Gmail, Yahoo and Microsoft bulk sender requirements explained

Since 2024, the three largest consumer mailbox providers have set written rules for anyone sending them mail in volume. If your domain doesn't meet them, your messages can be junked or refused outright. This guide lists what Gmail, Yahoo and Outlook.com require, when each rule took effect, and how to check your own domain.

Who counts as a bulk sender?

Each provider defines it differently:

Three details matter.

Gmail counts your whole domain. Its FAQ gives the example of 2,500 messages from a main domain plus 2,500 from a promotions. subdomain. Together, that's 5,000, so the domain is a bulk sender.

Gmail status is permanent. Google says senders who meet the criteria at least once are permanently considered bulk senders.

These are consumer rules. Google says its requirements don't apply to Google Workspace inbound and intra-domain mail. Microsoft's announcement covers Outlook.com, its consumer service, not Microsoft 365 business mailboxes. Business-to-business mail is still filtered, just not under these published thresholds.

What does Gmail require?

Google's email sender guidelines took effect on February 1, 2024. They have two tiers.

Requirements for all senders to Gmail

1. Set up SPF or DKIM for your sending domain.
2. Give sending domains or IPs valid forward and reverse DNS (PTR) records.
3. Use a TLS connection to transmit mail.
4. Keep the spam rate reported in Postmaster Tools below 0.3%.
5. Format messages according to RFC 5322.
6. Don't impersonate Gmail From: headers. Google says it will begin using a DMARC quarantine enforcement policy, which affects anyone who does.

Extra requirements at 5,000 or more per day

1. Set up SPF and DKIM.
2. Publish DMARC for your sending domain. The policy can be p=none.
3. For direct mail, align the From: domain with either the SPF domain or the DKIM domain. Google says alignment isn't required for forwarded and mailing list messages.
4. Support one-click unsubscribe in marketing and subscribed messages, and include a clearly visible unsubscribe link in the body.
5. Keep the spam rate below 0.3%. Google recommends staying below 0.1%.

Gmail's enforcement timeline

Google recommends processing unsubscribe requests within 48 hours. It excludes transactional messages, such as password resets, from the one-click requirement.

You'll see enforcement as SMTP codes in your bounces. A message that fails Gmail's authentication checks is rejected with 550 5.7.26, and an IP that sends at a rate Gmail finds unusual gets temporary 421 4.7.28 deferrals. Each page explains the cause and the fix.

What does Yahoo require?

Yahoo's sender requirements also took effect in February 2024, with gradual rollout afterwards.

All senders must:

• Implement SPF or DKIM, at a minimum.
• Keep the spam rate below 0.3%.
• Have valid forward and reverse DNS for sending IPs.
• Comply with RFC 5321 and RFC 5322.

Bulk senders must also:

• Implement both SPF and DKIM.
• Publish a valid DMARC policy of at least p=none, and DMARC must pass.
• Align the From: domain with either the SPF or DKIM domain.
• Implement a working List-Unsubscribe header for one-click unsubscribe, and honor unsubscribes within 2 days.

Yahoo's FAQ adds that it won't specify a volume threshold. It also says a body link alone isn't enough: you need the List-Unsubscribe header, preferably following RFC 8058. Enforcement of the unsubscribe policy began in June 2024, and it applies only to promotional and marketing mail.

What does Microsoft require for Outlook.com?

Microsoft announced its requirements on April 2, 2025. They apply to domains sending more than 5,000 emails per day to Outlook.com consumer addresses.

Required:

• SPF must pass for the sending domain.
• DKIM must pass.
• DMARC must be at least p=none and align with SPF or DKIM, preferably both.

Note the difference: Gmail and Yahoo ask you to set up SPF and DKIM, while Microsoft's support article says both checks must pass.

Recommended: a valid From or Reply-To address that can receive replies, a functional unsubscribe link, regular list cleaning and bounce handling, and transparent practices such as accurate subjects and recipient consent. Microsoft's FAQ also recommends ARC for forwarding and mailing lists, and says a recipient's Safe Senders list won't bypass the enforcement.

What happens to non-compliant Outlook.com mail?

The original announcement said non-compliant mail would go to Junk first. On April 29, 2025, Microsoft changed that: from May 5, 2025, messages that fail the requirements are rejected with:

550; 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level.

