[ Deliverability & sender rules ]

Bulk-sender classification: check each provider's definition

Classify bulk sending with each destination’s own identity, volume and history rules, and preserve unknowns instead of manufacturing an exemption.

By the EmailAuth research team · 3 min read

[ Key points ]

  • Keep each provider’s domain grouping, volume and historical rules distinct.
  • Inventory activity beyond the campaign platform.
  • Use estimated counts for planning, not as a receiver classification certificate.
On this page

A business may think it sends only a few hundred newsletters while its applications generate thousands of other messages. Another may divide campaigns among subdomains and assume each is a separate sender. Bulk classification requires a destination-specific count and identity model, not a count taken from one marketing dashboard.

Record the provider’s actual definition

Google's FAQ groups messages from the same primary domain, describes the threshold as close to 5,000 or more in 24 hours, and says classification persists once reached. Yahoo does not publish a numeric threshold. Microsoft's current consumer support article uses 5,000 or more with the same visible From domain; its original announcement describes daily sending. These differences should remain explicit. Google FAQ, Yahoo FAQ and Microsoft support.

Do not transfer Google's primary-domain aggregation or permanent-status wording to another provider without that provider's evidence. Conversely, an unpublished Yahoo threshold is not proof that a low-volume stream is exempt. When the classification is uncertain, document that uncertainty and meet the stronger controls where practical.

Inventory messages outside the campaign platform

List billing, support, account notifications, sales systems, event invitations and employee mailbox services. For each source, retain timestamp, destination service, visible From domain and the available sender identity fields. Define how your internal report handles retries and duplicate events so a resubmission is not silently counted as an entirely new intended recipient.

An internal report is a planning tool, not a reproduction of a receiver's private classifier. The provider may have evidence you cannot observe. Label estimated counts as estimates and preserve any provider dashboard classification separately. Avoid presenting a spreadsheet total as a formal certification of non-bulk status.

Reproduce a simple aggregation example

The private review package’s synthetic model assigns 3,000 messages to a primary domain and 2,200 to its promotional subdomain in the same observation period. The total is 5,200. For the Google grouping described above, looking only at the 2,200-message campaign would miss the combined activity.

These are invented inputs. The fixture computes the total from the named primary_domain and subdomain inputs and asserts that it equals 5,200; it does not connect to Gmail, decide how Yahoo classifies a sender or emulate Microsoft's classifier. Its purpose is to make the inventory error visible. To reproduce the exercise, change one stream count and observe how the group total changes while the source rows remain separately attributable.

Preserve history and distinguish destination scope

Keep historical classification evidence when a provider's rule makes history relevant. A quiet week does not automatically undo an earlier status. Record the date of the source review, the count window, the source systems included and any periods with missing logs. Missing history should remain a gap, not be interpreted as zero volume.

Group recipients by the actual service scope needed for the policy. A familiar desktop client or a company domain using a provider's infrastructure does not necessarily belong to the provider's consumer rule. Keep uncertain destination mappings visible and avoid sending extra mail merely to discover how a receiver classifies the sender.

Use classification to improve controls

The useful outcome is a list of applicable controls and owners, not a strategy for staying just below a limit. Splitting traffic without fixing authentication, consent or unsubscribe handling leaves those problems intact and can make the inventory harder to maintain.

Revisit the record after acquisitions, new applications, domain changes or large launches. Close with the provider-specific status, evidence and unresolved scope questions. This is a planning workflow, not a promise that a receiver will classify a sender in a particular way.

[ Takeaway ]

Use estimated counts for planning, not as a receiver classification certificate.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Make aggregation reproducible

A total needs identities and a time window.

Next steps

  1. Document grouping rules.
  2. Deduplicate internal events.
  3. Preserve historical gaps.

CISO / SecOps

Avoid false non-bulk assurances

The receiver may classify using additional evidence.

Next steps

  1. Review policy dates.
  2. Retain provider observations.
  3. Reject threshold-evasion plans.

Founder / Non-technical

Count the whole sending operation

Marketing volume can hide application traffic.

Next steps

  1. Inventory business systems.
  2. Plan controls before growth.
  3. Keep uncertain scope visible.

[ FAQs ]

Frequently asked questions

Is one campaign dashboard enough to classify a sender?

No. Inventory the other systems using the relevant identities too.

Does every provider publish the same threshold?

No. Keep provider-specific definitions separate.

Current provider guidance Current provider guidance Current provider guidance

Can subdomain splitting be assumed to avoid grouping?

No. Check the receiver’s identity aggregation rules.

Current provider guidance

What does the 5,200-message example prove?

Only the arithmetic and the inventory risk in the stated synthetic scenario.

Should missing historical logs be counted as zero?

No. Record the missing period as an evidence gap.

Is an internal spreadsheet the provider’s classifier?

No. It is a planning estimate based on available data.

When should classification be revisited?

After material changes in applications, domains, traffic or provider guidance.

What is the intended outcome?

Applicable controls, evidence and accountable owners, not evasion of a volume boundary.

[ Sources ]

Sources

  1. GOOGLE FAQ official requirements

    Sections Bulk senders · Google Workspace accounts

  2. YAHOO FAQ official requirements

    Sections Bulk senders

  3. MICROSOFT official requirements

    Sections What defines a high volume (large) sender?

  4. MICROSOFT UPDATE official requirements

    Sections Scope

[ Glossary ]

Glossary

Bulk classification
A receiver-specific determination that a sender falls within a higher-volume category.
Aggregation scope
The identities and messages combined for a count.
Historical classification
A retained status or observation from an earlier sending period.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base