Since February 2024, the rules of bulk email have been written by two groups: mailbox providers (Google, Yahoo, and later Microsoft) and lawmakers (CAN-SPAM in the US, GDPR in the EU, CASL in Canada). Providers enforce their rules technically — non-compliant mail is rejected or junked. The law enforces its rules financially. This page lists what each actually requires, with a link to every primary source.
The Google & Yahoo bulk sender rules
In October 2023, Google and Yahoo jointly announced new requirements for senders, enforced beginning February 2024 (Google's announcement). Google defines a bulk sender as any sender that sends around 5,000 or more messages to Gmail addresses within a 24-hour period — and once you qualify, you're treated as a bulk sender permanently (Email sender guidelines).
1. Authentication: SPF, DKIM, and DMARC
Every sender must authenticate with SPF or DKIM at minimum. Bulk senders must have both SPF and DKIM pass, plus a published DMARC policy (at least p=none) with the From: domain aligned to the authenticated domain. Messages must also come from infrastructure with valid forward and reverse DNS (PTR) records, and be transmitted over TLS. All of this is specified in Google's sender guidelines and Yahoo's sender best practices.
2. One-click unsubscribe (RFC 8058)
Bulk senders of marketing or promotional mail must support one-click unsubscribe — the List-Unsubscribe and List-Unsubscribe-Post headers defined in RFC 8058 — and must process unsubscribe requests within two days. This is separate from, and stricter than, the CAN-SPAM opt-out window below. A visible unsubscribe link in the message body is still required as well.
3. Spam-rate thresholds
Google instructs senders to keep their user-reported spam rate (measured in Postmaster Tools) below 0.10% and to never let it reach 0.30% or higher. Yahoo enforces the same complaint-rate ceiling. Cross the line and delivery degrades for the whole domain — authentication does not rescue a sender people are reporting.
Microsoft announced equivalent requirements for Outlook.com senders exceeding 5,000 messages per day in 2025, completing the alignment of the three major mailbox providers around the same baseline: authenticate fully, make leaving easy, and keep complaints near zero.
CAN-SPAM: the US legal baseline
The CAN-SPAM Act applies to all commercial email in the United States — B2B included. It is an opt-out regime: prior consent is not required, but every message must meet seven requirements, per the FTC's compliance guide:
- No false or misleading header information (From, To, Reply-To, routing)
- No deceptive subject lines
- Clear identification of the message as an advertisement (the law allows latitude in how)
- A valid physical postal address in every message
- A clear, conspicuous way to opt out of future email
- Opt-outs honored within 10 business days, at no charge, with no login required
- Responsibility for what vendors send on your behalf — hiring an agency does not transfer liability
Each separate violating email is subject to civil penalties that currently exceed $50,000 (the figure is adjusted for inflation; see the FTC guide for the current amount).
GDPR, ePrivacy, and CASL
Outside the US, the default flips from opt-out to consent-based:
- EU — GDPR and ePrivacy: processing a prospect's personal data (a work email tied to a person) requires a lawful basis under the GDPR. B2B outreach is commonly run under "legitimate interest," but national ePrivacy implementations differ significantly by member state — Germany, for example, is far stricter than Ireland. Assess per-country before sending into the EU.
- Canada — CASL: Canada's Anti-Spam Legislation requires express or implied consent before sending commercial electronic messages, plus sender identification and a working unsubscribe mechanism. Implied consent exists in limited cases (existing business relationships, conspicuously published addresses relevant to the message).
Where purchased lists fit
The legal answer depends on jurisdiction: CAN-SPAM does not prohibit emailing purchased or third-party contacts, while consent-based regimes (GDPR, CASL) make most purchased-list sending non-compliant unless consent transfers. The practical answer is stricter than the legal one: mailbox providers evaluate recipient behavior, not list provenance — and most marketing ESPs (Mailchimp, Klaviyo, and similar) prohibit purchased lists in their terms of service outright.
What actually determines outcomes is list quality. Across 170,000+ cold emails sent on our infrastructure over the past 12 months, campaigns using verified addresses averaged a 0.8% bounce rate; the one list we deliberately sent without verification bounced 98.4% — a rate that would burn a sending domain in a single day. Whatever the source of a list, verify every address before it sees a send and keep complaint rates within the thresholds above.
Compliance checklist
- Publish SPF and DKIM for every sending domain; verify both pass and align
- Publish a DMARC record (start at
p=none, monitor, then tighten) - Confirm valid PTR (reverse DNS) records for sending IPs; send over TLS
- Implement RFC 8058 one-click unsubscribe headers; process opt-outs within 2 days
- Include a physical postal address and a visible unsubscribe path in every message
- Register in Google Postmaster Tools and watch the spam-rate dashboard (< 0.10%)
- Verify every list before sending; suppress bounces and unsubscribes globally
- Map recipients by jurisdiction — US (opt-out), EU (consent/legitimate interest by state), Canada (consent)
For the technical implementation details — DNS records, warm-up schedules, monitoring — see our cold email deliverability guide. For what results compliant sending actually produces, see our cold email statistics report covering 2M+ real sends.
Primary sources
- Google: New Gmail protections for a safer, less spammy inbox (Oct 2023 announcement)
- Google: Email sender guidelines
- Yahoo: Sender best practices
- RFC 8058: Signaling one-click functionality for List-Unsubscribe
- FTC: CAN-SPAM Act — A Compliance Guide for Business
- EUR-Lex: Regulation (EU) 2016/679 (GDPR)
- Government of Canada: Canada's Anti-Spam Legislation (CASL)