Gmail, Yahoo and Outlook.com sender requirements: the 2026 checklist

Marketing and lifecycle email sent to Gmail, Yahoo or Outlook.com addresses has to meet each provider’s sender requirements. Since late 2025, missing them increasingly gets the message rejected outright, where it used to land in spam. The three sets of rules overlap a lot but are not identical. Below is what each provider requires as of October 2026, checked against their own documentation, plus a checklist to work through with whoever manages your DNS and email platform.

What changed and when

The requirements arrived in stages.

On 1 February 2024, Google’s requirements for all senders and for bulk senders took effect, according to its email sender guidelines. Yahoo’s best practices page says its enforcement also began that February and was rolled out gradually through the first half of 2024.

One-click unsubscribe was enforced from June 2024. Google’s sender guidelines FAQ gave senders who already had an unsubscribe link until 1 June 2024 to add one-click unsubscribe to commercial and promotional mail, and Yahoo’s FAQ says its enforcement began the same month. Google also says that from June 2024, bulk senders with a spam rate above 0.3% are not eligible for mitigation support.

Microsoft started enforcing authentication for high-volume senders to Outlook.com, Hotmail.com and Live.com on 5 May 2025. Its announcement, updated on 29 April 2025, says non-compliant messages are rejected with the error “550; 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level.” An earlier version of that post had said such mail would go to junk first.

Then, in November 2025, Google’s FAQ added: “Starting November 2025, Gmail is ramping up its enforcement on non-compliant traffic.” Messages that fail the requirements may now face temporary or permanent rejection.

So the rules have barely moved since 2024. Enforcement is what got stricter.

Who counts as a bulk sender

Each provider draws the line in its own place.

Gmail defines a bulk sender as “any email sender that sends close to 5,000 messages or more to personal Gmail accounts within a 24-hour period”, counting every message from the same primary domain. Hit that once and, per Google’s FAQ, you are treated as a bulk sender permanently. Some requirements apply to every sender regardless of volume.

Yahoo’s FAQ describes a bulk sender as one “sending a significant volume of mail. We will not specify a volume threshold.” If you send marketing email at any meaningful scale, act as if the bulk rules apply.

Microsoft’s requirements cover domains “sending more than 5,000 emails per day” to its consumer service, the one behind hotmail.com, live.com and outlook.com addresses. The announcement is explicitly about that consumer service.

A list of a few thousand people getting newsletters, product updates or lifecycle campaigns is enough. Assume the bulk rules apply to you.

Authenticating your domain

SPF and DKIM

Bulk senders need both SPF and DKIM at all three providers. Google and Yahoo require at least one of the two from everyone else.

SPF lists the servers allowed to send for your domain. Every platform that sends mail as you (newsletter tool, CRM, help desk, billing system) has to be in it.

DKIM signs each message with a key published in your DNS. Google’s guidelines say sending to personal Gmail accounts “requires a DKIM key of 1024 bits or longer” and recommend 2048 bits if your provider supports it.

Set up DKIM on your own domain inside each sending platform. Plenty of tools sign with their own domain by default. That passes DKIM and fails alignment.

DMARC and alignment

All three require bulk senders to publish a DMARC record, and all three accept a policy of p=none. Yahoo’s wording is “Publish a valid DMARC policy with at least p=none”.

DMARC also checks alignment. The domain in the visible From header has to match either the domain that passed SPF or the domain that signed with DKIM. Google’s guidelines say the From domain “must align with the SPF domain or the DKIM domain”. Yahoo accepts relaxed alignment, so a subdomain such as mail.example.com aligns with example.com. Microsoft asks for alignment with SPF or DKIM, “preferably both”.

Yahoo strongly recommends a rua tag so that aggregate reports reach you. Add one. The reports list every service sending as your domain, including the ones nobody remembers signing up for.

Unsubscribes and spam complaints

One-click unsubscribe (RFC 8058)

Gmail and Yahoo require one-click unsubscribe in the headers of marketing and subscribed messages, as defined in RFC 8058. In practice that means two headers:

List-Unsubscribe: <https://example.com/unsub?id=abc123>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

Google’s guidelines list both. Yahoo calls the RFC 8058 POST method highly recommended and accepts a mailto method. Most email service providers add the headers to marketing sends automatically, but open a raw message and look, particularly for mail your own application sends.

A visible link in the body

Gmail and Yahoo also want a clearly visible unsubscribe link in the message itself. Yahoo lets it point to a preference page. Microsoft lists “functional unsubscribe links” as recommended practice for large senders, not a hard requirement.

Processing requests within two days

Yahoo says to “Honor unsubscribes within 2 days”. Google’s FAQ recommends processing them within 48 hours, and lists requests not honoured within 48 hours among the issues that can make mitigation unavailable. Unsubscribes from one tool need to sync to every other tool that can email the same person; test that they do.

