Crossing about 5,000 messages in a day to personal Gmail accounts turns your primary domain into a bulk sender. Gmail counts the apex and every subdomain together, the status does not expire, and Yahoo plus consumer Outlook apply a matching authentication floor. September is the window to publish SPF, DKIM, DMARC at least p=none, and one-click unsubscribe on marketing mail — not 26 November, the day before Black Friday 2026.
The 5,000/day rule is a one-way door
Google defines a bulk sender as anyone who sends close to 5,000 messages or more in a 24-hour period to personal Gmail accounts. Messages from the same primary domain count together. Mail from news.example.com plus receipts from mail.example.com is one pile, not two.
The sender-guidelines FAQ is explicit that bulk status has no expiration date. Once Gmail assigns it, later volume cuts do not roll the domain back to “all senders.” Treat the first day you trip the threshold as permanent classification, not a temporary badge.
That is why 3,000 newsletters and 3,000 password resets from the same root domain already put you over the line. Splitting streams onto subdomains still helps isolate complaint reputation — it does not dodge the count. See why marketing and transactional mail should use separate subdomains for the isolation case, and keep this page for the threshold itself.
Gmail, Yahoo, and Outlook checklist
Use this as the operator table. Numbers below for Gmail come from Google’s Email sender guidelines and the sender guidelines FAQ. Yahoo and Outlook columns are the matching consumer-mail floor operators actually get rejected against in 2026.
| Requirement | Gmail (personal) | Yahoo / AOL | Outlook.com / Hotmail / Live |
|---|---|---|---|
| Volume trigger | ~5,000 / 24h to personal Gmail, counted on the primary domain including subdomains | Marketing / subscribed bulk to Yahoo consumer mail | ~5,000 / day to the consumer Outlook family (enforced since May 2025) |
| Authentication | All senders: SPF or DKIM. Bulk: SPF and DKIM both passing, plus a published DMARC record at least p=none |
SPF, DKIM, published DMARC, From alignment | SPF, DKIM, and aligned DMARC on the 5322.From domain |
| From alignment | 5322.From must align with the SPF or DKIM domain | Same alignment expectation | Failing alignment is observed as 550 5.7.515 |
| One-click unsubscribe | Required on marketing and subscribed mail, plus a visible body link | Required on marketing bulk | Recommended; do not invent a Microsoft-only RFC 8058 SLA |
| Complaint / spam rate | Aim under 0.10% in Postmaster Tools; never treat 0.30% as a target | Stay under ~0.3% complaints in Yahoo Sender Hub | No public 0.30% SLA equivalent; authentication failure is the documented reject |
| Transport hygiene | TLS on the sending connection; valid forward and reverse DNS (PTR) on sending IPs; RFC 5322 formatting; no Gmail From impersonation | TLS and aligned identity | TLS and aligned identity |
| Operator dashboard | Google Postmaster Tools, including Compliance status | Yahoo Sender Hub | Microsoft SNDS |
DKIM keys used toward personal Gmail must be at least 1,024 bits; 2,048-bit keys are the recommended default. Protocol definitions live in SPF, DKIM, and DMARC explained. Alignment versus a bare SPF pass is a separate article shipping 7 September — this page only needs you to know alignment is required, not optional.
Gmail has been ramping temporary and permanent rejections of non-compliant bulk traffic since November 2025. That is Google enforcement, not an ArawaMail feature. The Gmail Verified Sender Program that opens 8 September 2026 applies to eligible, verified US political committees only. It is not a new general bulk-sender rule.
What ArawaMail writes versus what you still own
ArawaMail is an operational platform for company-managed Cloudflare zones: receiving, mailboxes, and a send API. It is not a marketing ESP and it does not publish a bulk-sender compliance dashboard, a complaint-rate graph, or automatic List-Unsubscribe injection.
When you activate sending after receiving is live, ArawaMail publishes DKIM CNAMEs and a custom MAIL FROM (MX plus SPF) on that zone. Mailbox sending and HTTP API sending both require the domain to be sending-active. The API from domain must be registered, allowed by the key, and enabled for outbound mail. See the product guide to enable sending.
You still publish DMARC yourself. Public docs do not say ArawaMail writes DMARC, BIMI, MTA-STS, TLS-RPT, or PTR. Turning sending-active is not a substitute for a TXT record at _dmarc.example.com. p=none satisfies the Gmail publication floor; it does not excuse failed alignment. Read reports with How to read a DMARC report.
PTR and reverse DNS sit on the sending IPs. Shared-pool operators inherit the provider’s PTR; you still need to understand why a mismatch fails Gmail’s all-sender bar — covered in Reverse DNS and PTR records.
