Gmail and Yahoo bulk sender requirements: what Shopify stores need to do

The short answer: Gmail and Yahoo require every sender to authenticate email with SPF or DKIM and keep spam complaints below 0.3%. Bulk senders, which Gmail defines as close to 5,000 messages a day to Gmail accounts, also need SPF, DKIM and DMARC, an aligned From domain and one-click unsubscribe on marketing email.

For most Shopify stores, the Gmail and Yahoo bulk sender requirements come down to three jobs: authenticate the domain your emails come from, make unsubscribing easy, and send only to people who want your email. Some of that your email app already does. This guide sets out the rules from Google's, Yahoo's and Microsoft's own pages, shows which parts Shopify handles, and gives you a checklist for the rest.

What are the Gmail and Yahoo bulk sender requirements?

Google and Yahoo started enforcing near-identical rules in February 2024, and Microsoft added similar ones for Outlook.com in 2025. Here is what each provider's official page says:

Requirement	Gmail: all senders	Gmail: 5,000+ a day	Yahoo: bulk senders	Outlook.com: 5,000+ a day
SPF	SPF or DKIM	Required	Required	Must pass
DKIM	SPF or DKIM	Required (1024-bit key or longer)	Required	Must pass
DMARC	Recommended	Required; policy can be none	Required; at least p=none, and DMARC must pass	Required; at least p=none
From domain aligned with SPF or DKIM	Not listed	Required	Required (relaxed alignment is fine)	Required (both preferred)
One-click unsubscribe	Not listed	Required on marketing and subscribed messages	Required on marketing and subscribed messages	A working unsubscribe link is recommended
Visible unsubscribe link in the email	Not listed	Required	Required (can go to a preferences page)	Recommended
Act on unsubscribes	Not listed	Within 48 hours (recommended)	Within 2 days	Not stated
Spam complaint rate	Below 0.3%	Below 0.30%; aim for under 0.10%	Below 0.3%	Not stated
Valid forward and reverse DNS, TLS, standard message format	Required	Required	DNS and message format required	Not stated

Sources: Google's email sender guidelines and its sender guidelines FAQ, Yahoo Sender Hub best practices, and Microsoft's announcement for high-volume senders. Yahoo's rules for all senders match Gmail's baseline: SPF or DKIM, a spam rate below 0.3%, valid DNS and standard message formatting. Yahoo's rules also cover AOL and the other email brands Yahoo Mail hosts.

The DNS, TLS and message-format rows are about the servers that send your email. If you send through Shopify or an email app, the provider looks after those. The rows you influence are authentication of your own domain, unsubscribes and complaints.

Does your Shopify store count as a bulk sender?

Gmail counts you as a bulk sender if you send close to 5,000 or more messages to personal Gmail accounts within 24 hours. Three details matter for a store:

• Only Gmail addresses count towards Gmail's threshold. If 5,000 of your subscribers use @gmail.com addresses, one campaign to your whole list reaches it that day.
• Your whole domain counts together. Google adds up everything sent from the same primary domain, so mail from shop.yourstore.com and news.yourstore.com counts as yourstore.com.
• It's permanent. According to Google's FAQ, a sender that meets the threshold once is treated as a bulk sender from then on, even if volumes fall.

Yahoo doesn't publish a number. Its FAQ says a bulk sender sends "a significant volume of mail" and that it judges senders by the authenticated domain or From domain. Microsoft's rules apply to domains sending more than 5,000 emails a day to Outlook.com, Hotmail and Live addresses.

The practical answer: don't plan around the threshold. Your list grows, a Black Friday campaign can push one day over it, and the bulk rules are good practice at any size. Meet them now and you never have to check.

Whose domain is the sender?

The rules apply to the domain in your From address and authentication, not to your store. That decides who does the work:

• Sending from Shopify without your own domain authenticated: Shopify sends your marketing email from an authenticated shopifyemail.com subdomain, and your sender address is rewritten to it (for example store+123@shopifyemail.com). Shopify says this meets Gmail's and Yahoo's bulk-sender authentication requirements (Shopify Help Center).
• Sending from your own domain, such as hello@yourstore.com: your domain is the sender, so it needs SPF, DKIM and DMARC records that you or your provider publish.
• Sending through an email app: check whether the app sends from its own authenticated address or from your domain, and whether it adds one-click unsubscribe. Google's advice is to confirm that your provider authenticates your domain's email with SPF and DKIM.

