nanoPost

The WordPress Email Authority

Gmail and Yahoo bulk-sender rules: what a WordPress site actually has to do

Last reviewed/updated:

A Gmail deferral showed up in the plugin log, the sending provider sent a compliance email quoting “bulk sender requirements,” or a Postmaster notice arrived and someone asked what it means for the site. In every case, the question is the same: does this WordPress installation have to do anything, and if it does, where does the fix live?

Gmail has enforced four sender requirements since February 2024, triggered at 5,000 messages per day to Gmail addresses. Yahoo introduced matching requirements at the same time for bulk senders, though Yahoo does not publish a numeric threshold. Authentication failures show up as deferrals: Gmail returns a 5.7.26 error code when a message fails SPF and DKIM checks, typically reading something like “This message does not have authentication information or fails to pass authentication checks.”

Am I affected?

The 5,000-per-day threshold applies to the sending domain, not to a single mailbox or plugin. A WordPress site sending a weekly newsletter to 30,000 active subscribers crosses the threshold on send day. A WooCommerce store processing 150 or more orders per day crosses it on order-confirmation and shipping-notification volume combined.

To check actual volume, go to the log in whichever mailer plugin the site is running:

  • WP Mail SMTP: Email Log, filter by date, sum the sent count.
  • FluentSMTP: Email Logs, date filter, count.
  • Post SMTP: Email Log, export CSV, count rows.
  • Provider dashboard: if mail goes out through a provider, the provider’s daily count is authoritative. In SendGrid, check Activity Feed; in Postmark, Message Streams; in Mailgun, Logs; in Amazon SES, Sending Statistics.

Authentication is not optional at any volume: all senders must have SPF or DKIM in place. Above the 5,000/day threshold, the requirements tighten: both SPF and DKIM must be configured (not just one), DMARC must be present at minimum p=none, and marketing and newsletter messages must support one-click unsubscribe.

The four requirements, as WordPress work

SPF

SPF authorizes the servers allowed to send mail for a domain. The record is a DNS TXT entry published at the registrar: v=spf1 include:sendgrid.net ~all is the shape of it, where the include: value comes from the sending provider’s setup documentation.

In a WordPress setup, SPF means finding that include: value and pasting it as a TXT record at the registrar. WP Mail SMTP shows the required value under the active mailer’s settings. FluentSMTP shows it in the connection modal. If you’re connecting to a provider directly without a mailer plugin, the value is in the provider’s domain-authentication or sender-authentication docs.

To see the current SPF record for the sending domain, run the DNS Auth Checker. The checker parses the record and flags common problems: missing include: for the provider, conflicting records, or a lookup chain that exceeds the 10-lookup limit.

DKIM

DKIM signs outgoing messages with a private key held by the sending provider. Receiving mail servers use the corresponding public key to verify the message was not altered in transit. The public key publishes at the registrar as a TXT record (sometimes CNAME, depending on the provider) under a provider-specific subdomain like s1._domainkey.example.com.

In a WordPress setup, the keys and selectors come from the sending provider. WP Mail SMTP shows them under the active mailer’s settings for supported providers. FluentSMTP has a Sender Authentication panel. For providers connected directly, the keys are under Sender Identity or Domain Authentication in the provider dashboard.

The DNS Auth Checker verifies the DKIM record is present and correctly formatted. If it returns a mismatch, the selector in the record may not match the one the provider is using for signing.

DMARC

DMARC tells receiving mail servers what to do when a message from a domain fails SPF and DKIM alignment. Gmail requires at least p=none for bulk senders above the threshold. p=none means failing mail still delivers, but the failures show up in aggregate reports sent to the address in the rua tag of the policy. Yahoo requires the same.

The record publishes at the registrar as a TXT record under _dmarc.example.com. A minimal policy looks like: v=DMARC1; p=none; rua=mailto:[email protected]. No mailer plugin field is involved; DMARC is pure DNS.

Start at p=none, read the aggregate reports as they arrive, and move to p=quarantine once every legitimate sender for the domain is aligned. Moving to a stricter policy before that confirmation will block mail from providers or systems not yet configured correctly. The DNS Auth Checker parses the DMARC record and flags common problems: missing rua tag, syntax errors, and policy values that conflict across multiple records.

One-click unsubscribe (RFC 8058)

One-click unsubscribe requires that marketing and newsletter messages carry a List-Unsubscribe header alongside a List-Unsubscribe-Post: List-Unsubscribe=One-Click companion, and that the unsubscribe endpoint processes the request without routing the subscriber through a confirmation page. This requirement applies to bulk senders above the threshold sending to personal Gmail or Yahoo addresses. Transactional messages are exempt.

Whether the correct headers go out depends on which WordPress plugin generates the messages. For newsletter and marketing mail, check the plugin’s current documentation for one-click unsubscribe support. MailPoet and FluentCRM are among the plugins that document this feature, but verify the current version’s behavior in each plugin’s own docs rather than relying on a fixed list. If you’re sending through a custom wp_mail() call without a dedicated newsletter plugin, the headers are not added automatically; they have to be added to the message array explicitly.

To check whether a message from the site carries the correct headers, test it with the List-Unsubscribe Validator.

The canonical sources for the requirements as Google and Yahoo have stated them: Gmail bulk-sender requirements, Yahoo bulk-sender requirements. The underlying primary documentation is Google’s Email sender guidelines and Yahoo’s Sender Hub best practices.

Where to go from here

  • If the DNS Auth Checker flagged missing or misconfigured SPF, DKIM, or DMARC: the WordPress email setup guide covers authentication configuration for the major mailer plugins and providers. The deliverability section walks through each record type and where to find the values for each sending path.
  • If the List-Unsubscribe Validator flagged missing headers: the fix depends on how the mail is generated. For a dedicated newsletter plugin, check the plugin’s documentation for a one-click unsubscribe setting that may need enabling. For custom wp_mail() code, add the List-Unsubscribe and List-Unsubscribe-Post headers to the $headers array in the send call; the unsubscribe endpoint must handle an HTTP POST and action it immediately, without a confirmation redirect.
  • If the site is below 5,000/day but shares sending infrastructure with a bulk sender (shared sending IP, shared subdomain): the requirements apply to the sending domain, not to individual volume. Authentication failures still affect deliverability regardless of your own message count.
  • If you’re not sure which plugin or service generates outbound mail: the DNS Auth Checker shows the return-path domain and DKIM signing domain, which identifies the sending path.

Related coverage

Changelog

  • 2026-09-03 – Published. Reflects the Google Postmaster and Yahoo Sender Hub bulk-sender requirements in force since February 2024. Checked against primary sources at publication date.