Gmail and Yahoo Sender Rules for Shopify Stores

Quick answer: Google treats you as a bulk sender once you send close to 5,000 messages a day to personal Gmail accounts, counted across your whole primary domain, and it does not take the label back. Bulk senders need SPF, DKIM and DMARC, a From address that lines up with the authenticated domain, one-click unsubscribe on marketing email and a spam rate under 0.3% in Postmaster Tools (Google asks for under 0.10%). Yahoo publishes the same kind of rules and a 0.3% spam-rate line but no volume number, so a Shopify store with a real email list should set itself up as a bulk sender. Most of the work is a few DNS records and settings in Shopify and your email app.

If you run a Shopify store with an email list, you have probably seen the warnings: Shopify telling you your sender address will be rewritten, Klaviyo telling you to set up a branded sending domain, someone telling you your emails are “going to spam”. Most of what ranks for this topic is written for developers and email platforms. This is for the founder who needs to know whether a store with 8,000 subscribers is a bulk sender, where the spam-rate number lives, and which parts the email app already handles.

One thing up front. Prism3 does not run email or ads. We work on conversion after the click, organic and AI-search visibility, and measurement. This is a diagnostic checklist so you can check your own setup or brief whoever runs your email, not a service we sell. It is also not legal advice. Gmail and Yahoo’s rules are the mailbox providers’ own sender requirements, separate from consumer, spam and privacy law. Australian rules on commercial email are a different matter. I have not covered them here, so check them with the regulator or a lawyer.

Everything below was checked against the providers’ own pages on 31 October 2026. Where I could not confirm something at the source, I say so.

What the rules say, in one table

Google publishes “Email sender guidelines” and a longer FAQ in its help centre. Yahoo publishes “Sender Requirements & Recommendations” on its Sender Hub. Google’s requirements apply to mail sent to personal Gmail accounts, not to messages sent to Google Workspace accounts. Yahoo’s page says enforcement was to begin in February 2024 and be rolled out gradually through the first half of that year. Google’s FAQ says that from November 2025 it is “ramping up” enforcement, with temporary and permanent rejections for traffic that fails the requirements.

Google also lists requirements your email platform mostly manages: valid forward and reverse DNS (PTR) records, TLS, messages formatted to RFC 5322, and no impersonating Gmail From headers.

Blogs disagree about whether Yahoo gives a spam-rate number. Here is only what Yahoo’s own page says: under both “all senders” and “bulk senders” it says to keep your spam rate below 0.3%, calculated from mail delivered to the inbox, so your own sums may differ.

Are you a bulk sender? The 5,000 maths for a Shopify store

Google’s guidelines page sets the extra rules for senders who send “more than 5,000 messages per day” to Gmail accounts. Its FAQ defines a bulk sender as one that sends close to 5,000 messages or more to personal Gmail accounts within 24 hours. That “close to” matters, so to be safe treat 4,000 a day as inside the line.

Three details change how you apply it.

It counts Gmail recipients, not your whole list. Take a store with 12,500 subscribers where 40% use Gmail (an assumption for illustration; your email app can show your real share). One campaign to everyone puts 5,000 messages into Gmail in a day, before flows and order confirmations.

It counts the primary domain. Google’s FAQ counts all messages from the same primary domain, and its example is 2,500 messages a day from solarmora.com plus 2,500 from promotions.solarmora.com making a bulk sender. So marketing sent from mail.yourstore.com and a flow sent from yourstore.com add together.

It does not expire. Google’s FAQ says senders who meet the criteria at least once are permanently considered bulk senders. One large Black Friday send, with Black Friday on 27 November 2026, can tip a mid-sized list over for good.

Do transactional emails count? Google’s FAQ excludes transactional messages from the one-click unsubscribe requirement, but it does not say they are excluded from the 5,000. It says it counts “all messages sent from the same primary domain”, and Klaviyo’s help article on branded sending domains says all traffic counts toward the threshold, including transactional email. Plan on that reading: order confirmations, shipping notices and flows all count.

A simple decision rule:

• Over about 12,000 subscribers. One full-list send can reach the line. Assume you are a bulk sender.
• Between about 5,000 and 12,000. A big sale day plus flows and order emails can cross it.
• Under about 5,000. Google’s bulk-only rules may not apply yet, but its rules for all senders do (SPF or DKIM, a spam rate under 0.3%), and Yahoo’s page gives no volume cut-off at all.