What Shopify already handles for you

Shopify authenticates all marketing email sent with Shopify Messaging. If you bought your domain through Shopify, Shopify sets up your DKIM, SPF and DMARC records for you. If your domain is with Cloudflare, GoDaddy or IONOS, Shopify can add the records automatically after you approve the change. For any other domain provider, you add the records yourself (Shopify Help Center).

You can check where you stand in your Shopify admin under Settings > Notifications > Sender email. The Email domain authentication status tells you whether your domain is Authenticated, still Propagating, or needs an update. If you have never set it up, your sender address is rewritten to a shopifyemail.com address, which is compliant but doesn't show your brand.

What Shopify can't do for you is decide who you email, how often, and whether they asked to hear from you. Those decide your spam rate, and your spam rate is the one requirement no setting can fix.

What Shopify stores need to do: a checklist

1. List everything that sends email as your domain

Before touching DNS, write down every service that uses your domain in its From address: Shopify order notifications, your email marketing app, your help desk, your business inbox (for example Google Workspace or Microsoft 365), and any review or loyalty app. Google says your SPF record should include every service that sends for your domain; anything left out is more likely to land in spam.

2. Authenticate your domain with SPF and DKIM

For Shopify, you add the CNAME records shown under Settings > Notifications > Sender email > Email domain authentication. Shopify says these CNAME records cover SPF and DKIM, so you don't need to add IP addresses. Every other sender on your list does the same through its own settings. Our step-by-step guide to setting up DKIM, SPF and DMARC for your Shopify store walks through each record.

3. Publish a DMARC record

A DMARC record is one TXT record named _dmarc on your domain. Shopify's suggested starting value is v=DMARC1; p=none;, which meets the minimum both Gmail and Yahoo set. Yahoo strongly recommends adding a reporting address (an rua tag) so you can see who is sending as your domain. Only publish one DMARC record per domain.

4. Check that your From domain is aligned

Alignment means the domain in your From address matches the domain that passed SPF or DKIM. Gmail and Yahoo need only one of the two to align; Google recommends aligning both and says it's likely to become a requirement. To check, send a campaign to a Gmail address you own, open it, choose More > Show original, and look for SPF, DKIM and DMARC results of PASS (Gmail Help).

5. Make unsubscribing one click

One-click unsubscribe is a pair of email headers (List-Unsubscribe and List-Unsubscribe-Post, defined in RFC 8058) that let Gmail and Yahoo show their own unsubscribe button. Email apps add these headers, not you, so ask your provider to confirm they're there. You also need a visible unsubscribe link in every marketing email, and you should remove people within 48 hours (Google) or 2 days (Yahoo). Order confirmations, shipping updates and password resets are transactional and don't need one-click unsubscribe.

6. Keep your spam rate well under 0.3%

Google asks senders to keep their spam rate in Postmaster Tools below 0.10% and never reach 0.30%. That's about one complaint per 1,000 emails delivered as a comfortable level, and three per 1,000 as the limit. Google Postmaster Tools reports your rate once you send from your own authenticated domain, but Shopify notes it only shows data after you send at least 5,000 messages a day to Gmail addresses. Below that, watch the complaint and unsubscribe figures in your email app.

7. Email only people who opted in

Google's guidelines say don't buy email addresses, don't email people who didn't sign up, and avoid opt-in boxes that are ticked by default. Yahoo adds that you should tell people at signup what you'll send and how often. On Shopify, that means subscribers from your signup forms and the marketing checkbox at checkout, not every customer who ever placed an order. If you're setting up forms, our guide to adding an email popup to Shopify covers wording that sets the right expectations.

8. Change volume gradually

Google recommends sending at a consistent rate and warns that suddenly doubling volume can lead to rate limiting. Yahoo asks you to keep to the frequency people signed up for. If you've been sending monthly, don't jump to three emails a week before Black Friday; build up over several weeks and send first to your most engaged subscribers. Our guide to how often to send marketing emails covers picking a rhythm.

9. Use a real reply address

Shopify notes that some email hosts reject sender addresses containing "no-reply" or "noreply", and Microsoft recommends a From or Reply-To address that can receive replies. Use an address such as hello@ or support@ that someone reads.

What happens if you don't meet the requirements?

Google says that from November 2025 it began ramping up enforcement, with temporary and permanent rejections for messages that fail. Its FAQ splits the consequences:

• Authentication, alignment, DNS, TLS or format problems: temporary or permanent failure codes, or the spam folder. Unauthenticated messages may be rejected with a 5.7.26 error.
• Missing DMARC record, missing one-click unsubscribe, unsubscribes not honoured within 48 hours, or a spam rate above 0.3%: Google's delivery support and mitigations aren't available to you, so you can't ask Google for help with delivery problems.

