Gmail, Yahoo and Outlook Sender Requirements in 2026: The Rules

Gmail and Yahoo started enforcing new rules for bulk senders in February 2024. Microsoft followed for Outlook.com in May 2025. The three sets of rules overlap heavily: authenticate your mail with SPF, DKIM and DMARC, make unsubscribing easy, and keep complaints low.

This page sets out what each provider says, with the thresholds and dates, then gives a single checklist that covers all three. To see where your own domain stands, run it through our free email deliverability checker.

The short version

Gmail sender requirements

Google’s email sender guidelines split the rules into two tiers.

Every sender to personal Gmail accounts must:

• Set up SPF or DKIM for the sending domain.
• Have valid forward and reverse DNS (PTR) records for sending IPs.
• Use TLS when transmitting email.
• Keep the spam rate reported in Postmaster Tools below 0.3%.
• Format messages to the RFC 5322 standard, and not impersonate Gmail From: headers.

Bulk senders also must:

• Set up both SPF and DKIM.
• Publish a DMARC record. Google says the policy can be set to none.
• Align the From: domain with either the SPF domain or the DKIM domain.
• Support one-click unsubscribe on marketing and subscribed messages, using the List-Unsubscribe-Post: List-Unsubscribe=One-Click header (RFC 8058), and include a clearly visible unsubscribe link in the body.

The details from Google’s sender guidelines FAQ:

• Threshold: a bulk sender sends “close to 5,000 messages or more” to personal Gmail accounts in 24 hours. Once you reach it, the status is permanent, even if your volume drops.
• Spam rate: keep it below 0.1% and never let it reach 0.3%. Above 0.3%, Google says senders become ineligible for mitigation, meaning Google won’t take up an escalation about their delivery problems.
• Unsubscribes: process them within 48 hours.
• Transactional mail: password resets, order confirmations and similar messages don’t need one-click unsubscribe.
• Timeline: the rules began in February 2024. Enforcement of spam-rate limits and one-click unsubscribe tightened from June 2024. From November 2025, Google says it’s ramping up enforcement: non-compliant messages face temporary and permanent rejections.

Google announced the rules in an October 2023 Gmail blog post.

Yahoo sender requirements

Yahoo’s sender best practices also use two tiers.

All senders must:

• Implement SPF or DKIM.
• Keep the spam complaint rate below 0.3%.
• Have valid forward and reverse DNS records for sending IPs.
• Follow RFC 5321 and RFC 5322.

Bulk senders also must:

• Implement both SPF and DKIM. Yahoo sets a minimum DKIM key length of 1024 bits.
• Publish a DMARC policy of at least p=none, and DMARC must pass.
• Align the From: domain with the SPF or DKIM domain.
• Support one-click unsubscribe with a List-Unsubscribe header (RFC 8058), keep a visible unsubscribe link in the message body, and honor unsubscribes within 2 days.

Yahoo’s sender FAQ says it won’t publish a volume threshold for “bulk”. If you send marketing email at any real volume, plan to meet the bulk rules. The FAQ also says one-click unsubscribe enforcement began in June 2024 and doesn’t apply to transactional messages.

Microsoft Outlook sender requirements

Microsoft announced its rules for Outlook.com consumer mailboxes (Outlook.com, Hotmail, Live and MSN addresses) in an April 2025 post.

Domains sending over 5,000 emails a day must:

• Pass SPF for the sending domain, with DNS listing the authorized IPs and hosts.
• Pass DKIM.
• Publish DMARC of at least p=none, aligned with SPF or DKIM (Microsoft prefers both).

What happens if you don’t: Microsoft first said non-compliant mail would go to Junk. It updated the post in late April 2025: from 5 May 2025, failing messages are rejected with “550; 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level.” Microsoft’s help page for that error says the threshold counts messages that share the same From: domain.

Microsoft also recommends:

• A From or Reply-To address that’s valid, matches your sending domain and can receive replies.
• A clearly visible unsubscribe link.
• Regular removal of invalid addresses.
• Accurate subject lines and consented recipients.

How to comply with all three

Meeting the strictest version of each rule covers all three providers.

1. List everything that sends as your domain: your email platform, CRM, help desk, billing system, Google Workspace or Microsoft 365. Each one needs to authenticate.
2. Publish one SPF record that includes every sending service and ends in ~all or -all. Keep it under the limit of 10 DNS lookups.
3. Turn on DKIM signing with your own domain in every sending service, with keys of 1024 bits or more (2048 where offered).
4. Publish DMARC. Start with v=DMARC1; p=none; rua=mailto:[email protected] so you receive aggregate reports. Then check that your real mail passes with alignment. The d= domain in DKIM, or the return-path domain for SPF, has to match your From: domain.
5. Add one-click unsubscribe headers to marketing mail. Most email platforms do this automatically. Check by opening a sent message’s headers and looking for both List-Unsubscribe and List-Unsubscribe-Post. Make sure unsubscribes are processed within 48 hours.
6. Check PTR and TLS if you send from your own servers. Hosted platforms handle both for you.
7. Watch your spam rate in Google Postmaster Tools, which is free once you verify your domain. Aim for under 0.1%.
8. Clean your list. Remove hard bounces and long-inactive subscribers, and only mail people who opted in. This is the most reliable way to keep complaints down.
9. Move DMARC toward enforcement once reports show your legitimate mail passing: quarantine, then reject. This isn’t required, but it stops spoofing of your domain and is needed for BIMI logos.

For a fuller walkthrough, including reputation and inbox placement checks, see our email deliverability audit checklist. For tools to monitor all of this, see the best email deliverability tools.

Common mistakes

• Two SPF records. A domain can only have one. With two, SPF fails for everything.
• Passing SPF that doesn’t align. Many platforms send with their own return-path domain. SPF passes, but not for your domain, so DMARC relies on DKIM. If DKIM is signed with the platform’s domain instead of yours, DMARC fails.
• Forgetting other senders. Invoices from your billing system or replies from your help desk can fail DMARC once you tighten the policy.
• Treating p=none as finished. It meets the minimum but doesn’t protect your domain.
• Ignoring Yahoo because there’s no threshold. Yahoo’s bulk rules can apply at lower volumes than Gmail’s or Microsoft’s.