One-click headers travel as a custom headers object on the Resend-compatible Send email API. Implementation, Laravel mailables, and the Next.js path are in the companion article One-Click Unsubscribe: List-Unsubscribe headers in Laravel and Next.js.
Watch complaint rate where the providers actually score you
Gmail spam rate is a Postmaster Tools number, not an ArawaMail dashboard tile. Register the sending domains, wait for data, and treat the Compliance status view as the source of truth for Gmail. Yahoo Sender Hub and Microsoft SNDS are the parallel tools.
0.30% is a ceiling Google tells you to avoid, not a budget to spend. Aim under 0.10%. A list blast that “only” complains at 0.25% is already a domain event. Why that mail then folds into spam is the same mechanics as why emails go to spam.
Transactional receipts, password resets, and OTPs are generally outside the one-click unsubscribe mandate. Marketing and subscribed mail is not. Do not put List-Unsubscribe on an OTP; do not ship a November newsletter without it.
Pre-Q4 checklist (do this in September)
Black Friday 2026 is Friday 27 November. Teams that first trip 5,000/day during a sale, without alignment or one-click headers, do not get a friendly retry.
- Publish SPF and DKIM on the apex and on every subdomain that will appear in a From header. Inheritance rules are in SPF, DKIM, and DMARC on subdomains.
- Publish DMARC at least
p=noneon the organizational domain. RFC 9989 (DMARCbis, May 2026) changed some tags and lookup details; the bulk-sender floor is still a published policy. - Confirm From-domain alignment for every vendor that sends as you. Two platforms on one From address have extra SPF-include and DKIM-selector constraints — see Two vendors, one From address.
- Register Google Postmaster Tools, Yahoo Sender Hub, and Microsoft SNDS against the domains you actually send from.
- Ship RFC 8058 headers and a visible unsubscribe link on marketing and subscribed mail before the first list blast, not after the first reject.
- Keep people-mail and product-mail on a known brand domain. The domain is the durable asset heading into Q4 — that argument is in Your domain is the product.
Use the free lookups on ArawaMail tools to confirm the records you think you published are the records resolvers see.
Good and bad operator patterns
- Good: authenticate the apex and each sending subdomain in September, publish DMARC at least
p=none, register Postmaster Tools, and keep marketing one-click headers ready before any list blast. - Bad: first adding DMARC on 26 November because Black Friday volume tripped the threshold.
- Bad: treating ArawaMail sending-active as a substitute for a published DMARC record.
- Bad: assuming a marketing subdomain resets the 5,000/day clock.
How we analyzed this
The article is an operator checklist, not a protocol explainer. Claims about Gmail numbers and stickiness come from Google Help (sender guidelines and the FAQ), including the November 2025 enforcement ramp and the primary-domain counting example. Yahoo and Outlook columns stay at the documented authentication floor; we do not invent a Microsoft complaint-rate SLA.
ArawaMail product claims are limited to what the public sending guide and Send email API actually document: DKIM CNAMEs, custom MAIL FROM, sending-active as a gate, and a headers object. No invented compliance dashboard, dedicated IP product, or automatic unsubscribe injector. Q4 timing uses the public Black Friday 2026 date (27 November) as the reason this ships in early September.
FAQ
Am I a bulk sender if I send 3,000 newsletters and 3,000 receipts from the same root domain?
For Gmail, yes. Volume is counted on the primary domain, including every subdomain, across all message types.
Does p=none satisfy Gmail’s DMARC rule?
Yes, as the publication minimum. Alignment still has to pass. A published p=none record with failing alignment is not compliant bulk mail.
Do password resets need List-Unsubscribe?
Usually no. Transactional receipts, password resets, and OTPs are outside the mandate. Marketing and subscribed mail need both the header pair and a visible body link.
Where do I watch complaint rate?
Google Postmaster Tools for Gmail, Yahoo Sender Hub for Yahoo/AOL, Microsoft SNDS for consumer Outlook. Not the ArawaMail dashboard.
Does splitting marketing onto a subdomain dodge the 5,000 threshold?
No for Gmail’s primary-domain count. It can still isolate complaint reputation, which is why the subdomain split remains useful.
Is the Gmail Verified Sender Program a new bulk-sender rule?
No. It is a 8 September 2026 program for eligible, verified US political committees. It is not a new general bulk-sender rule.
Related reading: SPF, DKIM, and DMARC explained, Why emails go to spam, Custom-domain business email vs Gmail, How to read a DMARC report, Reverse DNS and PTR records, Your domain is the product, Two vendors, one From address, SPF, DKIM, and DMARC on subdomains, Separate marketing and transactional subdomains, One-click unsubscribe headers, and free DNS tools.