Spam complaint rates

Gmail requires a user-reported spam rate below 0.3% in Postmaster Tools, recommends keeping it below 0.1%, and says never to reach 0.3%. Bulk senders who go over 0.3% only become eligible for mitigation again after 7 consecutive days back under it, according to Google’s FAQ.

Yahoo also sets the limit at 0.3%. It calculates the rate from mail delivered to the inbox, so your own figures may not match.

Microsoft’s announcement publishes no complaint threshold. It reserves the right to filter or block non-compliant senders and recommends list hygiene, bounce management and confirmed consent.

Complaints fall fastest when you stop mailing people who have stopped engaging. Run a structured win-back sequence for inactive users and suppress whoever does not respond. At the other end, a clear welcome email sequence sets expectations at sign-up, so people recognise your name when you turn up later.

Infrastructure every sender needs

Gmail and Yahoo apply these to all senders, whatever the volume:

• Valid forward and reverse DNS. Google says the sending IP must match the IP of the PTR hostname, and that hostname must resolve back to the same IP.
• TLS when transmitting email (a Google requirement since December 2023).
• Messages formatted correctly under RFC 5322 (Google and Yahoo) and RFC 5321 (Yahoo).
• No impersonating Gmail From addresses. Google applies a DMARC quarantine policy to mail pretending to come from gmail.com.

A reputable email service provider handles most of this for you. If you send from your own servers or an SMTP relay you configured yourself, go through each item.

The checklist

Start by listing every platform that sends email as your domain: marketing, CRM, product, billing, support. Send a test from each to a Gmail and an Outlook.com address and open the original message; rows 1 to 4 can all be read from those headers. Then work down the table with your platform settings and DNS records open.

When you publish or fix the DMARC record in row 3, include the rua address. When you test row 7, check that the unsubscribe stops mail from every tool within 48 hours, not only the one you clicked in.

Keeping it compliant

Passing once proves little. Someone connects a new tool, someone edits a DNS record, one bad list import pushes complaints over the limit.

Google’s Postmaster Tools dashboards include a compliance status view that marks each requirement as compliant or needing work. Google says data typically updates within 24 hours and fixes can take up to seven days to show. Set it up and put the spam rate in your weekly email report.

Read your DMARC aggregate reports monthly and look for sources you don’t recognise.

Watch bounce codes too: 5.7.26 at Gmail means unauthenticated mail, per Google’s guidelines, and 550 5.7.515 is the Outlook.com rejection covered in Microsoft’s support article.

And give one person ownership of every system that sends as your domain. The lifecycle orchestration lesson covers coordinating messages across tools so nobody gets conflicting or duplicate emails.

Cold outreach falls under the same rules, and it is where the spam-rate limit gets breached most easily, because the recipients never asked to hear from you. Send cold email from a separate domain and keep volumes low; our cold email deliverability tactic covers the setup.

Questions people ask

Who counts as a bulk sender for Gmail?

Google defines a bulk sender as one that sends close to 5,000 messages or more to personal Gmail accounts within 24 hours, counting all mail from the same primary domain. Once you hit that threshold once, Google treats you as a bulk sender permanently. Yahoo does not publish a volume threshold, and Microsoft's rules apply to domains sending more than 5,000 emails a day to its consumer services.

Does my DMARC policy have to be quarantine or reject?

No. Gmail, Yahoo and Microsoft all accept a DMARC policy of p=none for bulk senders. What they require is a valid DMARC record and a message that passes DMARC, which means SPF or DKIM must pass and align with the domain in the From header. Moving to quarantine or reject later gives you stronger protection against spoofing.

What spam complaint rate do Gmail and Yahoo allow?

Both require a user-reported spam rate below 0.3%. Google recommends staying below 0.1% and says bulk senders above 0.3% are not eligible for its mitigation support until they stay below it for 7 consecutive days. Yahoo calculates its rate on mail delivered to the inbox, so your own numbers may differ from Yahoo's.

Do transactional emails need one-click unsubscribe?

Google's FAQ says one-click unsubscribe applies to commercial and promotional messages, and transactional messages are excluded. Transactional mail must still meet the authentication requirements, and it usually shares a domain with your marketing mail, so a broken setup affects password resets and receipts as well.

Sources

• Google Workspace Admin Help: Email sender guidelines
• Google Workspace Admin Help: Email sender guidelines FAQ
• Gmail Help: Postmaster Tools dashboards
• Yahoo Sender Hub: Sender best practices
• Yahoo Sender Hub: FAQs
• Microsoft Community Hub: Outlook's new requirements for high-volume senders
• Microsoft Support: Fix NDR error 550 5.7.515 in Outlook.com
• RFC Editor: RFC 8058, Signaling One-Click Functionality for List Email Headers

• email-deliverability
• dmarc
• email-marketing
• lifecycle-email
• compliance