Gmail, Yahoo and Outlook sender requirements

Who these rules apply to

All three mailbox providers split senders into two groups: everyone, and senders who push a lot of mail at their users. The second group gets the full list, but the line between the groups is drawn differently by each provider, and that difference matters more than most summaries admit.

• Google calls you a bulk sender once you send close to 5,000 messages or more to personal Gmail accounts within 24 hours. Every message from the same primary domain counts toward that number, so 2,500 from example.com and 2,500 from news.example.com add up to 5,000. Crossing the line once is enough: Google says the status has no expiration date and later changes in volume do not remove it.
• Yahoo defines a bulk sender as one sending "a significant volume of mail" and states that it will not publish a threshold. It looks at senders at the level of the authenticated domain or the From domain, and spoofed mail using your domain counts toward what it looks at. The rules cover every brand Yahoo Mail hosts, AOL included.
• Microsoft applies its rules to domains sending more than 5,000 messages a day to Outlook.com, its consumer service behind outlook.com, hotmail.com and live.com addresses. Its error guide counts messages that use the same domain in the visible From address.

Two details are easy to miss. Google's rules apply only to mail sent to personal Gmail accounts; its FAQ states they do not apply to mail sent to Google Workspace accounts. And none of the providers treats small senders as exempt from everything: Google and Yahoo each publish a shorter list for all senders, and Microsoft notes that all senders benefit from the same practices even though enforcement targets large ones.

Google (Gmail)

Google's requirements took effect on February 1, 2024. Every sender to Gmail must set up SPF or DKIM for its sending domains, have valid forward and reverse DNS (PTR) records for its sending IPs, use a TLS connection, keep the spam rate reported in Postmaster Tools below 0.3%, format messages according to RFC 5322 and not impersonate Gmail in the From header.

Bulk senders must meet all of that, and additionally:

• set up both SPF and DKIM;
• publish a DMARC record for the sending domain, where Google states the policy "can be set to none";
• align the From domain with either the SPF domain or the DKIM domain. The FAQ is explicit that both must be set up but only one of them needs to align;
• support one-click unsubscribe in marketing and subscribed messages and show a clearly visible unsubscribe link in the body. Senders who already had an unsubscribe link were given until June 1, 2024 to add one-click.

One-click means two headers: List-Unsubscribe with an HTTPS address and List-Unsubscribe-Post: List-Unsubscribe=One-Click. When the recipient clicks unsubscribe, Gmail sends a POST request to that address. The mechanism is defined in RFC 8058, which also requires a valid DKIM signature covering both headers and forbids answering the POST with a redirect. Transactional mail such as password resets and order confirmations is excluded. Google asks senders to process unsubscribe requests within 48 hours.

On spam rate, the general guidance is stricter than the requirement: keep it below 0.1% and never reach 0.3%. Since June 2024, bulk senders above 0.3% are not eligible for mitigation requests, and they become eligible again once the rate stays below 0.3% for seven consecutive days. Google also requires a DKIM key of at least 1024 bits for mail to personal Gmail accounts and recommends 2048.

The consequences are stated in Google's FAQ: temporary or permanent failure codes, or the spam folder. In November 2025 Google said it was ramping up enforcement, with non-compliant messages facing temporary and permanent rejections.

If you send through an email service, one-click support often comes from the service itself. Check that its headers are present on your marketing mail and that its DKIM signature uses your domain, because RFC 8058 relies on DKIM to prove the headers were not added along the way. Our DKIM checker shows whether the key behind that signature is published and long enough.

Yahoo (and AOL)

Yahoo's list mirrors Google's closely, and the wording is often nearly identical. For all senders, Yahoo asks for SPF or DKIM at a minimum, a spam rate below 0.3%, valid forward and reverse DNS for sending IPs, and compliance with RFC 5321 and RFC 5322.

Bulk senders must also:

• implement both SPF and DKIM;
• publish a valid DMARC policy of at least p=none. Yahoo adds "DMARC must pass", which in practice means the From domain has to align with the SPF domain or the DKIM domain;
• send a working List-Unsubscribe header that supports one-click unsubscribe for marketing and subscribed messages, with the RFC 8058 POST method "highly recommended", plus a clearly visible link in the body;
• honor unsubscribes within 2 days.