If you see that bounce, the fix is in your DNS and your sending platform, not at the recipient's end. Our 550 5.7.515 reference lists the causes and fixes.

Side-by-side: Gmail vs Yahoo vs Outlook.com

How does one-click unsubscribe work?

One-click unsubscribe is defined in RFC 8058. Your message carries two headers:

List-Unsubscribe: <https://example.com/unsub/abc123>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

When a recipient clicks the provider's own Unsubscribe button, the mailbox provider sends an HTTPS POST to that URL. The request carries no cookies or login, so the URL itself must identify the recipient and the list, and the unsubscribe must complete automatically. Your server must not answer with a redirect, and the message needs a valid DKIM signature that covers both headers. Most email marketing platforms add both headers for you; check that they're switched on for your account. Our one-click unsubscribe guide covers implementation and testing.

How to check your domain meets the requirements

The free Bulk Sender Requirements Checker runs the DNS part of this list in one scan and shows a checklist for Gmail, Yahoo and Outlook.com. The steps below cover the rest.

1. Find every sender. List each service that sends with your domain in From: your mailboxes, marketing platform, CRM, helpdesk, billing system.
2. Check SPF. Run the SPF Checker. One record, 10 or fewer DNS lookups, every sending service included. If you're over the limit, see how to fix too many SPF lookups.
3. Check DKIM. Each service should sign with your domain, not its own. The DKIM setup guide for Microsoft 365 and Google Workspace covers the two big platforms. Verify each selector with a DKIM checker.
4. Publish DMARC. At minimum v=DMARC1; p=none; rua=mailto:.... See DMARC record examples for each stage.
5. Test alignment. Send a message from each service to a personal Gmail or Outlook.com address and open the headers in the Email Header Analyzer. You want dmarc=pass, plus spf=pass and dkim=pass for Outlook.com. For a quick inbox check, send one message to our free Email Deliverability Test; it reports SPF, DKIM and DMARC results, reverse DNS and blocklist status for that message.
6. Turn on one-click unsubscribe in every marketing tool, and confirm the visible body link works.
7. Watch your spam rate. Register your domain in Google Postmaster Tools and keep the user-reported rate under 0.1%. See spam complaint rates explained for how to measure and lower it.
8. Keep monitoring. Records drift when someone adds a tool or a vendor changes its setup.

Why does mail still fail when the records look right?

Publishing the records is half the job. Common gaps:

• The tool signs with its own domain. Many platforms DKIM-sign as themselves until you add your domain's keys. DKIM passes, but it doesn't align with your From address.
• The envelope sender belongs to the vendor. SPF passes for the vendor's bounce domain, not yours. That's fine if DKIM aligns; it's a failure if DKIM doesn't.
• SPF is over the 10-lookup limit. Receivers return PermError, so SPF stops counting at all.
• Outlook.com wants both. A message with aligned DKIM but failing SPF passes DMARC, yet still misses Microsoft's rule that SPF and DKIM must both pass.

What these rules mean if you don't send in bulk

Most small businesses send far fewer than 5,000 messages a day. You still benefit from meeting the bulk requirements:

• The all-sender rules at Gmail and Yahoo already apply to you.
• Business mail systems use the same signals. A domain with aligned SPF, DKIM and DMARC is easier for any receiver to trust.
• If you send newsletters through a platform, that platform's volume may be counted against your domain when it uses your From address.

In our scan of the Tranco top 1,000 domains in October 2026, 26.5% published no DMARC record at all. Meeting the p=none minimum puts you ahead of many much larger organizations.

Next steps

1. Run the free Email Health Check to see SPF, DKIM and DMARC for your domain in one place.
2. Fix any sender that doesn't sign with DKIM as your domain. If you send from your own servers, confirm their reverse DNS with the PTR Lookup and their IPs with the Blacklist Checker.
3. Publish DMARC with reporting, then work toward enforcement.
4. If you send transactional mail from your own systems, iBlockSpam's outbound relay DKIM-signs it (500 messages per month included). It's built for business mail, not bulk campaigns, so keep marketing on a dedicated platform.

Browse our other SPF, DKIM and DMARC guides.