Authentication is the requirement everyone remembers and the one least likely to be what breaks you. The rules that bite are about complaints, consent, and how easy you make it to leave.
The bulk sender rules that Google and Yahoo announced for 2024 changed what it means to send mail to a large list, and the requirements have been spreading provider by provider ever since — Microsoft added its own in 2025, and others followed through the year. Most senders cleared the first hurdle, enabled authentication, and assumed the matter was closed. The requirements that actually threaten a program are the ones further down the list.
The commonly cited figure is correct but imprecise in a way that matters. The bulk sender requirements apply to anyone sending more than 5,000 messages a day to Gmail addresses — and the count is of messages to Gmail recipients specifically, not your total send volume. A program sending 40,000 emails to a list where 3,000 are Gmail users is not, by that definition, in the regulated tier for Gmail.
Treat that as a fact to know, not a loophole to use. Your Gmail share is the number to measure, and it is usually larger than people guess. Yahoo's equivalent rules classify a sender by authenticated domain, which is a different slicing of the same problem.
Authentication is generally the part teams get right, because it is a finite engineering task with a clear definition of done. The one-click unsubscribe requirement is where a surprising number of programs fail — not because the header is missing, but because the link behind it leads to a form.
Complaint rate is the metric that cannot be engineered around. It is a direct measurement of whether people who received your mail wanted it, which means it reflects consent quality, frequency, and relevance — the things marketing actually controls.
The failure mode is nearly always the same and it is not a technical one. A list is grown with a lead magnet, subscribed to a high-frequency promotional track, and never re-segmented. Engagement decays. Complaints rise. The program then tries to fix a consent problem with a deliverability consultant.
Every deliverability problem we have been asked to fix in the last three years turned out to be a consent problem wearing a technical costume.
1. Measure your Gmail share of volume. 2. Confirm DMARC is enforced, not merely present. 3. Send yourself a campaign and click unsubscribe — all the way through, on mobile, logged out. 4. Open the postmaster tooling and read the complaint rate for the last ninety days. 5. Find the segments with the highest complaint rate and ask what you would do with them if you could not email them again.
Step five is where the work is. The first four take an afternoon.
A compliant program is not a hard one to build. It is an authenticated program with one-click unsubscribe that works, a complaint rate low enough that you have never had to think about it, and a habit of removing people who are not engaging. None of that is exciting, and all of it is a precondition for everything else you want to do — a journey, a launch, a personalisation program, an AI agent. They all run on the same reputation.
The senders who struggle are almost never the ones who missed a DNS record. They are the ones who treated the rules as a compliance exercise rather than as a description of what a welcome sender looks like.
Written by the team at LMR — a senior lifecycle marketing studio working in Iterable, Braze, Klaviyo and the tools you already run.
Start a project ↗