# Gmail and Yahoo bulk sender requirements explained (and Microsoft's)

> What Gmail, Yahoo and Microsoft's Outlook.com require from senders in 2026, who counts as a bulk sender, which rules apply to everyone, and what happens when you miss. Read from each provider's own pages, with a checker for the parts DNS can show.

By MailSetupCheck. Updated 7 October 2026. Canonical URL: https://mailsetupcheck.com/gmail-yahoo-bulk-sender-requirements/

## The short version

Since February 2024, Gmail and Yahoo have required every sender to authenticate their mail, keep spam complaints low, and send properly formatted messages. Bulk senders must also publish DMARC, align their From address with SPF or DKIM, and offer one-click unsubscribe. Microsoft applied the authentication part to Outlook.com, Hotmail and Live.com in May 2025. Gmail began [ramping up enforcement in November 2025](https://support.google.com/mail/answer/14229414), with temporary and permanent rejections.

| Requirement | Gmail, everyone | Gmail, bulk | Yahoo, everyone | Yahoo, bulk | Outlook.com, over 5,000 a day |
|---|---|---|---|---|---|
| SPF or DKIM | Required | | Required | | |
| SPF and DKIM both | | Required | | Required | Both must pass |
| DMARC record | | At least p=none | | At least p=none | At least p=none |
| From domain aligned with SPF or DKIM | | Required | | Required | Required (both preferred) |
| One-click unsubscribe | | Marketing and subscribed mail | | Marketing and subscribed mail | A working unsubscribe link recommended |
| Spam rate | Under 0.3% (aim for 0.1%) | Under 0.3% (aim for 0.1%) | Under 0.3% | Under 0.3% | Not stated |
| Valid forward and reverse DNS for sending IPs | Required | Required | Required | Required | |
| TLS for sending | Required | Required | | | |

Sources: [Google's email sender guidelines](https://support.google.com/mail/answer/81126) and [FAQ](https://support.google.com/mail/answer/14229414), [Yahoo's sender requirements](https://senders.yahooinc.com/best-practices/) and [FAQ](https://senders.yahooinc.com/faqs/), and [Microsoft's announcement for high-volume senders](https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook%e2%80%99s-new-requirements-for-high%e2%80%90volume-senders/4399730). Read 7 October 2026.

## Check the DNS part now

SPF, DKIM and DMARC are DNS records, so they can be checked from outside. The checker below tests all three and the rest of your setup. Alignment, spam rate and unsubscribe headers depend on each message, so it cannot confirm those (see "Which rules you can check" below).

> **Interactive checker.** On the HTML version of this page (https://mailsetupcheck.com/gmail-yahoo-bulk-sender-requirements/), enter a domain. Your browser asks Cloudflare's public DNS-over-HTTPS resolver (Google Public DNS as a fallback) for the domain's MX, SPF, DMARC, DKIM, MTA-STS, TLS-RPT and BIMI records, and the checker returns a fix list in three tiers: must fix to send to Gmail at volume, should fix, and nice to have, with the exact record to add where it can be worked out. MailSetupCheck has no server; the domain is never sent to it.

What it checks, in short:

- **MX**: present, null MX (RFC 7505), and the mail provider recognized from the host names.
- **SPF** (RFC 7208): exactly one v=spf1 record, valid syntax, every include and redirect followed, DNS-querying terms counted against the limit of 10 and empty lookups against 2, "+all", "?all", a missing "all", and "ptr".
- **DMARC** (RFC 9989, which replaced RFC 7489 in 2026): found at _dmarc.<domain> or by the DNS tree walk, every tag parsed, p=none explained, and an authorization record checked for report addresses at another organization (RFC 9990).
- **DKIM** (RFC 6376): your selector plus 34 common ones; key type and size (RFC 8301: at least 1024 bits, 2048 recommended). Not finding a key at these names does not prove DKIM is off.
- **MTA-STS** (RFC 8461), **TLS-RPT** (RFC 8460) and **BIMI** records.