These cut-offs are my rules of thumb using the illustrative 40% Gmail share, not Google’s. Whichever band you are in, set up as a bulk sender: the cost is a handful of DNS records, done once. Klaviyo’s sender-requirements guide says bulk senders who regularly email Google and Yahoo recipients need a branded sending domain and cannot use its shared one, and Shopify’s help says it rewrites your sender address if you take no action.

Where the email in your store actually comes from

Before fixing anything, list every tool that sends mail as your domain: Shopify’s own store emails, your email platform for campaigns and flows, any helpdesk, reviews, subscriptions or returns app, and the human inbox your team replies from. They all share one root domain, so they share one DMARC record. Write the list down; it feeds the checklist at the end.

Step 1: send from a domain you own

Look at the From address in Shopify notifications and in your email app. If it ends in @gmail.com or @yahoo.com, fix that first. Klaviyo’s guide says to use an address on a domain you own, and that the domain in the From address must align with the root domain of your branded sending domain. Google’s guidelines list “using an @gmail.com domain as the display name for bulk email” as a spoofing practice. Without a domain whose DNS you control, there is nothing to authenticate.

Step 2: SPF and DKIM

SPF lists which servers may send mail for your domain. Google describes it as preventing spammers from sending unauthorised messages that appear to be from your domain. Microsoft’s guidance warns that going over 10 DNS lookups can make an SPF check fail, a risk when several tools share one domain.

DKIM adds a digital signature that receiving servers use to verify the domain owner sent the message. Google says sending to personal Gmail accounts needs a DKIM key of 1024 bits or longer and recommends 2048 if your provider supports it. Yahoo asks for a minimum of 1024.

On Shopify you rarely write either by hand:

• Shopify’s store emails. Under Settings, then Notifications, in the Sender email section, you choose to authenticate your domain. Shopify’s help says the CNAME records you add handle both DKIM and SPF, so you do not need a separate SPF record for it. For domains at Cloudflare, GoDaddy or IONOS Shopify offers an automatic option; otherwise you add the records manually.
• Klaviyo’s emails. Klaviyo’s help says its branded sending domain lets inbox providers verify your identity and pass authentication such as DMARC. Setup asks you to add DNS records (NS records, or CNAME records including DKIM ones, plus a TXT record). Klaviyo’s help says a new account starting on a marketing branded sending domain, or any domain registered in the last 30 days, should be warmed up over the first 2 to 4 weeks. Existing customers whose domain is at least 30 days old and has already sent email do not need to warm up again.

Microsoft adds that even when a third party does the sending, authentication is tied to your domain, so every tool needs its own records.

Step 3: DMARC and alignment

DMARC is the step Shopify’s automatic setup and Klaviyo both leave for you to publish.

DMARC is a TXT record published at _dmarc under your domain. It tells receiving servers what to do with mail claiming to be from you that fails authentication, and it asks for reports. The current definition is RFC 9989, which obsoletes the older RFC 7489. The details below match RFC 9989.

The pieces that matter to a store owner:

• The p= tag is the policy: none (the owner offers no preference for how failures are handled), quarantine (the owner considers the mail suspicious) or reject (the owner considers the failure a clear sign the domain is being misused).
• The rua= tag names an address for aggregate reports. Yahoo calls it strongly recommended, and Klaviyo calls it recommended but not required. The reports show who is sending as your domain, which is how you find the forgotten helpdesk.
• A message passes DMARC when SPF or DKIM passes and the domain that passed matches the domain in your visible From address. That match is called alignment. Under relaxed alignment, the default, the two domains need to share the same organisational domain, so news.example.com aligns with example.com.

What Google and Yahoo ask for. A DMARC record for bulk senders, and a policy of none is enough. Yahoo’s wording is “a valid DMARC policy with at least p=none”, and Google says the enforcement policy can be set to none. Shopify’s help gives v=DMARC1; p=none; as its default record, and Klaviyo says a policy of p=none is all it needs.

Where stores go wrong:

1. No DMARC record. Shopify’s help says its automatic authentication does not add a DMARC record; you add one yourself. Google’s FAQ says a missing DMARC record, or one without a policy, triggers the error 4.7.31 for bulk senders.
2. Two records. Shopify’s help says multiple DMARC TXT records cause validation to fail. If an old tool added one, edit it rather than adding a second.
3. Authenticated, but not aligned. The mail passes SPF or DKIM on a domain that is not your From domain, as when an app sends through its own shared domain. Google’s FAQ says only one of the two needs to align, recommends aligning both, and says aligning both will likely become a requirement.
4. Jumping to reject too soon. Microsoft’s FAQ advises moving gradually, none then quarantine then reject, to avoid unintended mail loss. Neither Google nor Yahoo asks bulk senders for more than none.

