Email Sender Requirements: Gmail, Yahoo and Outlook

Gmail, Yahoo and Outlook.com all require bulk senders to pass SPF and DKIM, publish DMARC at p=none or stricter, and align the From domain with SPF or DKIM. Gmail and Outlook.com draw the line at 5,000 messages a day. Gmail and Yahoo add one-click unsubscribe (RFC 8058) and a spam rate under 0.3%.

Gmail and Yahoo began enforcing in February 2024. Microsoft announced its rules for Outlook.com on 2 April 2025, with enforcement from 5 May 2025. Everything below comes from the providers' own pages, which we read on 19 October 2026. Where a page is silent on something, the table says so rather than guessing.

Side-by-side comparison

Gmail

Google's rules are on two pages: the Email sender guidelines and the Email sender guidelines FAQ. They apply to mail sent to personal accounts ending in @gmail.com or @googlemail.com. The FAQ says they do not apply to mail sent to Google Workspace accounts.

Requirements for every sender

From 1 February 2024, anyone sending to Gmail accounts must:

• Set up SPF or DKIM for the sending domain.
• Have valid forward and reverse DNS (PTR) records for sending domains or IPs.
• Use a TLS connection for transmitting email.
• Keep the spam rate reported in Postmaster Tools below 0.3%.
• Format messages to RFC 5322.
• Not impersonate Gmail From headers.

Extra requirements at 5,000 messages a day

Senders over the line must also set up both SPF and DKIM, publish DMARC ("Your DMARC enforcement policy can be set to none"), align the From domain with either the SPF or the DKIM domain, and support one-click unsubscribe with a clearly visible unsubscribe link in the body for marketing and subscribed messages.

The FAQ's definition is strict on two points. A bulk sender is "any email sender that sends close to 5,000 messages or more to personal Gmail accounts within a 24-hour period", and all mail from the same primary domain counts together. Its example: 2,500 messages from solarmora.com plus 2,500 from promotions.solarmora.com makes 5,000. And the status never expires: "Senders who meet the above criteria at least once are permanently considered bulk senders."

What changed in 2025

The FAQ now opens with this line: "Starting November 2025, Gmail is ramping up its enforcement on non-compliant traffic. Messages that fail to meet the email sender requirements will experience disruptions, including temporary and permanent rejections."

The FAQ lists the error codes. A few you will see in bounce logs:

Spam rate and mitigation

Google asks for a user-reported spam rate below 0.1% and never 0.3% or higher. Since June 2024, bulk senders above 0.3% are not eligible for delivery mitigation. Eligibility returns after the rate stays below 0.3% for 7 consecutive days.

Yahoo

Yahoo publishes its rules on the Sender Hub best practices page and in its FAQ. They cover "all domains and consumer email brands hosted by Yahoo Mail", which includes AOL.

All senders must authenticate with SPF or DKIM at a minimum, keep the spam rate below 0.3%, have valid forward and reverse DNS for sending IPs, and comply with RFC 5321 and RFC 5322.

Bulk senders must also:

• Implement both SPF and DKIM.
• Publish "a valid DMARC policy with at least p=none", and "DMARC must pass". A rua= reporting address is "strongly recommended", and "Relaxed alignment is acceptable".
• Align the From domain with either the SPF domain or the DKIM domain.
• Provide a working List-Unsubscribe header with one-click support for marketing and subscribed messages, plus a visible unsubscribe link in the body.
• Honor unsubscribes within 2 days.

Yahoo differs from Google in three places. It sets no volume threshold; the FAQ says "We will not specify a volume threshold." It accepts a mailto: unsubscribe, though it calls the RFC 8058 POST method "highly recommended". And it measures spam rate against "mail delivered to the inbox", so your own calculation from complaint feedback loop data may come out different.

Outlook.com (Microsoft)

Microsoft announced its rules on 2 April 2025 in a Microsoft Defender for Office 365 blog post. They apply to Outlook.com, which the post says covers "hotmail.com live.com and outlook.com consumer domain addresses". Microsoft 365 business mailboxes are not named.

