That number is 5,000 messages per day.
What the thresholds actually are
Gmail's sender requirements, effective February 2024, apply to senders delivering 5,000 or more messages a day to Gmail accounts. Yahoo introduced parallel requirements in the same month, though Yahoo describes the group as bulk senders without publishing a number.
Microsoft went further. From May 2025, senders delivering 5,000 or more messages a day from a single From domain to outlook.com, hotmail.com and live.com must pass SPF and DKIM and have a DMARC record at minimum policy.
Consider what 5,000 a day means for a first year business. That is 150,000 a month to one provider. If you are a consultant, a contractor, a studio or a shop, you are not close, and you will not be close for years.
So the honest position on most of the advice circulating about this is that it describes obligations you do not have.
What does apply to you
The requirements below the bulk threshold are shorter and worth knowing precisely, because this part is real.
SPF or DKIM on your sending domain. Not both as a legal matter, though both is the correct answer for other reasons below.
Valid forward and reverse DNS for your sending servers, which your email provider handles if you use a normal one.
A spam complaint rate under 0.3 percent, with Google's own guidance suggesting you aim for under 0.1 percent. This applies to every sender regardless of volume, and it is the one most likely to catch a small business that buys a list.
Messages formatted to the standard email specification, which again your provider handles.
DMARC, strict alignment between your visible From address and your authenticated domain, and one click unsubscribe are bulk sender obligations. They do not apply to you at your volume.
The way a small business does get caught
There is one route by which a business nowhere near 5,000 a day ends up inside these rules, and it is worth understanding because it is not obvious.
The threshold counts messages sent from your domain, not messages sent by you personally. If a newsletter platform, a booking system, a review request tool and an invoicing service all send on your behalf using your domain, those add together. Each one alone looks trivial. The aggregate is what gets counted.
That matters more under Microsoft's version than the others, for a reason covered below.
Why to authenticate anyway
Two reasons, neither of which is compliance, and both of which are better reasons than compliance.
Your ordinary mail is being filtered and nobody tells you. This is the one that costs money. A quote sent to a prospect lands in their junk folder, you hear nothing, and you conclude they went elsewhere. There is no bounce message and no notification. The same applies to invoices, which is a worse version of the problem because you then chase a client who never saw it. Authentication is the largest single factor you control here. I have written separately on what email deliverability is and why it matters and how to avoid the spam folder, which cover the mechanics.
Without DMARC, anybody can send mail that appears to come from your domain. This is the security case and it is the one that gets ignored. SPF and DKIM let a receiving server check whether a message is really from you. DMARC is the instruction telling that server what to do when the check fails. With no DMARC record, the answer is whatever the receiving server feels like, which in practice often means delivery.
A business with an unprotected domain is a usable tool for somebody sending invoices to your customers in your name. The customers who get hurt are yours, and the first you hear of it is a phone call from one of them.
That risk does not scale with your sending volume. It is identical for a business sending five emails a day and one sending fifty thousand.
The Microsoft change is different in kind
Worth separating out, because most coverage treats the three providers as one announcement and they are not.
Google and Yahoo filter. A non compliant bulk message gets treated as suspicious and tends toward the spam folder.
Microsoft rejects. A non compliant message to outlook.com, hotmail.com or live.com above the threshold is refused at the door with a 550 error and never delivered at all.
The practical difference is that a filtered message still technically arrived somewhere a recipient could find it. A rejected one did not happen. If your business ever does run a large send, through a provider, to a list with a lot of Microsoft consumer addresses on it, an authentication gap produces total failure for that segment rather than reduced performance.
What to do, in order
Four steps. The first two are the ones that matter and both are one time work.
Confirm SPF and DKIM are actually set up and passing. Not configured. Passing. Many businesses have an SPF record written years ago that no longer lists the services currently sending on their behalf, which is worse than none, because it fails authentication rather than skipping it.
Add a DMARC record at monitoring only. This is a single DNS entry that changes nothing about how your mail is handled and starts generating reports about who is sending as your domain. It is free, it cannot break anything at this setting, and the reports are the only way to find out whether somebody is already spoofing you.
Inventory what sends on your behalf. Every tool that emails your customers using your domain. Newsletter platform, scheduler, store, invoicing, review requests, form notifications. This list is almost always longer than the owner expects and each item has to be authorized in your SPF record.
Then leave it alone. This is not an ongoing discipline. Once the records are right and your sending tools are listed, the only maintenance is updating the list when you add a tool.
The quickest check costs nothing and takes a minute: send an email from your business address to a Gmail account you control, open it, and view the original message. The header will say whether SPF and DKIM passed. If both say pass, your foundation is sound and the rest of this is reading.
Two honest caveats on the numbers above
The thresholds and dates here come from secondary sources that track provider requirements rather than from the providers directly, and the sources were not perfectly consistent. One described the Microsoft threshold as 5,000 or more and another as over 5,000. Yahoo does not publish a numeric threshold at all.
For your purposes the distinction is immaterial, since you are not within an order of magnitude of any version of the number. If you are planning a send that approaches it, verify against the provider's own documentation rather than against this post or any other.
These requirements have also tightened steadily since 2024 and there is no reason to expect that to stop. Nothing here is a permanent description of the landscape.
The summary
The urgent warnings about new email rules are mostly describing requirements that start at 5,000 messages a day, which is not you.
What applies to you is shorter: authentication on your domain, clean sending behavior, and a complaint rate under 0.3 percent.
But set up SPF, DKIM and DMARC anyway, for the two reasons that have nothing to do with any provider's policy. Your quotes and invoices are silently landing in junk folders. And an unprotected domain is something a stranger can send mail from while wearing your name.
Both of those were true before 2024 and will be true after whatever changes next.