Yahoo's FAQ answers a question many senders ask: a link in the body alone does not meet the one-click requirement, the header is required. Like Google, Yahoo excludes transactional messages from the one-click rule. Enforcement began in February 2024 and was rolled out gradually, with unsubscribe enforcement starting in June 2024. Mail that does not meet the requirements may go to spam or be rejected, and Yahoo says a rejection comes with a specific error code. Complaint rates are visible through Yahoo's Complaint Feedback Loop, for which you enroll the domains in your DKIM signatures (the d= value).

Microsoft (Outlook.com)

Microsoft announced its requirements on April 2, 2025, with enforcement starting in May. The post states that they apply to Outlook.com, Microsoft's consumer mail service. For domains above 5,000 messages a day, SPF must pass for the sending domain, DKIM must pass, and the domain must publish DMARC with at least p=none that aligns with SPF or DKIM, "preferably both".

The original post said non-compliant mail would first go to Junk and might later be rejected. An update dated April 29, 2025 changed that: Microsoft decided to reject failing messages outright, starting May 5, 2025, with the error 550 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level. Microsoft gave the reason itself: to remove confusion about why a message ended up in Junk. Its support article for that error lists the same three conditions: SPF and DKIM both pass, a DMARC record exists, and at least one of SPF or DKIM aligns with the From domain.

Beyond authentication, Microsoft lists hygiene recommendations rather than hard rules: a From or Reply-To address that is valid and can receive replies, a functional and clearly visible unsubscribe link, regular list cleaning and bounce handling, and transparent practices such as accurate subjects and consent. It does not publish a spam rate threshold or a one-click header requirement. Two more points from its FAQ: adding a sender to the Safe Senders list does not bypass the enforcement, and Microsoft recommends ARC for forwarding and mailing lists, because forwarding can break DMARC alignment.

Side by side

The table compares the strictest tier of each provider: bulk senders at Google and Yahoo, high-volume senders at Microsoft. A dash means the provider does not state a requirement for that row, not that anything goes.

What it means in practice

Read the three lists together and a common floor appears: SPF and DKIM both set up, a DMARC record, and mail that passes DMARC because at least one of them is aligned with the domain in the From address. If you send marketing mail to Gmail or Yahoo users at volume, add one-click unsubscribe and a spam rate that stays well under 0.3%.

A DMARC record with p=none meets the minimum at all three providers, and that is where most domains stop. It is worth being clear about what it does: p=none asks receivers to change nothing about failing mail. It satisfies the rule and turns on reporting, but it does not stop anyone from sending mail that shows your domain. Protection only starts at p=quarantine or p=reject. The current DMARC standard, RFC 9989 from May 2026, also drops the old pct tag and adds t=y, a testing flag that asks receivers to apply one level less than the published policy while you watch the results. Moving from p=none to p=reject lays out that rollout stage by stage.

A common failure is not a missing record but missing alignment. An email service sends with its own domain in the envelope (the Return-Path) and signs with its own DKIM domain. SPF passes and DKIM passes, but both for the service's domain, not yours, so DMARC fails. The fix is in the service's settings: a custom return path on your domain, a DKIM key published under your domain, or both. The setup guides linked below show where each service keeps those settings.

The other trap is forwarding. A message forwarded by a mailing list or an alias often loses SPF, because the forwarding server is not in your record, and DKIM survives only if nothing in the signed parts was changed. That is why every provider asks for DKIM rather than relying on SPF alone. Your DMARC reports are where both problems show up first; our guide on how to read DMARC aggregate reports walks through what each line means.

Check your domain

The free domain health check reads your SPF, DKIM, DMARC and MX records in one pass and tells you which of the authentication requirements above your domain already meets. To dig into one record, use the SPF checker, which follows every include and counts DNS lookups, the DKIM checker for key presence and length, or the DMARC checker for your policy and report addresses. None of them can measure your spam rate or test your unsubscribe headers; Google Postmaster Tools and Yahoo's Complaint Feedback Loop are the places for those.