For domains sending over 5,000 emails per day:

• SPF: must pass for the sending domain.
• DKIM: must pass.
• DMARC: "At least p=none and align with either SPF or DKIM (preferably both)."

The post also recommends, without making them requirements: a valid From or Reply-To address that can receive replies, functional unsubscribe links, list hygiene and bounce management, and transparent mailing practices.

Enforcement

The original post said non-compliant mail would go to Junk from 5 May 2025. An update dated 29 April changed that to rejection, with this response: 550; 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level. The post's FAQ adds that a recipient's Safe Senders list "won't be honored" for this check, and that Outlook.com sends DMARC aggregate (rua) reports but has no plans to send forensic (ruf) reports.

One-click unsubscribe, done to RFC 8058

Gmail requires it, Yahoo requires a List-Unsubscribe header and prefers this form. RFC 8058 needs two headers:

List-Unsubscribe: <https://example.com/unsubscribe/abc123>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

The RFC's rules: the List-Unsubscribe header "MUST contain one HTTPS URI" (it may also carry a mailto:), the Post header must contain exactly List-Unsubscribe=One-Click, and the message "MUST have a valid DomainKeys Identified Mail (DKIM) signature" covering both headers. When a user clicks unsubscribe, the mailbox provider sends an HTTPS POST to your URL with that key and value as the body. The request carries no cookies or login, so the URL itself must identify the recipient and the list, ideally with a hard-to-forge token. Your endpoint must not answer with a redirect.

Google's FAQ is clear that a link to a preferences page does not count on its own. You can keep one in the body, but the headers must be there too. One-click is only required for marketing and promotional mail; both Google and Yahoo exclude transactional messages such as password resets.

How to check your domain against these rules

1. SPF and DKIM. Run the SPF checker and the DKIM checker for every sending domain and selector. Make sure SPF stays under its 10-lookup limit; Microsoft's FAQ warns that going over it can make your SPF check fail. Background: SPF record syntax and DKIM explained.
2. DMARC. Check the record with the DMARC checker, or create one with the generator. Include a rua= address so you get reports.
3. Alignment. Send a test to a Gmail account and open "Show original". The header.from domain must match the domain that passed SPF (smtp.mailfrom) or DKIM (header.i), at least at the organizational level.
4. PTR. Run dig -x <your sending IP> +short, then look up the hostname it returns and confirm it resolves back to the same IP. Google's own sending IP 209.85.220.41 returned mail-sor-f41.google.com. on 19 October 2026.
5. Unsubscribe. Inspect the raw headers of one marketing message for both List-Unsubscribe lines.
6. Spam rate. Register in Google Postmaster Tools and Yahoo's complaint feedback loop.

How common is the DMARC gap? In our scan of the Tranco top 1,000 domains on 19 October 2026, 79 of the 688 domains with an MX record had no DMARC record at all. Any of them sending 5,000 messages a day to Gmail or Outlook.com would fail the minimum.

p=none meets all three providers' rules but does not protect you from spoofing. Once your reports show every legitimate source aligned, move to quarantine and then reject; the complete DMARC guide and the spoofing guide explain why. If you send through an email platform, the setup pages under integrations cover each provider's SPF and DKIM records, for example SendGrid and Mailchimp.

Next step

Pull last week's bounce log and search it for 5.7.515 and the Gmail codes in the table above (4.7.23 to 4.7.32, 5.7.25 to 5.7.30). Each hit names the rule a provider thinks you broke and the domain that broke it. Fix the domain with the most hits first.

Frequently asked questions

Sources

• Google: Email sender guidelines
• Google: Email sender guidelines FAQ
• Yahoo Sender Hub: Sender Requirements and Recommendations
• Yahoo Sender Hub: FAQs
• Microsoft Defender for Office 365 Blog: Strengthening Email Ecosystem: Outlook's New Requirements for High-Volume Senders (2 April 2025)
• RFC 8058: Signaling One-Click Functionality for List Email Headers
• RFC 7489: DMARC