Every headline about the Google and Yahoo sender rules leads with the same number: 5,000 messages a day. If you run a one-person publication, that is the wrong number to watch. A list of 3,000 that goes out once a week never approaches it, and the rules still decide whether your send arrives.
Three things make the threshold a poor guide for small operators.
1. The all-senders tier has no volume floor
The requirements split into two tiers. The bulk tier, which begins at roughly 5,000 messages a day to personal Gmail addresses, is the one that gets written about. The other tier applies to everyone who sends anything.
At any volume you need SPF or DKIM configured on the sending domain, valid forward and reverse DNS on the sending IP, TLS in transit, message formatting that conforms to RFC 5322, and a spam complaint rate under 0.30 percent. None of it is waived because the list is small. The full requirement list for both tiers, with sources, is on the email authentication reference page.
2. The classification is domain-level and it does not expire
Bulk sender status attaches to the organizational domain and aggregates across every subdomain beneath it. Mail from news.example.com, mail.example.com and the root domain counts as one sender, not three.
It also does not lapse. Once a domain crosses the threshold it is treated as a bulk sender, and dropping back below the line later does not undo the classification. One launch announcement, one imported list, one archive re-send is enough to cross it for a day.
The practical reading for a small publisher: the sub-5,000 exemption is a floor you can step over once and not step back behind. Configure for the bulk tier and the question stops mattering.
3. The gmail.com From address is the part that actually breaks
This is the change with the sharpest effect on one-person lists, because they are the operations most likely to be exposed to it.
Gmail enforces a DMARC quarantine policy on gmail.com itself. A publisher who sends through an email platform while putting a personal gmail.com address in the From header fails DMARC by construction. The From domain is gmail.com, the platform has no way to align to it, and the receiving server has already been told what to do with mail in that condition.
No amount of platform configuration fixes this. The fix is to send from a domain you control, which is the same domain the rest of the publication should already be sitting on.
The complaint arithmetic is worse at small volume
Google’s stated target is below 0.10 percent, with 0.30 percent as the point where enforcement begins. Those are rates rather than counts, so a small list has fewer complaints to spend before it crosses them.
| Messages sent | Complaints at 0.10% | Complaints at 0.30% |
|---|---|---|
| 1,000 | 1 | 3 |
| 2,000 | 2 | 6 |
| 5,000 | 5 | 15 |
| 10,000 | 10 | 30 |
On a list of 2,000, six people reaching for the spam button instead of the unsubscribe link puts the domain at the enforcement line for that send. That is not a hypothetical rate of dissatisfaction. It is six people on a bad subject line, and it is the strongest available argument for making the unsubscribe link easier to find than the spam button.
Enforcement stopped being advisory
February 2024 is when the requirements took effect. November 2025 is when the consequence changed. Google moved from accepting non-compliant mail and filtering it to applying temporary rate limiting and permanent rejection.
The distinction matters for diagnosis. A message that lands in spam is a deliverability problem you can see in your own copy of the newsletter. A rejected message is not in the spam folder, because it was never accepted. Nothing in the platform’s dashboard necessarily tells you it happened.
How to check whether this affects you
All of it is verifiable in about ten minutes, without logging into your email platform, which is the same reason it is admissible teardown evidence.
- Read the From address on your own newsletter. If the domain is gmail.com, or any other consumer mail provider, stop here. That is the failure described above and it is the only one on this list that no platform setting can fix.
- Send one issue to an address at a different provider. Sending to your own inbox on your own domain bypasses most of the checks you are trying to test.
- Open it in Gmail and choose Show original. The Authentication-Results header states pass or fail for SPF, DKIM and DMARC. This is the answer, and it takes precedence over whatever your platform’s dashboard claims.
- Compare the DKIM
d=domain to the From domain. If they differ, DKIM is passing without aligning. This is the most common failure on an otherwise correct setup. - Check for the via indicator. When Gmail shows a message as sent via another domain, it is telling you the same thing at a glance, with no headers to read.
- Confirm a DMARC record exists.
dig +short TXT _dmarc.yourdomain.comreturns it, or returns nothing, which is itself the finding. - Open Google Postmaster Tools. It is the only place your actual spam complaint rate is visible. A publisher who sends weekly and has never opened it does not know their own number.
The full requirement list for both tiers, what each protocol does, and the difference between authenticating and aligning are on the email authentication reference page.
What to fix, in order
Ordered by consequence rather than by effort, because the cheapest fix here is not the most important one.
- Move the From address to a domain you control. Nothing else works until this is true, and it is also an Owned hub strength point rather than only a deliverability one.
- Get DKIM signing with your own domain in the
d=tag. Most platforms support this and few enable it by default. It is the alignment path that survives forwarding. - Publish DMARC at
p=nonewith anrua=address. The reporting address is the optional part and the most useful thing in the specification, because it tells you which services have been sending as your domain and failing. - Configure SPF as well, and check you are inside the ten DNS lookup limit if you have accumulated services over the years.
- Verify one-click unsubscribe is actually in the headers, not only a link in the footer. They are separate requirements and platforms differ on whether they send both.
- Make the unsubscribe link easier to find than the spam button. On the volumes in the table above, this is a deliverability decision rather than a retention one.
- Move DMARC to
p=quarantineonce the reports are clean for a few weeks. Not required, and it is the difference between monitoring spoofing and preventing it.
What this changes for the rubric
Authentication sits inside Distribution loop, which asks whether attention converts into a relationship the publisher controls. The band definitions treat authenticated and delivered sends as a condition of scoring above the midpoint, not a bonus.
The reason is that authentication status is checkable from outside. DNS records are public. A teardown can confirm whether SPF, DKIM and DMARC exist and whether at least one of them aligns with the From domain, without access to the publisher’s account. A publication with capture units on every template, a healthy signup rate and a broken alignment record has a loop that leaks at delivery rather than at capture. Those are different failures with different fixes, and they score differently.
Questions
My list is 800 people. Can I ignore this?
No. The all-senders tier has no volume floor, so SPF or DKIM, reverse DNS, TLS and the spam complaint rate apply to you at any size. The 5,000 figure only gates the additional obligations, and those are worth configuring anyway because the classification is easy to trip once and does not lapse.
My platform’s dashboard says authentication is configured. Is that enough?
It tells you SPF and DKIM exist. It usually says nothing about whether either aligns with your From domain, which is the test DMARC actually applies. Read the headers of a real send instead.
Why did my sends work fine for two years and then stop?
Three candidates, and they are distinguishable. A domain that crossed the bulk threshold once is now held to the higher tier permanently. Enforcement posture has tightened over time rather than staying fixed. Or the complaint rate crossed a line on one bad send and the effect persisted afterwards. Postmaster Tools separates the third from the first two.
How would I know if messages are being rejected rather than filtered?
Not from your own copy of the newsletter, and often not from your platform’s dashboard either. A filtered message is in a spam folder you could look in. A rejected message was never accepted, so there is nothing to find. Postmaster Tools and your sending provider’s bounce logs are the places the evidence exists.
Does any of this improve open rates?
Not directly, and it is a precondition for them. A rejected message has no open rate at all and a message routed to spam has a much worse one. Authentication does not make people read; it makes reading possible.
Sources
- Google Workspace Admin Help, Email sender guidelines
- Google Workspace Admin Help, Email sender guidelines FAQ
Requirements and thresholds verified July 29, 2026. Google has revised these rules before and has signalled that alignment expectations may tighten further, so this page records the state of the rules on the date given.