate-limits per domain and per IP.
• Content rules. No fake "Re:"/"Fwd:", no hidden HTML, no deceptive display names (Google). Several popular cold-email "hacks" are explicitly named here. See Content and tracking.
• The consent sentence. Google's guidance says "Don't send messages to people who didn't sign up to get messages from you" and "Don't purchase email addresses from other companies." Google Workspace's Acceptable Use Policy bans "unsolicited mass email". Cold email at volume runs against the spirit of Google's rules even where it is under their letter. See Provider rules: Google, Microsoft and the ESPs and Provider crackdowns.

#What this means for an entrant

• Compliance is a floor you must hit perfectly and cannot sell. Authentication, alignment, PTR, TLS and RFC 5322 conformance are automated by every incumbent. A single misconfigured customer domain now risks permanent rejections at Gmail.
• Turn Gmail's bounce codes into product. Since November 2025, Gmail tells you why it rejected a message. Parse every 4xx/5xx, map it to a cause and a fix, and alert per domain. This is cheaper and more truthful than any warmup score.
• Count per primary domain like Google does. If a customer's domains share a primary domain (subdomains of one brand), aggregate them and warn before they approach 5,000/day to personal Gmail. "Permanent bulk sender" status is easy to trip and impossible to undo.
• Use 0.1% complaints as the internal red line, not 0.3%. Build suppression, global unsubscribe and complaint feedback (Yahoo CFL for DKIM domains) into the core, with 48-hour SLAs.
• Assume the Workspace exemption is temporary. The rules' scope (personal accounts only) is the main reason cold email survived 2024 mostly unchanged. A platform whose economics depend on that scope never widening is fragile. See The wedge and Kill criteria.