How to send bulk email the right way

Bulk email is one message sent to a large list of recipients at once: a newsletter, a product announcement, a promotion. Since February 2024, Gmail and Yahoo enforce technical requirements on anyone sending 5,000 or more messages a day, and Microsoft added its own in May 2025. Mail that misses them is increasingly rejected outright rather than filed in spam. This guide covers what the rules require, why a regular mailbox account cannot meet them, and a step-by-step workflow for bulk sending that holds up.

What counts as bulk email

The threshold that matters is the one the mailbox providers use. Google treats anyone sending 5,000 or more messages a day to personal Gmail accounts as a bulk sender, and the count aggregates everything sent from the same primary domain, so mail from example.com and promotions.example.com counts together. Once a domain crosses the line, bulk sender status is permanent regardless of what volume does later. Yahoo announced matching rules jointly with Google, and Microsoft applies its own version to domains sending 5,000 or more messages a day to Outlook, Hotmail, and Live addresses.

The older name for this kind of send is an email marketing blast: the same message pushed to an entire list at once. The term survives, but sending one message to everyone regardless of interest is exactly the pattern that drives spam complaints, and complaint rate is now a hard metric. Segmented sends to the part of the list a message is actually relevant to are the modern form of the blast.

Bulk email is also a different category from transactional email, the receipts and password resets an application sends to one person at a time. The two are judged differently by mailbox providers and regulated differently by law, which is why they belong on separate sending domains.

Why a mailbox account can't send mass email

The obvious starting point is Gmail or Outlook, with the list in the BCC field or a mail merge add-on. The published sending limits make that a dead end well before real volume. These are the current caps:

The limits are only half the problem. A BCC blast offers no personalization, no per-recipient delivery tracking, and one wrong keystroke (Cc instead of Bcc) exposes the entire list to every recipient, which for a customer list is a privacy incident.

The other half is compliance tooling. A mailbox provides no unsubscribe headers, no suppression list, no bounce processing, and no complaint feedback loop, all of which the bulk sender rules below effectively require. A mailbox account runs out of quota two orders of magnitude before the 5,000-a-day threshold, so the rules were never written with one in mind.

The rules Gmail, Yahoo, and Outlook enforce

Google and Yahoo announced their requirements jointly in October 2023 and began enforcing them on February 1, 2024; Microsoft's version took effect on May 5, 2025. The three sets overlap almost entirely, so meeting Google's published sender guidelines effectively covers all three providers. The requirements for bulk senders:

• Full authentication. SPF and DKIM must both pass, a DMARC record must exist (at minimum p=none), and the visible From domain must align with the domain SPF or DKIM validated. The SPF, DKIM, and DMARC guide covers how to publish each record.
• One-click unsubscribe. Marketing messages must carry the RFC 8058 header pair shown below, and opt-outs must be honored within two days. A visible unsubscribe link in the body is required as well.
• Spam complaint rate below 0.3%. That is the enforcement threshold; Google recommends staying below 0.1% as measured in Postmaster Tools.
• Clean infrastructure. Sending IPs need valid forward and reverse DNS (PTR records), and delivery must use TLS.

The one-click unsubscribe requirement is two headers, added to every marketing message:

List-Unsubscribe: <https://yourapp.com/unsubscribe?c=123&u=456>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

The full requirement lists are published in Google's Email sender guidelines and Yahoo's sender best practices; Microsoft's are in its high-volume sender announcement.

The legal rules

Separate from the mailbox providers, three legal regimes cover most bulk sending, and they differ on one axis: whether consent is required before the first email.

• CAN-SPAM (US) is an opt-out regime: emailing first is allowed, but every message needs truthful headers, a physical postal address, and a working opt-out honored within 10 business days. The FTC's penalty is up to $53,088 per email.
• GDPR (EU) is opt-in: marketing to individuals requires consent that is active (no pre-ticked boxes), specific, provable, and withdrawable at any time.
• CASL (Canada) requires express consent before sending, with penalties up to CA$10 million per violation for organizations.

A permission-first list satisfies all three regimes at once, which is why the workflow below starts there rather than with tooling.

How to send bulk email, step by step

1. Collect permission, not just addresses

Every address on the list should belong to someone who asked to be there. Double opt-in (a confirmation click after signup) proves the address exists, keeps typos and bots off the list, and produces the consent record GDPR expects. A purchased list fails on every count: the recipients never opted in, the complaint rate will show it, and bought lists are where spam traps live.

2. Authenticate a dedicated sending domain

Publish SPF, DKIM, and DMARC before the first send, and put bulk mail on its own subdomain (such as news.example.com) rather than the domain transactional email uses. Reputation is tracked per domain, and marketing mail always draws more complaints than receipts do, so the split keeps a bad campaign from dragging password resets into spam. Google's guidelines themselves recommend separating mail types by From address.

3. Send through an email platform, not a mailbox

A bulk email platform exists to do the things a mailbox cannot: render a template per recipient, add the one-click unsubscribe headers, process bounces, and maintain the suppression list automatically. In Lettr's Campaigns, anyone who unsubscribes, bounces, or complains is excluded from every future send without a list to maintain, and an unsubscribe link is added to every campaign by default, so a send cannot ship without the one the law requires.

4. Warm up before full volume

A domain with no sending history cannot open at full volume. Google's guidance is to start with a low volume to the most engaged recipients and increase gradually; it warns that suddenly doubling previous volume can trigger rate limiting and reputation drops. The domain warm-up guide has two ramp schedules to copy.

5. Keep the list clean and segmented

List quality decays on its own: addresses die, interest fades. Remove hard bounces immediately, and follow Google's own recommendation to automatically unsubscribe recipients whose mail keeps bouncing and consider unsubscribing those who never open (a sunset policy). Segmenting each send to the contacts it is relevant to lowers complaints and raises engagement at the same time.

6. Measure clicks and complaints, not opens

Open rates stopped being trustworthy in 2021. Apple Mail Privacy Protection preloads tracking pixels when a message arrives, not when it is read, and Apple Mail accounts for roughly half of all email opens, so reported opens are inflated across the board. Clicks and conversions still measure real behavior. On the negative side, watch the spam complaint rate in Google Postmaster Tools and treat 0.1% as the ceiling to stay under.

FAQ

Bottom line

Sending bulk email the right way is a short list: a permission-based list, SPF, DKIM, and DMARC on a dedicated subdomain, a platform that handles unsubscribes and bounces automatically, a gradual volume ramp, and complaint monitoring. Every item on the list is now enforced by someone, either a mailbox provider or a regulator, which is exactly why bulk sending belongs on purpose-built infrastructure.

Lettr's Campaigns and Audiences handle the platform side: suppression, one-click unsubscribe, per-recipient rendering, and real-time results, with marketing and transactional streams kept on separate domains. Create a free account (3,000 emails and 500 contacts a month are included) and send the first campaign to yourself.