2026 bulk sender requirements: Gmail, Yahoo and Microsoft

The requirements, side by side

The single most important cell in that table is the spam-complaint rate. It applies to you from your very first email, it is shared (in spirit) by every provider, and it is the one number a young sending domain has no track record to absorb. Everything else on this page is a one-time setup task; the 0.3% ceiling is a standard you have to keep meeting for as long as you send.

What applies below 5,000 a day (where almost all cold email lives)

If you send cold email from a handful of mailboxes on your own domain, you are almost certainly under 5,000 messages a day to any single provider's consumer inboxes — and mail to business addresses hosted on a company's own domain does not count toward that line at all. So the bulk-only requirements (full SPF + DKIM + DMARC, one-click unsubscribe) are good practice but not what governs you day to day. The rules that do govern you at any volume are short:

• Authenticate with SPF or DKIM. Publish both anyway — it is the requirement the moment your volume crosses, and there is no downside to having it early.
• Publish valid reverse DNS on the IP you send from. Gmail rejects mail from an IP whose reverse lookup does not resolve back to it.
• Send over TLS. Every modern mailbox does this by default; it is worth confirming, not configuring.
• Format messages to the standard. One address in the From line, exactly one Subject and Date header, a valid message identifier — the things a normal mail client produces on its own.
• Keep your spam-complaint rate under 0.3%. This is the one that ends programmes, and it is the one nobody can set up once and forget.

Set up SPF, DKIM and DMARC once: verifying your list before you send and authenticating your domain are the two changes that move inbox placement the most.

The 0.3% rule, and why warmup is the remedy

Google asks senders to keep the spam-complaint rate below 0.10% and to never reach 0.30%. Yahoo asks for under 0.3%, measured against mail that actually landed in the inbox. That is a complaint rate, not a volume: three complaints in a thousand delivered emails puts you at the edge, and a brand-new domain with no sending history has nothing to cushion a bad week.

Warmup is how you build that cushion before you need it. Instead of appearing from nowhere at volume — the fastest way to look like a spammer — a warming mailbox sends a small, steadily rising trickle of genuinely wanted mail that gets opened and replied to, so that by the time your first campaign goes out the domain already reads as an established, welcome sender. WarmySender starts a new domain at one warmup email a day and climbs to full speed — 40 a day for a new domain — around the sixth week of sending, then keeps a steady baseline running underneath your campaigns so your reputation never fades to zero between lists.

It also refuses to let you sprint. Google names the exact failure mode: "immediately doubling previously sent volumes suddenly could result in rate limiting or reputation drops." The warmup ramp steps up in small increments precisely so you never trip that, and no provider publishes a day-by-day schedule you could follow instead — any "day 1: five emails, day 2: eight emails" table sourced to Google is something Google never wrote.

The full curve, and what changes it: how your warmup daily volume is decided.

Microsoft's high-volume enforcement, and the 550 5.7.515 bounce

Since May 5, 2025, Microsoft has enforced authentication on any domain sending 5,000 or more messages a day from one From domain to its consumer inboxes — Outlook.com, Hotmail.com and Live.com. Such a domain must pass SPF and DKIM and publish a DMARC record that passes and aligns with the visible From address.

Enforcement rolled out in phases. Non-compliant high-volume mail was first filtered to the Junk folder to give senders time to fix their setup, and the published escalation is outright rejection. The rejection carries a specific bounce that senders are already seeing:

550 5.7.515 Access denied, sending domain [your-domain] does not meet the required authentication level

If you ever receive that, it is not a WarmySender problem and not a content problem — it means the sending domain's SPF, DKIM or DMARC did not pass Microsoft's check for high-volume senders. The fix is on your domain's authentication records, and it applies from the moment your domain crosses the threshold, not just on the day it does. Microsoft does not publish a per-mailbox daily send number for consumer Outlook.com, so treat any specific figure you see quoted for it as guesswork.

