Whitepaper · Bulk senders · 2026

Google & Yahoo bulk sender requirements: complete 2026 audit checklist

22 October 2026

Google and Yahoo require authenticated, low-complaint mail from senders who deliver large volumes (commonly described as 5,000+ messages per day to Gmail). Use this as a 2026 landing-state audit checklist against a Sender Identity static reading—not as a marketing migration diary.

Authentication (mandatory)

SPF published for the sending domain / envelope domain, under ten DNS lookups (SPF_LOOKUP_LIMIT must be clear).
DKIM signing with a production key (≥2048-bit RSA or Ed25519 recommended; DKIM_WEAK_KEY on the audit).
DMARC at the organizational domain with at least p=none and a working rua. Enforcement (quarantine / reject) is the durable end state.
Alignment: From domain aligns with SPF or DKIM—see alignment failures.

Spam and consent

Keep user-reported spam rates low (Google cites thresholds on the order of 0.10%, with tighter targets advised).
Honor one-click unsubscribe (List-Unsubscribe + List-Unsubscribe-Post) for marketing/bulk classes Yahoo and Google describe.
Valid From / Reply-To identities; no borrowed domains.

Sender Identity landing path

Free audit until critical SPF/DKIM/DMARC findings are gone.
Hosted DMARC for aggregate visibility at reports.senderidentity.com.
Label ESPs in Account; fix unnamed passing senders.
Approve staged quarantine, then reject—never on calendar alone (transition plan).
Export a compliance PDF of the static reading when stakeholders need a one-pager.

ESP publish steps: Quickstarts. Gmail bounce 550 5.7.26 is the usual symptom when authentication is still missing.