To check, look up the TXT record at _dmarc.yourdomain.com with any DNS lookup tool. Nothing back means no record; two lines starting v=DMARC1 means duplicates.

Step 4: one-click unsubscribe

This is the requirement people over-engineer. It applies to marketing and subscribed messages. Google’s FAQ excludes transactional messages (its examples are password resets, reservation confirmations and form submission confirmations) and says recipients, not Google, decide what counts as marketing, so keep promotions out of transactional templates.

“One-click” is specific. It is two headers on the message: a List-Unsubscribe header and a List-Unsubscribe-Post header with the value List-Unsubscribe=One-Click. This is RFC 8058. It says the message needs a valid DKIM signature covering both headers, the receiver unsubscribes the person with an HTTPS POST, and the sender must not redirect that POST. If the signature is missing, the receiver should not offer one-click at all. Google’s FAQ says a mailto link or a landing-page link on its own does not meet the requirement. Yahoo is looser: it calls the RFC 8058 method “highly recommended” and the mailto method acceptable. Build for RFC 8058 and both are covered. Both providers also want a clearly visible unsubscribe link in the body.

On timing, Yahoo says to honour unsubscribes within 2 days. Google’s FAQ recommends fulfilling requests within 48 hours.

For a Shopify store using Klaviyo, the practical answer is usually “nothing to build”. Klaviyo’s help says it adds a one-click unsubscribe to the header of every marketing email automatically. What stays with you is checking that every template, especially custom-coded ones, still has a clear unsubscribe link at the bottom. If you use another email app, ask its support whether it sends both headers on marketing mail.

Step 5: spam rate, and where to see it

This is the number most founders cannot find. Klaviyo’s own checklist sends you to Google Postmaster Tools for Gmail, and says its Deliverability hub shows the spam complaint rate for every provider except Gmail.

What Google measures. Google’s Postmaster Tools help defines the spam rate as messages delivered to an engaged recipient’s inbox and then marked as spam by the recipient. It reflects user-reported spam, not mail Gmail files in spam automatically, and it covers only DKIM-authenticated mail. So unauthenticated mail is invisible in the dashboard, and an extremely low rate can mean the data is incomplete rather than your list being excellent.

The thresholds. Google’s guidelines say to keep the rate under 0.10% and avoid ever reaching 0.30% or higher. The FAQ adds that 0.1% is not just a tidy target: rates above 0.1% already hurt inbox delivery for bulk senders, and 0.3% or higher hurts more. It also says bulk senders above 0.3% are ineligible for mitigation (Google’s support route for delivery problems), and become eligible again after 7 consecutive days below 0.3%.

An illustration, not a benchmark: 0.1% is one spam report per 1,000 messages and 0.3% is three. A campaign reaching 20,000 Gmail inboxes is 20 reports against 60. On a send of 2,000 inboxes, 0.3% is only six people.

How to see it:

1. Sign in to Google Postmaster Tools and add the domain you use to authenticate outgoing email: Google says to add either the DKIM (d=) domain or the SPF (Return-Path) domain. Then verify it by adding the TXT or CNAME record Google gives you at your DNS host. Until the domain is verified, Postmaster Tools shows no data.
2. Open the Spam rate dashboard. Google says the data is typically updated within 24 hours, though it can take longer.
3. Open the Compliance status dashboard, which Google says is available to all senders. For all senders it checks SPF and DKIM, DNS records, message formatting, encryption and the user-reported spam rate. For bulk senders it also checks DMARC, one-click unsubscribe and honouring unsubscribes. Each item shows Compliant, Needs work or No data found, and Google says the status reflects the settings it saw when emails arrived, not your current configuration.
4. After you fix something, allow time. Google says it can take up to 7 days for changes to show in the dashboard.

The low-volume catch. Google’s help says dashboards might not include all data on days when outgoing volume is low, to protect users’ privacy. I could not find a minimum volume stated on Google’s pages. A smaller store may see “no data” most days, which is not proof you are fine. Watch the unsubscribe and spam-report numbers your email app shows, and look at Postmaster Tools after your biggest sends.

