In short
- Gmail treats anyone sending close to 5,000 messages a day to personal Gmail accounts as a bulk sender, and that status does not expire.
- Bulk senders must authenticate with SPF, DKIM and DMARC, support one-click unsubscribe on marketing mail and keep spam rates below 0.3%.
- Google says that from November 2025, non-compliant messages face temporary and permanent rejections rather than just spam-folder placement.
- Yahoo asks bulk senders to honour unsubscribes within two days, and Microsoft introduced similar authentication rules for Outlook consumer mailboxes in 2025.
- Most Shopify brands can become compliant in a day by setting up a branded sending domain, publishing DMARC and cleaning their list.
Email deliverability for ecommerce in 2026 comes down to meeting the sender rules that Gmail, Yahoo and Microsoft now enforce. If you send close to 5,000 or more emails a day to Gmail users, you must authenticate your domain with SPF, DKIM and DMARC, offer one-click unsubscribe on marketing emails and keep your spam rate below 0.3%. Since November 2025, Google has been rejecting mail that fails these rules, not just filtering it.
The good news is that compliance is mostly one-time setup. The ongoing work is list hygiene and sending to people who want your emails.
In short
- Set up a branded sending domain with SPF and DKIM, and publish a DMARC record.
- Make sure marketing emails carry one-click unsubscribe headers and a visible unsubscribe link.
- Keep spam complaints under 0.1% as a working target, and never above 0.3%.
- Stop mailing people who have not engaged in months.
The rules, provider by provider
Gmail
Google's email sender guidelines split requirements into two levels.
| Requirement | All senders | Bulk senders (about 5,000+ a day to Gmail) |
|---|---|---|
| Authentication | SPF or DKIM | SPF and DKIM, plus DMARC (minimum p=none) |
| Alignment | Not required | From domain must align with SPF or DKIM domain |
| DNS | Valid forward and reverse DNS | Same |
| Encryption | TLS connection | Same |
| Spam rate (Postmaster Tools) | Below 0.3% | Below 0.3%, recommended below 0.1% |
| Unsubscribe | Recommended | One-click unsubscribe on marketing mail, plus a visible link |
Two details from Google's sender FAQ catch brands out. First, bulk sender status has no expiry: once you cross the threshold, you are treated as a bulk sender permanently. Second, starting November 2025, Google says non-compliant messages will see "temporary and permanent rejections". Google also recommends processing unsubscribe requests within 48 hours.
Yahoo
Yahoo's sender best practices ask bulk senders to implement SPF and DKIM, publish a DMARC policy of at least p=none that passes, support one-click unsubscribe (with the RFC 8058 POST method highly recommended), honour unsubscribes within two days and keep the spam rate below 0.3%.
Microsoft Outlook
Microsoft announced similar requirements for domains sending more than 5,000 emails a day to its consumer mailboxes, covering SPF, DKIM and DMARC, with enforcement from May 2025. If you meet Gmail's rules, you will usually meet Microsoft's too.
Why Shopify brands cross the bulk threshold sooner than they think
The threshold is about daily volume to personal Gmail addresses, not list size. Imagine a hypothetical store with 30,000 subscribers, of which roughly half use Gmail. One campaign to the full list sends around 15,000 messages to Gmail in a day, three times the threshold. Add abandoned cart and post-purchase flows and you are well past it. For most Indian D2C brands with any real list, it is safest to assume you are a bulk sender.
Step-by-step setup for a Shopify store
- Use your own domain. Send from an address like hello@yourbrand.com, never a free Gmail address. Free-mail domains fail DMARC alignment when sent through a platform.
- Set up a branded sending domain in your email platform. Klaviyo, Shopify Email and Omnisend all walk you through this and give you DNS records to add, usually for a subdomain such as send.yourbrand.com. Add them at your DNS host (GoDaddy, Hostinger, Cloudflare or wherever your domain is managed). If you are new to Klaviyo, our beginner's guide covers the account basics.
- Check SPF. Your root domain should have exactly one SPF record. If Google Workspace or Zoho Mail also sends for you, include them in the same record rather than creating a second one.
- Publish DMARC. Add a TXT record at _dmarc.yourbrand.com. A sensible starting value is v=DMARC1; p=none; rua=mailto:dmarc@yourbrand.com. Use a free or paid DMARC reporting tool to read the reports.
- Verify. Send a test email to a Gmail account, open it, choose "Show original" and confirm SPF, DKIM and DMARC all show PASS.
- Connect Google Postmaster Tools. Verify your domain to see spam rate and compliance status over time.
- Tighten DMARC later. Once reports show every legitimate sender passing, move to p=quarantine, then p=reject, to stop others spoofing your domain.
