Gmail and Yahoo bulk sender requirements explained (and Microsoft's)

The short version

Since February 2024, Gmail and Yahoo have required every sender to authenticate their mail, keep spam complaints low, and send properly formatted messages. Bulk senders must also publish DMARC, align their From address with SPF or DKIM, and offer one-click unsubscribe. Microsoft applied the authentication part to Outlook.com, Hotmail and Live.com in May 2025. Gmail began ramping up enforcement in November 2025, with temporary and permanent rejections.

Sources: Google's email sender guidelines and FAQ, Yahoo's sender requirements and FAQ, and Microsoft's announcement for high-volume senders. Read 7 October 2026.

Check the DNS part now

SPF, DKIM and DMARC are DNS records, so they can be checked from outside. The checker below tests all three and the rest of your setup. Alignment, spam rate and unsubscribe headers depend on each message, so it cannot confirm those (see "Which rules you can check" below).

Who counts as a bulk sender

• Gmail: "any email sender that sends close to 5,000 messages or more to personal Gmail accounts within a 24-hour period." Mail from subdomains counts together: "Messages sent from the same primary domain count toward the 5,000 limit." And it is permanent: "Senders who meet the above criteria at least once are permanently considered bulk senders." (Google FAQ)
• Yahoo: no number. "A 'bulk' sender is classified as an email sender sending a significant volume of mail. We will not specify a volume threshold." The rules cover every domain Yahoo Mail hosts, AOL included. (Yahoo FAQ)
• Microsoft: "domains sending more than 5,000 emails per day" to Outlook.com consumer addresses (outlook.com, hotmail.com, live.com). (Microsoft)

A small business that sends a few hundred messages a day is not a Gmail bulk sender today. One newsletter to a large list can make it one for good, so set up the bulk requirements before you need them. They cost nothing but a few DNS records and the right settings in your sending tools.

What every sender needs

Gmail's list for all senders, quoted from its guidelines, with Yahoo's equivalents:

1. "Set up SPF or DKIM email authentication for your sending domains." Yahoo: "Implement SPF or DKIM at a minimum."
2. "Ensure that sending domains or IPs have valid forward and reverse DNS records, also referred to as PTR records." Your email provider handles this if you use Google Workspace, Microsoft 365 or a major sending service. If you run your own mail server, the server's IP address must have a PTR record naming a host that resolves back to the same IP.
3. "Use a TLS connection for transmitting email." Again, handled by mainstream providers.
4. "Keep spam rates reported in Postmaster Tools below 0.3%." Yahoo: "Keep your spam rate below 0.3%."
5. "Format messages according to the Internet Message Format standard, RFC 5322."
6. "Don't impersonate Gmail From: headers." Do not send as an @gmail.com address through other servers.

Gmail also requires DKIM keys of at least 1024 bits and recommends 2048: "Sending to personal Gmail accounts requires a DKIM key of 1024 bits or longer. For security reasons, we recommend using a 2048-bit key if your domain provider supports this." Yahoo also asks for a minimum of 1024 bits.

What bulk senders need on top

• Both SPF and DKIM. Gmail: "Set up SPF and DKIM email authentication for your domain." Yahoo: "Implement both SPF & DKIM." Microsoft: SPF "Must Pass for the sending domain" and DKIM "Must Pass".
• A DMARC record, and p=none is enough. Gmail: "Your DMARC enforcement policy can be set to none." Yahoo: "Publish a valid DMARC policy with at least p=none" and a report address (rua) "is strongly recommended". Microsoft: "At least p=none". Moving beyond p=none is still worth doing; it is what actually stops forged mail.
• Alignment. Gmail: "the domain in the sender's From: header must be aligned with either the SPF domain or the DKIM domain." In practice: your sending service signs with DKIM using your domain, or sends with a bounce address on your domain. Yahoo accepts relaxed alignment, which means a subdomain of yours counts.
• One-click unsubscribe for marketing and subscribed messages. Gmail requires one-click unsubscribe plus "a clearly visible unsubscribe link in the message body", and says transactional messages are excluded. One-click means the two headers defined in RFC 8058: List-Unsubscribe with an HTTPS address and List-Unsubscribe-Post: List-Unsubscribe=One-Click, both covered by the DKIM signature. Gmail says a mailto: link alone does not meet its requirement; Yahoo says the POST method "is highly recommended" and "The mail-to: method is acceptable".
• Honor unsubscribes fast. Yahoo: "Honor unsubscribes within 2 days." Google recommends 48 hours, and lists slower handling among the failures that make a sender ineligible for delivery help.
• Spam rate under 0.3%, and aim for 0.1%. Gmail: "Keep spam rates reported in Postmaster Tools below 0.10% and avoid ever reaching a spam rate of 0.30% or higher." Postmaster Tools measures the share of messages delivered to the inbox that recipients then marked as spam, for DKIM-authenticated mail.

What happens when you miss

• Gmail. Messages that fail authentication "might be marked as spam or rejected with a 5.7.26 error." From November 2025: "Messages that fail to meet the email sender requirements will experience disruptions, including temporary and permanent rejections." Failures on SPF, DKIM, alignment, reverse DNS or TLS bring rejection codes (for example 5.7.27 for SPF and 5.7.30 for DKIM). A spam rate above 0.3%, a missing DMARC record, or unsubscribes not honored within 48 hours make a sender ineligible for Google's delivery help and mitigations. A sender becomes eligible again after its spam rate stays under 0.3% for 7 consecutive days.
• Microsoft. Since 5 May 2025, non-compliant mail from high-volume senders is rejected with "550; 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level." (An earlier plan to route it to Junk was dropped.)
• Yahoo. The rules took effect in February 2024, and enforcement of the unsubscribe rule in June 2024. "If the unsubscribe is not honored in 2 days, then it would not meet the requirement."

Which rules you can check from outside

The order to fix things in

1. SPF: one record that lists every service sending as your domain. Keep it under 10 DNS lookups.
2. DKIM: turn it on in every sending service, with your own domain, using 2048-bit keys where offered.
3. DMARC: publish v=DMARC1; p=none; rua=mailto: plus an address you read or a report service. The checker writes the record for you.
4. Alignment: confirm dmarc=pass in a test message from each sending service.
5. Unsubscribe: turn on one-click unsubscribe in your newsletter or marketing tool, and make sure opt-outs are processed within two days.
6. Watch: register your domain in Google Postmaster Tools and keep the spam rate under 0.1%.
7. Enforce: once reports show all your real mail passing, move DMARC to quarantine and then reject.

If you send cold email, the same rules apply, and US law adds its own: see cold email that stays legal.

Also available as Markdown.