# Sending limits and operating standards

The rules mailbox providers enforce on bulk senders, the tighter limits this practice operates to, and the industry findings that survive a primary-source check. Every figure names its source and the date it was checked. Anything that could not be traced to a primary source is not on this page.

Updated: 2026-07-29

## What providers enforce

The floor. Missing any of these is not an optimization problem, it is an outage.

### Google (Gmail)

since February 1, 2024, for senders of 5,000 or more messages a day

- SPF and DKIM authentication, and DMARC at p=none or stricter, aligned with the From domain.
- User-reported spam below 0.10 percent, and never at or above 0.30. Above 0.30, Gmail withholds delivery mitigation until the rate holds under it for 7 consecutive days.
- One-click unsubscribe per RFC 8058 on marketing mail, honored within 48 hours.

Source: [Google Email sender guidelines](https://support.google.com/mail/answer/81126). Checked 2026-07-29.

### Yahoo

since February 2024, enforcement rolled out gradually

- SPF, DKIM, and DMARC at p=none or stricter, aligned with the From domain.
- Spam complaint rate below 0.3 percent, measured against mail delivered to the inbox.
- Unsubscribes honored within 2 days.

Source: [Yahoo sender best practices](https://senders.yahooinc.com/best-practices/). Checked 2026-07-29.

### Microsoft (Outlook.com, Hotmail, Live)

since May 5, 2025, for senders of 5,000 or more messages a day to consumer addresses

- SPF and DKIM must pass, and DMARC at p=none or stricter, aligned with SPF or DKIM.
- Non-compliant mail is routed to the junk folder. Microsoft has announced outright rejection at an unspecified future date.

Source: [Microsoft, new requirements for high-volume senders](https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook%E2%80%99s-new-requirements-for-high%E2%80%90volume-senders/4399730). Checked 2026-07-29.

### RFC 8058, the one-click unsubscribe mechanics

- List-Unsubscribe and List-Unsubscribe-Post headers pointing at an HTTPS endpoint that accepts a POST, on a message carrying a DKIM signature that covers both headers.

Source: [RFC 8058](https://datatracker.ietf.org/doc/html/rfc8058). Checked 2026-07-29.

## What this practice operates to

Tighter than the floor on purpose. A published limit is where enforcement starts, not where sending is safe.

- Complaint rate: under 0.08 percent, holding headroom below Google's 0.10 guidance.
- Bounce rate: sending pauses at 5 percent until the list is fixed.
- Volume: capped at 50 sends per mailbox per day.
- Warmup and ramp: new domains and mailboxes warm up before carrying campaign volume, and volume rises on a schedule, never in one jump.
- Cadence: multi-day gaps between touches in a sequence, replies triaged daily, volume changes decided weekly against the deliverability numbers.

## What the data says

Only findings that check out against the original source are listed. Popular numbers that trace to vendor blogs citing each other are not.

Campaigns under 200 prospects produce 2x the reply rate and 4.4x the positive reply rate of campaigns over 1,000, in Saleshandy's analysis of 53.1 million cold emails sent January to June 2026. Small, tight lists beat volume.

Source: [Saleshandy cold email statistics](https://www.saleshandy.com/blog/cold-email-statistics/). Checked 2026-07-29.

Global inbox placement averaged 83.5 percent in Validity's 2025 benchmark. Their phrasing: one in six legitimate marketing emails fails to reach the inbox. Authentication is the entry fee, not a guarantee of placement.

Source: [Validity 2025 Email Deliverability Benchmark Report](https://www.validity.com/resource-center/2025-email-deliverability-benchmark-report/). Checked 2026-07-29.

Three of the twelve readiness check questions score a deployment against exactly these standards. It runs in 3 minutes, on the page.

Run it: https://cognitivegtm.com/readiness-check