List practices that keep you inside the rules
Authentication gets you through the door. Spam rate decides whether you stay. These habits keep complaints low:
- Send campaigns to engaged segments. For example, people who clicked in the last 90 days plus recent buyers. Save full-list sends for a few big moments a year.
- Run a sunset flow. After around six months of no engagement, send a short "still want to hear from us?" sequence, then suppress non-responders. In Klaviyo, suppressed profiles also stop counting towards your billable active profiles.
- Set expectations at signup. Say how often you email and what you send. Surprise is what drives spam clicks.
- Keep the unsubscribe link visible. A customer who cannot find it will mark you as spam instead.
- Never buy or rent lists. They contain spam traps and people who never agreed to hear from you.
- Warm up new domains. If you move to a new sending domain before Diwali or Black Friday, start with your most engaged subscribers and increase volume gradually over a few weeks.
Common symptoms and what usually causes them
| Symptom | Likely cause | First fix |
|---|---|---|
| Gmail bounces with authentication errors | Missing DMARC or misaligned From domain | Publish DMARC and send from your branded domain |
| Open and click rates fall at one provider only | Reputation problem with that mailbox provider | Send only to engaged subscribers for two to three weeks |
| Spam rate climbs after a sale | Frequency jump or mailing old, unengaged profiles | Reduce frequency and tighten segments |
| Transactional emails landing in spam | Shared reputation with heavy promotional sends | Separate transactional and marketing streams |
| New signups never receive the welcome email | Form or flow misconfigured, or typo-filled addresses | Test the form end to end and add inline email validation |
Work through problems one variable at a time. If you change your domain, frequency and segments in the same week, you will not know which change helped. Keep a simple log of what you changed and when, and compare Postmaster Tools data a week later.
It also helps to know that deliverability is judged per mailbox provider. Good placement at Gmail does not guarantee good placement at Outlook or Yahoo, so check results by domain in your email platform's reports rather than relying on one blended open or click rate.
Festive season: the highest-risk weeks
October and November are when Indian D2C brands send the most email, and when complaint rates tend to spike. A few precautions help:
- Increase frequency gradually in the weeks before a sale rather than jumping from one email a week to one a day.
- Send the heaviest sequences only to recently engaged subscribers.
- Watch Postmaster Tools daily during the sale, and pull back if the spam rate climbs.
- Keep transactional emails (order confirmations, shipping updates) clean and separate from promotions, ideally from a different subdomain.
A quick compliance checklist
| Check | Where to verify |
|---|---|
| Branded sending domain verified | Your email platform's domain settings |
| SPF and DKIM pass | Gmail "Show original" on a test email |
| DMARC record published and aligned | DNS lookup and test email headers |
| One-click unsubscribe headers present | "Show original" on a marketing email |
| Spam rate below 0.1% | Google Postmaster Tools |
| Unsubscribes processed within 48 hours | Your platform's suppression settings |
| Sunset policy live | Your flows list |
Getting deliverability right before peak season
Most brands can fix authentication in a day. The harder part is changing sending habits: segmenting properly, sunsetting dead profiles and planning festive frequency. If you would like an expert to check your setup, see our email marketing services, or read how we manage Klaviyo accounts for Shopify brands.
Frequently asked questions
The strictest rules apply to bulk senders: Gmail defines them as sending close to 5,000 messages or more to personal Gmail accounts in 24 hours. A store with 10,000 subscribers can cross that in one campaign. Basic rules such as SPF or DKIM, valid DNS and a low spam rate apply to every sender, so set everything up regardless of size.
For compliance with Gmail and Yahoo's bulk sender rules, a DMARC record with a policy of at least p=none is the stated minimum. It is a good starting point because it lets you collect reports without blocking mail. Once reports show all legitimate sources pass, many brands move to quarantine and later reject for better spoofing protection.
No. Google's sender FAQ says one-click unsubscribe is required only for marketing and promotional messages, and transactional messages are excluded. Order confirmations, shipping notices and password resets do not need it. They still need proper authentication, and should not include heavy promotional content that makes them look like marketing.
Gmail requires bulk senders to keep the spam rate reported in Postmaster Tools below 0.3% and recommends staying below 0.1%. Yahoo also sets 0.3% as the limit. Treat 0.1% as your working ceiling. If you approach it, reduce sends to unengaged subscribers and review how you collect email addresses.
Watch bounce rates in your email platform, especially soft bounces or blocks concentrated on Gmail, Yahoo or Outlook addresses. Connect Google Postmaster Tools to see spam rate and compliance status for your domain. A sudden fall in opens or clicks from one mailbox provider is another early warning.