Yahoo’s side. Yahoo says an active Complaint Feedback Loop (CFL) is needed for all DKIM domains. Ask your email provider whether it has enrolled yours.

What brings the number down is mostly not technical. Yahoo’s recommendations read like a list-quality checklist: remove invalid recipients promptly, watch bounces and inactive recipients, use confirmed opt-in and honour the frequency people signed up for. Microsoft suggests cleaning inactive and invalid addresses monthly or quarterly.

What Klaviyo handles, and what stays with you

Here is the split, based on Klaviyo’s sender-requirements checklist and its help article on branded sending domains.

Klaviyo says most accounts start on a shared IP and domain, shown as “via klaviyomail.com” beside the sender address, and that a branded sending domain removes that label. If you use a different email app, treat these rows as questions for its support team.

Shopify’s own emails are a separate stream

It is easy to authenticate marketing and forget the rest. Your store notifications, such as order confirmations, go out through Shopify using the sender email you set under Settings, then Notifications, and that address has its own authentication.

Shopify’s help says that if you take no action, your sender email is rewritten to an address like store+123@shopifyemail.com, where the number is unique to your store. It ties this to Gmail and Yahoo requiring domain authentication and a DMARC record from 1 February 2024, and says multiple DMARC records also cause the problem. The fix is the one above: add Shopify’s CNAME records and one DMARC record of at least v=DMARC1; p=none.

Yahoo also says not to send bulk or marketing mail from the same IPs you use for transactional mail.

What about Microsoft?

Outlook.com has its own rules. Microsoft’s post “Strengthening Email Ecosystem: Outlook’s New Requirements for High-Volume Senders”, dated 2 April 2025 and updated on 30 April 2025, says they apply to Outlook.com, its consumer service (hotmail.com, live.com and outlook.com addresses), and to domains sending more than 5,000 emails a day. Microsoft’s support article on the 550 5.7.515 error is more specific. It defines a high-volume sender as one sending 5,000 or more messages to Microsoft consumer email services, all using the same domain in the From address. Past that point, SPF and DKIM must both pass, the domain must publish a DMARC record (its example is v=DMARC1; p=none), and at least one of SPF or DKIM must align with the From domain.

On enforcement, the April post says non-compliant mail goes to Junk from 5 May 2025, with rejection to follow, yet it also describes a 550 5.7.515 rejection, so its wording is mixed. The support article says Microsoft now enforces these requirements and that failing messages are rejected with that error. It carries no date, so as at 31 October 2026 I can say rejection is what Microsoft’s support page describes, but not when it began; check Microsoft’s sender support for the current position. The practical point: SPF, DKIM and an aligned p=none DMARC record cover all three providers’ published minimums for a bulk sender.

The checklist

Run this against your store.

Domain and senders

1. Your From address, in Shopify and in your email app, is on a domain you own.
2. Marketing and flows send through a branded sending domain.
3. You have a written list of every tool that sends mail as your domain.

Authentication 4. Shopify’s sender email domain authentication is complete (Settings, then Notifications). 5. Your email app shows its sending domain as active or verified. 6. Exactly one DMARC record exists at _dmarc.yourdomain.com, at least p=none, with an rua address someone actually reads. 7. The domain in your From address aligns with the SPF or DKIM domain. 8. You have not stacked so many tools into SPF that it passes 10 lookups.

Unsubscribe 9. Marketing mail carries the one-click headers (confirm with your app’s help page) and a visible body link. 10. Unsubscribes take effect within 2 days, sooner if you can.

Monitoring 11. Your domain is verified in Postmaster Tools and someone checks Spam rate and Compliance status after big sends. 12. Your provider has confirmed Yahoo’s Complaint Feedback Loop is covered. 13. You have written down your own limit (under 0.10% for Gmail) and what you do if you pass it, such as pausing the segment.

List quality 14. Sign-up forms and checkout say what people will receive and how often, with no pre-ticked box. 15. You have a rule for subscribers who never engage, so you are not mailing them indefinitely.

To check a single email, send one to a Gmail address you control, open it, choose More, then “Show original” (Google’s instructions), and read the SPF, DKIM and DMARC lines. The three should pass for the domain in the From address.