Microsoft's announcement says messages from high-volume domains that fail SPF, DKIM or DMARC are rejected with the error "550; 5.7.515 Access denied". Yahoo says failing its standards can affect delivery of your mail to Yahoo domains. In practice, the first sign is usually a sudden drop in clicks from one provider's subscribers, or bounce messages quoting these codes.

Do Outlook and Hotmail have the same rules?

Close to it. Since May 2025, Outlook.com (which covers outlook.com, hotmail.com and live.com addresses) requires domains sending more than 5,000 emails a day to pass SPF and DKIM and publish DMARC at p=none or stronger, aligned with SPF or DKIM. Microsoft's announcement lists unsubscribe links, list cleaning and valid reply addresses as recommendations rather than requirements, and says adding a sender to the safe senders list won't get around the rules. If you meet Gmail's and Yahoo's bulk rules, you meet Microsoft's.

How tinyAlbert handles sender requirements

tinyAlbert is a Shopify app that plans, writes and sends your email marketing. On the authentication side:

• Authenticated from day one. Your email goes out from a tinyAlbert-managed sending address with DKIM, SPF and DMARC all showing Verified, along with Email Status, so you can send your first campaign without touching DNS.
• Your own domain when you're ready. Add and verify your own sending domain under Verify DNS Settings in your account.
• Recovery segments by provider. 12 of tinyAlbert's 28 pre-built segments are for deliverability: a recovery segment each for Gmail, Yahoo, Microsoft and iCloud, soft, medium and hard inbox recovery across all providers, and five segments that leave out one provider (Gmail, Yahoo, Microsoft, iCloud or Comcast).
• List cleaning. Clean My List checks your contacts for a fee per email, shown before you confirm, gives you a CSV report and marks failing contacts Inactive.
• A steady rhythm. Campaigns default to about one a week, and you choose how many to send each week.

See how it fits together on the tinyAlbert deliverability page. Plans start at $3 a month for up to 100 contacts, after a 7-day free trial. For how this fits with the rest of your email programme, read the Shopify email marketing guide, and if AI writes your emails, the deliverability checks in how to use AI for email marketing still apply.

Frequently asked questions

Do the Gmail requirements apply if I send fewer than 5,000 emails a day?

Partly. Every sender to personal Gmail accounts must use SPF or DKIM, have valid forward and reverse DNS, use TLS, follow the standard message format and keep spam rates below 0.3%. DMARC, alignment and one-click unsubscribe are the extra bulk-sender rules. Because bulk status is permanent once reached, most stores are better off meeting all of them early.

Is a DMARC policy of p=none enough?

Yes, for compliance. Gmail, Yahoo and Microsoft all accept a published DMARC record with p=none as the minimum. It tells providers to take no action on failing mail, so it doesn't stop someone spoofing your domain. Once reports show all your legitimate senders pass, Microsoft advises moving gradually from none to quarantine to reject.

Do order confirmation emails need one-click unsubscribe?

No. Google and Yahoo require one-click unsubscribe only on marketing and promotional messages. Transactional emails such as order confirmations, shipping updates and password resets are excluded. Keep promotions out of those emails too: Google advises against mixing content types, such as adding promotions to sales receipts.

How quickly must I act on an unsubscribe?

Yahoo requires unsubscribes to be honoured within 2 days. Google recommends 48 hours, and its FAQ says bulk senders who don't honour them within 48 hours lose access to Google's delivery support. Most email apps remove the subscriber straight away; if you import lists between tools, make sure unsubscribed contacts stay unsubscribed in every one.

Do I need my own domain to send email from Shopify?

No. Without your own authenticated domain, Shopify sends marketing email from an authenticated shopifyemail.com subdomain, which Shopify says meets Gmail's and Yahoo's requirements. Authenticating your own domain is optional but recommended, because customers see your brand in the From address, and it lets you monitor your domain in Google Postmaster Tools.

What spam rate do Gmail and Yahoo allow?

Both set the limit below 0.3% of delivered email, or three complaints per 1,000. Google asks senders to stay below 0.10% and avoid ever reaching 0.30%. Yahoo calculates the rate on mail delivered to the inbox. Sending only to opted-in subscribers and making unsubscribing easy are the most direct ways to keep it low.