Most UAE companies we work with send two kinds of e-mail: everyday messages from staff, and bulk mail such as newsletters, offers, invoices and system alerts. The second kind now has to pass written rules set by Gmail, Outlook.com and Yahoo before it reaches a customer’s inbox. Those rules overlap, but the thresholds, dates and penalties are not the same, and many guides blur them together. Below we set out what each provider actually publishes, and what a company with 5 to 300 staff should fix first.
Quick Answer
Gmail treats you as a bulk sender once a domain sends close to 5,000 messages or more in 24 hours to personal Gmail accounts, according to Google’s sender FAQ. Outlook.com applies its rules to domains sending more than 5,000 e-mails a day from 5 May 2025. Yahoo does not publish a number. All three want SPF and DKIM, a DMARC record of at least p=none, a From: domain that aligns, an easy unsubscribe on marketing mail and few spam complaints. Gmail and Yahoo go further and require one-click unsubscribe and a spam rate below 0.3%. If your records are not in order, start with our guide to SPF, DKIM and DMARC and check how your business e-mail is set up.
Who Counts as a Bulk Sender: Three Different Answers
This is where most confusion starts. Each provider draws the line in its own place, so you should check yourself against each one separately.
Gmail. The Google sender guidelines took effect on 1 February 2024 and apply to personal accounts ending in @gmail.com or @googlemail.com. Google’s FAQ says all messages from the same primary domain count toward the 5,000 figure, so mail from a subdomain such as news.yourcompany.ae adds to the total for yourcompany.ae. Once you cross the line, the status is permanent. The FAQ also says the guidelines do not apply to mail sent to Google Workspace accounts, and that from November 2025 Gmail is ramping up enforcement, including temporary and permanent rejections.
Outlook.com. Microsoft’s Outlook high-volume sender post covers the consumer service (hotmail.com, live.com and outlook.com addresses) and targets domains sending more than 5,000 e-mails per day. Its 29 April 2025 update says messages that fail the checks are rejected with the error “550; 5.7.515 Access denied”, taking effect on 5 May 2025. An older paragraph on the same page still describes routing to Junk first, so plan for rejection.
Yahoo. The Yahoo Sender Hub FAQ says a bulk sender is one sending “a significant volume of mail” and that Yahoo will not specify a threshold. Its rules have been enforced since February 2024.
Authentication: SPF, DKIM, DMARC and Alignment
Authentication proves that a message really comes from your domain. It is a DNS job, and it is the part we most often find broken when a client calls about mail going to spam.
- Every sender, any volume. Google and Yahoo both require SPF or DKIM at a minimum, valid forward and reverse DNS (PTR) records for the sending IPs, and messages formatted to RFC 5322. Google also requires a TLS connection.
- Bulk senders. Gmail and Yahoo require both SPF and DKIM, plus a DMARC record. A policy of p=none is accepted, but Yahoo says DMARC must pass. Outlook.com requires SPF and DKIM to pass and DMARC at p=none or stricter.
- Alignment. The domain in your From: header must match the SPF domain or the DKIM domain. If a mailing tool signs DKIM with its own domain and uses its own return-path for SPF, you fail this test even when SPF and DKIM both pass.
- Key length and lookups. Google requires DKIM keys of 1024 bits or longer for mail to personal Gmail accounts and recommends 2048 bits; Yahoo recommends at least 1024 bits. Microsoft warns that an SPF record needing more than 10 DNS lookups can fail.
The common UAE pattern we see: a company moves its mailboxes, adds a CRM, a booking system and a newsletter tool over the years, and nobody updates SPF or turns on DKIM for each one. If you are planning an e-mail migration, fix these records at the same time.
Unsubscribe: One Header, One Link, a Short Deadline
Gmail requires marketing and subscribed messages from bulk senders to support one-click unsubscribe and to show a clearly visible unsubscribe link in the body. Google’s FAQ says transactional messages, such as password resets and booking confirmations, are excluded, and that mailto links and plain URL links do not meet the one-click requirement on their own.
What one-click means technically. RFC 8058 defines it: a List-Unsubscribe header with one HTTPS address, a List-Unsubscribe-Post header containing “List-Unsubscribe=One-Click”, and a valid DKIM signature that covers both headers. The receiving server sends a POST request to that address, and your system must remove the person without a login or a redirect.