What you would see when something is wrong

Google’s FAQ says non-compliant messages can get temporary failure codes (4.7.x), permanent rejections (5.7.x) or go to spam, and that spam-rate and missing-DMARC problems can make you ineligible for mitigation. It says enforcement is gradual and, from November 2025, ramping up. A missing DMARC record shows up as error 4.7.31, and a From domain that does not align as 4.7.32. Microsoft’s support article describes a 550 5.7.515 rejection. Shopify rewrites an unauthenticated sender address. The Yahoo page I read lists the requirements and the 0.3% line but no penalties beyond “a negative impact to the delivery of your mail”.

If email revenue has dropped or customers say order emails never arrive, work in this order: authentication first (cheap and mostly pass or fail), then the spam rate, then list quality.

Where this fits in the growth system

Deliverability decides whether the email part of your growth system works at all. Flows only earn when they reach an inbox, which is why it matters for customer lifetime value. Email sits alongside paid, organic and conversion work in the DTC growth system.

The part that sits in our lane is measurement. If email revenue in your reports looks higher or lower than Shopify shows, you may have an attribution problem rather than a deliverability one. Anchor on the three numbers Shopify founders watch before you change anything, and see how to grow revenue without more ad spend for where email fits when paid costs more.

None of this needs a new tool. Do the checks, then look at Postmaster Tools after your next big send.

Key takeaways

• Google’s bulk-sender line is close to 5,000 messages a day to personal Gmail accounts, counted across your primary domain, and it is permanent. Yahoo’s page gives no number.
• Set up as a bulk sender whatever your size: SPF and DKIM, one DMARC record (p=none is enough for Google and Yahoo), a From address on your own domain and a branded sending domain in your email app.
• One-click unsubscribe is two headers (RFC 8058) on marketing email. Klaviyo says it adds them automatically.
• Keep your Gmail spam rate under 0.10% and never reach 0.30%. Yahoo’s stated line is 0.3%. Gmail’s figure lives in Postmaster Tools.
• Shopify’s own store emails need their own authentication, or Shopify rewrites the sender.

FAQs

Do the Gmail and Yahoo rules apply to a small Shopify store?

Some of them. Google’s rules for all senders (SPF or DKIM, a spam rate under 0.3%, valid DNS records, TLS) apply to anyone sending to personal Gmail accounts. The bulk-only rules start at close to 5,000 messages a day, and Yahoo names no number. The setup is one-off, so set up as a bulk sender anyway.

How many emails make me a bulk sender?

For Gmail, close to 5,000 or more messages to personal Gmail accounts in 24 hours, counted across your primary domain including subdomains, and permanent once met. Yahoo’s Sender Hub page uses the term without a number. Microsoft’s support article for Outlook.com uses 5,000 or more messages to its consumer services, all with the same From domain.

What spam rate do I need to stay under?

Google says keep user-reported spam under 0.10% and never reach 0.30%. Yahoo’s page says to keep it below 0.3%. As an illustration, 0.3% is three spam reports for every 1,000 messages that reach the inbox.

Do I need DMARC at p=reject?

No. Google and Yahoo ask bulk senders for a DMARC record, and a policy of none is enough. Microsoft’s FAQ calls reject the most effective against spoofing once your legitimate sources are aligned, and advises moving gradually. Authenticate every tool sending as your domain before you tighten it.

Does Klaviyo handle all of this for me?

Not all of it. Klaviyo says it adds one-click unsubscribe to every marketing email and generates the DNS records for a branded sending domain. You still own the DNS, the DMARC record, a From address on your own domain and your Gmail spam rate in Postmaster Tools.

Do order confirmation emails count?

For one-click unsubscribe, no: Google’s FAQ excludes transactional messages. For the 5,000-a-day count, Google’s FAQ says it counts “all messages sent from the same primary domain”, and Klaviyo’s help says transactional email counts toward the threshold. Authentication applies to transactional mail either way, which is why Shopify’s own sender address needs its authentication.

Keep reading

• How email lifts customer lifetime value on Shopify
• The abandoned cart flow on Shopify and Klaviyo
• Your first Shopify welcome flow in Klaviyo

Want a second pair of eyes on where your first order leaks?

Getting your email delivered is half the job; what happens when the shopper clicks through is the other half. Book a free 30-minute diagnostic: we look at where your store loses buyers after the click, using your own numbers, and tell you what to fix first. We do not run ads or email. No pitch. No email gate. If conversion and tracking are the part you want checked, see how our Shopify CRO service works.