How WarmySender keeps you inside these rules

The requirements above split cleanly into "things on your domain" and "things about how you send". WarmySender cannot publish DNS records for you — SPF, DKIM and DMARC live at your domain registrar and stay your responsibility — but it does show you the authentication status of every connected mailbox so you can see at a glance what is missing. Everything about how you send, it handles:

• It paces every send. A day's volume is spread across your sending window rather than fired in a burst, because a sudden burst is one of the strongest automation signals a provider watches for — and no send, whether a human or an AI agent triggered it, can override that pacing or raise a limit.
• It warms your domain before you send cold, and keeps warmup running underneath. That steady baseline of wanted mail is what holds your complaint rate under the 0.3% line when a campaign goes out.
• It caps volume where it matters. A brand-new domain is held to 200 emails a day across every mailbox on it (warmup included) until it is 30 days old with 200 sends behind it and no spam complaints; only then does the ceiling lift. That is the same "start low, grow slowly" shape every provider asks for, enforced for you.
• It grows by adding mailboxes, not by pushing one harder. Ten mailboxes at 50 a day is a far safer signal than one at 500, and it keeps you comfortably under any provider's radar.

The week-by-week view of what to send, with the enforced ceilings alongside the recommendations, is at how many cold emails can I send per day.

Common questions

Do the bulk sender rules apply to me if I only send a few hundred emails a day?

The bulk-only rules — full SPF and DKIM and DMARC together, and a one-click unsubscribe header — only kick in above 5,000 messages a day to a single provider's consumer inboxes, so at a few hundred a day they do not strictly bind you. But four requirements apply at any volume: authenticate with SPF or DKIM, publish valid reverse DNS on your sending IP, send over TLS, and keep your spam-complaint rate under 0.3%. Set up all three authentication records anyway — there is no downside, and you are ready the moment your volume grows.

Does Yahoo really have no 5,000-a-day limit?

Correct. Yahoo deliberately publishes no numeric volume threshold — its own guidance says it "will not specify a volume threshold". It judges every sender the same way at every volume, on authentication and on a spam-complaint rate under 0.3% (measured against mail that reached the inbox). The "Yahoo caps you at 5,000 a day" line you will find in vendor blogs is a Google rule that has been copied onto Yahoo by mistake.

What is the 550 5.7.515 error, and how do I fix it?

It is the rejection Microsoft returns when a high-volume domain (5,000+ a day to Outlook.com, Hotmail or Live) fails the authentication it has required since May 5, 2025. The full bounce reads "Access denied, sending domain … does not meet the required authentication level". The fix is entirely on your domain's authentication: make sure SPF and DKIM both pass and that a DMARC record is published and aligned to your visible From address. It is not a content issue and not something to solve by retrying — the mail will keep bouncing until the records pass.

What counts toward the 5,000-a-day threshold?

Only mail to that provider's consumer inboxes. For Google, that means personal Gmail and googlemail addresses; mail to a business address hosted on a company's own Google Workspace domain does not count. Microsoft counts mail to Outlook.com, Hotmail.com and Live.com. This is why most business-to-business cold-email programmes never cross the line: much of their volume goes to company domains, which sit outside the count entirely.

How does warmup help me meet these rules?

The one requirement you cannot set up and forget is the spam-complaint rate under 0.3%, and warmup is what builds the reputation to hold it. A warming mailbox sends a small, rising trickle of genuinely wanted mail that gets opened and replied to, so your domain is an established, welcome sender before your first campaign rather than an unknown one appearing at volume. Keeping warmup running afterwards maintains that baseline so your reputation never fades between campaigns. Warmup does not replace authentication — you still need SPF, DKIM and DMARC — but it is what protects the number the setup steps cannot.

Do I need a one-click unsubscribe on cold email?

The one-click unsubscribe header (the RFC 8058 standard) is a requirement on marketing and subscribed mail once a domain crosses 5,000 messages a day to a provider. Below that it is not mandated, but an honest, working way to opt out is always good practice and protects your complaint rate — someone who can unsubscribe in one tap is far less likely to hit "report spam", which is the action that actually costs you. WarmySender can add an unsubscribe option to your campaign emails so this is handled for you.

Related guides

• How many cold emails can I send per day? — the week-by-week volume table
• How your warmup daily volume is decided — the ramp that protects your 0.3% rate
• Do I need to verify my list before I send? — the fastest way to lower your complaint and bounce rates
• Full documentation