Deadlines. Google’s FAQ lists unsubscribe requests not honoured within 48 hours as a failing condition. Yahoo’s sender requirements page says to honour unsubscribes within 2 days, highly recommends the RFC 8058 POST method, and accepts mailto. Microsoft asks for a functional, clearly visible unsubscribe link.
Spam Rate: The Number That Decides Delivery
Gmail measures the share of your messages that recipients report as spam, shown in Postmaster Tools. Google asks you to stay below 0.10% and never reach 0.30%. Its FAQ says bulk senders above 0.3% lose access to delivery mitigation, and regain it only after their rate stays below 0.3% for 7 consecutive days. Yahoo asks all senders to stay below 0.3%, and calculates the rate on mail delivered to the inbox.
In practice, the spam rate is a list problem, not a technical one. Yahoo’s page advises against bought lists and pre-ticked opt-in boxes, and recommends confirmed opt-in and removing invalid addresses promptly. Microsoft asks senders to remove invalid addresses regularly and to make sure recipients have consented. A clean list of people who asked for your mail will do more for delivery than any setting.
Separate the streams. Yahoo also recommends not sending marketing mail from the same IPs used for staff and transactional mail. A failed campaign should not drag down the invoice reminders your accounts team sends.
What We Recommend: Three Decisions to Make
- Decide which domain sends what. Keep staff mail on your main domain and send campaigns from a clearly named subdomain, remembering that Gmail still counts both toward the same total. If you need a new domain for this, see our domain registration options.
- Decide where bulk mail goes out from. Your staff mailboxes, whether on Microsoft 365, Google Workspace or another service (compared in our Microsoft 365 vs Google Workspace guide), are not built for newsletters. Our Email Delivery plans under Marketing Solutions send from your own custom sending domain and keep sending logs; larger plans add a dedicated IP address, and the top plan adds a deliverability review.
- Decide who owns the records. Name one person or one provider to keep SPF, DKIM and DMARC correct each time a new tool starts sending for you, and to watch the spam rate monthly.
Frequently Asked Questions
We send fewer than 5,000 e-mails a day. Do these rules apply to us?
Partly. Gmail’s rules for all senders still apply: SPF or DKIM, valid PTR records, TLS and a spam rate below 0.3%. Yahoo publishes no threshold, so a smaller campaign can still be treated as bulk. Microsoft says all senders benefit from the same authentication. Setting up all three records is cheap insurance.
Does DMARC have to be set to reject?
No. Google, Yahoo and Microsoft all accept a DMARC policy of p=none for these requirements. Microsoft adds that p=reject gives the strongest protection against spoofing once all legitimate senders are aligned, and advises moving gradually from none to quarantine to reject so that genuine mail is not lost along the way.
Do invoices and password resets need an unsubscribe link?
Not for Gmail’s one-click rule. Google’s FAQ says one-click unsubscribe is required only for marketing and promotional messages, and gives password resets, reservation confirmations and form confirmations as transactional examples. Google also notes that recipients, not Google, decide what counts as promotional, so keep transactional mail strictly transactional.
Sources
- Google Workspace Admin Help, Email sender guidelines (accessed 2026-10-26)
- Google Workspace Admin Help, Email sender guidelines FAQ (accessed 2026-10-26)
- Microsoft Tech Community, Strengthening Email Ecosystem: Outlook’s New Requirements for High-Volume Senders (accessed 2026-10-26)
- Yahoo Sender Hub, Sender Requirements & Recommendations (accessed 2026-10-26)
- Yahoo Sender Hub, FAQs (accessed 2026-10-26)
- IETF, RFC 8058: Signaling One-Click Functionality for List Email Headers (accessed 2026-10-26)
Where We Are
BIGBANG ITS has planned and run technology for UAE businesses since 2003, headquartered at the Sharjah Research, Technology and Innovation Park with a branch in Business Bay, Dubai. Support runs 24/7 and the office is open Saturday to Thursday, 09:00–18:00 Gulf time. If you want us to check your SPF, DKIM and DMARC records and fix what fails, contact us or message us on WhatsApp.
Talk to us directly — we usually reply within minutes during business hours.