DKIM selectors tried: `google` (Google Workspace (default)), `selector1` (Microsoft 365), `selector2` (Microsoft 365), `s1` (SendGrid), `s2` (SendGrid), `m1` (SendGrid (without automated security)), `k1` (Mailchimp (older setups)), `k2` (Mailchimp), `k3` (Mailchimp), `mte1` (Mailchimp Transactional (Mandrill)), `mte2` (Mailchimp Transactional (Mandrill)), `brevo1` (Brevo), `brevo2` (Brevo), `mail` (Brevo (older setups) and others), `km1` (Klaviyo (marketing)), `km2` (Klaviyo (marketing)), `kt1` (Klaviyo (transactional)), `kt2` (Klaviyo (transactional)), `ctct1` (Constant Contact), `ctct2` (Constant Contact), `mailjet` (Mailjet), `resend` (Resend), `zoho` (Zoho Mail (the example name in Zoho's guide; admins choose their own)), `fm1` (Fastmail), `fm2` (Fastmail), `fm3` (Fastmail), `protonmail` (Proton Mail), `protonmail2` (Proton Mail), `protonmail3` (Proton Mail), `sig1` (iCloud+ custom email domains), `x` (MXroute), `default` (cPanel and other hosting control panels), `cf2024-1` (Cloudflare Email Routing (signs forwarded mail)), `dkim` (Generic name some providers and admins use).

## Who counts as a bulk sender

- **Gmail:** "any email sender that sends close to 5,000 messages or more to personal Gmail accounts within a 24-hour period." Mail from subdomains counts together: "Messages sent from the same primary domain count toward the 5,000 limit." And it is permanent: "Senders who meet the above criteria at least once are permanently considered bulk senders." ([Google FAQ](https://support.google.com/mail/answer/14229414))
- **Yahoo:** no number. "A 'bulk' sender is classified as an email sender sending a significant volume of mail. We will not specify a volume threshold." The rules cover every domain Yahoo Mail hosts, AOL included. ([Yahoo FAQ](https://senders.yahooinc.com/faqs/))
- **Microsoft:** "domains sending more than 5,000 emails per day" to Outlook.com consumer addresses (outlook.com, hotmail.com, live.com). ([Microsoft](https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook%e2%80%99s-new-requirements-for-high%e2%80%90volume-senders/4399730))

A small business that sends a few hundred messages a day is not a Gmail bulk sender today. One newsletter to a large list can make it one for good, so set up the bulk requirements before you need them. They cost nothing but a few DNS records and the right settings in your sending tools.

## What every sender needs

Gmail's list for all senders, quoted from its guidelines, with Yahoo's equivalents:

1. **"Set up SPF or DKIM email authentication for your sending domains."** Yahoo: "Implement SPF or DKIM at a minimum."
2. **"Ensure that sending domains or IPs have valid forward and reverse DNS records, also referred to as PTR records."** Your email provider handles this if you use Google Workspace, Microsoft 365 or a major sending service. If you run your own mail server, the server's IP address must have a PTR record naming a host that resolves back to the same IP.
3. **"Use a TLS connection for transmitting email."** Again, handled by mainstream providers.
4. **"Keep spam rates reported in Postmaster Tools below 0.3%."** Yahoo: "Keep your spam rate below 0.3%."
5. **"Format messages according to the Internet Message Format standard, RFC 5322."**
6. **"Don't impersonate Gmail From: headers."** Do not send as an @gmail.com address through other servers.

Gmail also requires DKIM keys of at least 1024 bits and recommends 2048: "Sending to personal Gmail accounts requires a DKIM key of 1024 bits or longer. For security reasons, we recommend using a 2048-bit key if your domain provider supports this." Yahoo also asks for a minimum of 1024 bits.

