Google’s bulk sender rules changed the economics of cold email, and a lot of teams still treat them as a filtering guideline. They are not. Mail that fails the requirements now gets rejected at the door with a 5.7.26 error, which means it never reaches a spam folder to be rescued.
The good news is that the requirements are short, specific and mostly a one-time setup job. Here is what they are, who they apply to, and how to verify you pass.
Who counts as a bulk sender
The threshold is 5,000 messages a day to Gmail addresses, measured per sending domain. Two things trip people up here.
First, it counts Gmail recipients, not total sends. If you send 12,000 emails a day and 3,000 go to Gmail, you are under the threshold. Second, it is per domain, so a team spreading volume across 15 domains may sit below it on every one of them while sending far more in total.
Being under the threshold does not make you exempt in practice. Google applies the same authentication signals to everyone; the threshold only determines which rules are formally enforced. If your mail is unauthenticated, it will struggle at any volume.
The five requirements
| Requirement | What it means | How to satisfy it |
|---|---|---|
| SPF | Your sending server is authorised by the domain | Publish an SPF TXT record listing your sender. Keep it under 10 DNS lookups. |
| DKIM | The message is cryptographically signed | 2048-bit key published as a DNS TXT record, signing enabled on the mailbox. |
| DMARC | A published policy telling receivers what to do on failure | A DMARC record at _dmarc.yourdomain.com. p=none is enough to comply. |
| Alignment | The From domain matches the authenticated domain | Send from the domain that SPF and DKIM authenticate. This is where most setups quietly fail. |
| One-click unsubscribe | A working List-Unsubscribe header | Add List-Unsubscribe and List-Unsubscribe-Post, and honour requests within two days. |
Alignment deserves a note because it is the one that catches technically-correct setups. You can have valid SPF and valid DKIM and still fail DMARC if the domain in your visible From address is not the domain those records authenticate. If you send from a subdomain or through a relay, check this specifically.
The spam rate, which is the one that actually bites
Authentication is a setup task you do once. The spam complaint rate is an ongoing constraint, and it is the requirement that ends most cold email programmes.
Google asks bulk senders to stay below 0.3%, and states 0.1% as the level to target. Those numbers sound generous until you convert them: at 0.3%, three complaints per thousand emails is the ceiling. On a 10,000-email campaign that is thirty people clicking the spam button.
Three things drive the rate up faster than anything else:
- Poor list fit. People who were never plausible buyers report rather than delete. This is why scoring fit before you send is a deliverability control, not just a conversion one.
- No obvious way out. If the only route to stop receiving your email is the spam button, that is the button people press.
- Volume ramped too fast. A new domain going from 0 to 500 a day in a week generates complaints from recipients who find the sender unfamiliar and the pattern suspicious.
The rate is measured on a rolling basis and recovers slowly. Assume weeks, not days.
How to verify you pass, in five minutes
- Send a test to a Gmail address. Open it, choose “Show original”, and check the header block. You want SPF: PASS, DKIM: PASS and DMARC: PASS. Anything else is a configuration problem, not a content problem.
- Check your SPF lookup count. More than 10 DNS lookups and the record fails silently. Our SPF record generator builds a valid one and flags the limit.
- Confirm DMARC exists. A missing record is the most common single failure, and
p=nonetakes a minute to publish. - Look at Google Postmaster Tools. This is where your actual spam rate lives. If you have never set it up, do it before your next campaign, not after.
- Run an inbox placement test. Passing authentication tells you the mail is accepted. It does not tell you whether it reached Primary.
Where this gets hard at scale
All of the above is straightforward on one domain. The difficulty is that serious cold outreach runs on twenty, fifty or a hundred domains, and every one needs the same five records configured correctly and kept correct.
What goes wrong is not usually the initial setup. It is the change six months later: you add a new sending IP, update SPF on the domains you remember, and miss eleven. Those eleven start failing authentication and you find out from a placement drop rather than an error message.
This is the argument for automated DNS rather than a documented process. Mailboundry and Outboundry’s email infrastructure publish SPF, DKIM, DMARC and MX automatically when a domain is added, and let you update every domain at once when something changes. It removes the failure mode rather than documenting it.
A short compliance checklist
- SPF, DKIM and DMARC published on every sending domain, not just the main one.
- From domain aligned with the authenticated domain.
- List-Unsubscribe with one-click support, honoured within two days.
- Spam rate monitored in Postmaster Tools, target under 0.1%.
- New domains warmed gradually rather than launched at volume.
- A visible, easy opt-out in the body as well as the header.
None of this makes cold email work. It makes cold email possible. The rest is list quality and message relevance.
Next: a plain-English guide to SPF, DKIM and DMARC, or how fast you can safely increase sending volume.
Frequently asked questions
Do Google bulk sender guidelines apply to cold email?
They apply based on volume to Gmail addresses, not on whether the mail is cold. If you send more than 5,000 messages a day to Gmail accounts you are treated as a bulk sender. Below that, the authentication requirements still apply in practice because Google increasingly filters unauthenticated mail regardless of volume.
What is the spam complaint rate limit?
Google asks bulk senders to stay under 0.3% and treats 0.1% as the level you should actually aim for. Above 0.3% you will see mail throttled or rejected. It is a rolling measure, so one bad campaign can take weeks to recover from.
Do I need one-click unsubscribe on cold emails?
If you are a bulk sender by Google’s definition, yes, you need the List-Unsubscribe header with one-click support. Even below the threshold it is worth adding, because a visible easy opt-out is what stops recipients using the spam button instead.
What DMARC policy do I need?
A published DMARC record is required for bulk senders, and p=none satisfies the requirement. You do not need p=reject to comply. Start at none, read the reports for a few weeks, then tighten if you want the extra spoofing protection.
How do I check if I am compliant?
Send a test message to a Gmail account, open the original, and look at the authentication results header for SPF, DKIM and DMARC all showing PASS. Then check your rate in Google Postmaster Tools, and run an inbox placement test to see whether passing authentication is actually translating into inbox placement.