## What bulk senders need on top

- **Both SPF and DKIM.** Gmail: "Set up SPF and DKIM email authentication for your domain." Yahoo: "Implement both SPF & DKIM." Microsoft: SPF "Must Pass for the sending domain" and DKIM "Must Pass".
- **A DMARC record, and p=none is enough.** Gmail: "Your DMARC enforcement policy can be set to none." Yahoo: "Publish a valid DMARC policy with at least p=none" and a report address (rua) "is strongly recommended". Microsoft: "At least p=none". [Moving beyond p=none](/dmarc-p-none-to-reject/) is still worth doing; it is what actually stops forged mail.
- **Alignment.** Gmail: "the domain in the sender's From: header must be aligned with either the SPF domain or the DKIM domain." In practice: your sending service signs with DKIM using your domain, or sends with a bounce address on your domain. Yahoo accepts relaxed alignment, which means a subdomain of yours counts.
- **One-click unsubscribe for marketing and subscribed messages.** Gmail requires one-click unsubscribe plus "a clearly visible unsubscribe link in the message body", and says transactional messages are excluded. One-click means the two headers defined in [RFC 8058](https://www.rfc-editor.org/rfc/rfc8058): `List-Unsubscribe` with an HTTPS address and `List-Unsubscribe-Post: List-Unsubscribe=One-Click`, both covered by the DKIM signature. Gmail says a mailto: link alone does not meet its requirement; Yahoo says the POST method "is highly recommended" and "The mail-to: method is acceptable".
- **Honor unsubscribes fast.** Yahoo: "Honor unsubscribes within 2 days." Google recommends 48 hours, and lists slower handling among the failures that make a sender ineligible for delivery help.
- **Spam rate under 0.3%, and aim for 0.1%.** Gmail: "Keep spam rates reported in Postmaster Tools below 0.10% and avoid ever reaching a spam rate of 0.30% or higher." Postmaster Tools measures the share of messages delivered to the inbox that recipients then marked as spam, for DKIM-authenticated mail.

## What happens when you miss

- **Gmail.** Messages that fail authentication "might be marked as spam or rejected with a 5.7.26 error." From November 2025: "Messages that fail to meet the email sender requirements will experience disruptions, including temporary and permanent rejections." Failures on SPF, DKIM, alignment, reverse DNS or TLS bring rejection codes (for example 5.7.27 for SPF and 5.7.30 for DKIM). A spam rate above 0.3%, a missing DMARC record, or unsubscribes not honored within 48 hours make a sender ineligible for Google's delivery help and mitigations. A sender becomes eligible again after its spam rate stays under 0.3% for 7 consecutive days.
- **Microsoft.** Since 5 May 2025, non-compliant mail from high-volume senders is rejected with "550; 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level." (An earlier plan to route it to Junk was dropped.)
- **Yahoo.** The rules took effect in February 2024, and enforcement of the unsubscribe rule in June 2024. "If the unsubscribe is not honored in 2 days, then it would not meet the requirement."

## Which rules you can check from outside

| Rule | Visible in DNS? | How to check it |
|---|---|---|
| SPF published and valid | Yes | The checker above |
| DKIM key published | Mostly | The checker, with your selector if it is unusual |
| DMARC published | Yes | The checker above |
| Alignment | No | Send yourself a message at Gmail, choose "Show original", look for `dmarc=pass` |
| Reverse DNS and TLS of sending servers | No | Gmail's "Show original" view shows TLS; your provider handles both if you use a major one |
| Spam rate | No | [Google Postmaster Tools](https://postmaster.google.com/), and Yahoo's Sender Hub |
| One-click unsubscribe | No | Look for `List-Unsubscribe-Post` in a marketing message you sent |

## The order to fix things in

1. **SPF:** one record that lists every service sending as your domain. Keep it under [10 DNS lookups](/spf-too-many-dns-lookups/).
2. **DKIM:** turn it on in every sending service, with your own domain, using 2048-bit keys where offered.
3. **DMARC:** publish `v=DMARC1; p=none; rua=mailto:` plus an address you read or a report service. The checker writes the record for you.
4. **Alignment:** confirm `dmarc=pass` in a test message from each sending service.
5. **Unsubscribe:** turn on one-click unsubscribe in your newsletter or marketing tool, and make sure opt-outs are processed within two days.
6. **Watch:** register your domain in Google Postmaster Tools and keep the spam rate under 0.1%.
7. **Enforce:** once reports show all your real mail passing, [move DMARC to quarantine and then reject](/dmarc-p-none-to-reject/).

If you send cold email, the same rules apply, and US law adds its own: see [cold email that stays legal](/cold-email-can-spam/).