Gmail, Yahoo and Microsoft Bulk Sender Requirements (2026)

Gmail, Yahoo and Microsoft now publish specific rules that senders must meet to reach their users, and since late 2025 Gmail has been rejecting non-compliant mail outright rather than just filtering it. The rules overlap but aren't identical: thresholds, unsubscribe deadlines and enforcement wording differ. This post sets out what each provider requires as of October 2026, where they differ, and how to check your own setup against them.

The short version

Details follow, provider by provider.

Gmail

Google's email sender guidelines split rules into "all senders" and "senders of 5,000 or more messages a day."

All senders to personal Gmail accounts

• Set up SPF or DKIM for your sending domain.
• Have valid forward and reverse DNS (PTR) for sending IPs.
• Use TLS for transmitting email.
• Keep the spam rate reported in Postmaster Tools below 0.3%.
• Format messages according to RFC 5322.
• Don't impersonate Gmail From: headers.

Bulk senders (close to 5,000 or more messages a day)

Everything above, plus:

• SPF and DKIM and DMARC. The DMARC policy can be p=none.
• DKIM keys of at least 1024 bits, with 2048 recommended.
• The From: domain must align with either the SPF domain or the DKIM domain.
• One-click unsubscribe for marketing and subscribed messages, plus a clearly visible unsubscribe link in the message body.

How Google counts 5,000

According to Google's FAQ, the count covers messages sent to personal Gmail accounts in a 24-hour period, and mail from the same primary domain is combined, subdomains included. 2,500 messages from example.com plus 2,500 from news.example.com puts you at 5,000. Once you hit the threshold, you are permanently considered a bulk sender. Sending less later doesn't change that.

Enforcement timeline

• February 2024: requirements took effect for bulk senders.
• June 1, 2024: deadline for one-click unsubscribe on commercial and promotional messages.
• November 2025: Google said it was ramping up enforcement, with non-compliant messages facing "temporary and permanent rejections."

Rejections come with specific codes. A few you might see in bounce messages:

The 4xx codes are temporary (your server will retry); 5xx are permanent.

Yahoo

Yahoo's Sender Hub rules took effect in February 2024 with a gradual rollout through the first half of that year.

All senders

• Authenticate with SPF or DKIM at minimum.
• Keep the spam rate below 0.3%.
• Valid forward and reverse DNS for sending IPs.
• Comply with RFC 5321 and RFC 5322.

Bulk senders

• Both SPF and DKIM, and a DMARC policy of at least p=none that passes, with the From: domain aligned to SPF or DKIM. Yahoo strongly recommends including a rua reporting address.
• A working List-Unsubscribe header supporting one-click unsubscribe for marketing and subscribed messages. Yahoo highly recommends the RFC 8058 POST method, and accepts mailto. A visible unsubscribe link in the body is also required.
• Honor unsubscribes within 2 days.
• Keep spam rates below 0.3%. Yahoo calculates the rate from mail delivered to the inbox, so your own numbers may differ.

No fixed threshold

Unlike Google and Microsoft, Yahoo says it will not specify a volume threshold for bulk senders. It assesses senders at the domain level using all its signals. In practice, if you send marketing mail at any real volume, follow the bulk rules.

Microsoft Outlook.com

Microsoft's rules apply to its consumer mail service (Outlook.com, Hotmail.com and Live.com addresses). They took effect May 5, 2025, for domains sending more than 5,000 emails per day to those addresses.

Required for high-volume senders

• SPF must pass, with DNS listing your authorized IPs and hosts.
• DKIM must pass.
• DMARC at least p=none, aligned with SPF or DKIM (preferably both). Microsoft recommends p=reject.

Note the difference from Gmail and Yahoo: Outlook.com expects both SPF and DKIM to pass, not just one aligned result.

What happens if you don't comply

Microsoft's postmaster policy says failing messages are first sent to the Junk folder, and if the issues stay unresolved they may be rejected with:

550; 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level.

If you see 5.7.515 in your bounce logs, treat it as a direct signal that you're missing SPF, DKIM or DMARC for that domain.

Recommended practices

Microsoft also lists practices it expects from senders: an unsubscribe mechanism that's clearly documented and easy to use, not retrying after permanent 5xx errors, removing addresses that bounce repeatedly, valid reverse DNS, and monitoring your IPs through SNDS and the Junk Mail Reporting Program.

One-click unsubscribe, done right

Gmail and Yahoo both point to RFC 8058. Add these two headers to marketing mail:

List-Unsubscribe: <https://example.com/u/7f3a9c2e>, <mailto:unsub-7f3a9c2e@example.com>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

• The HTTPS URL must accept a POST request and unsubscribe the user without asking them to log in or confirm.
• RFC 8058 requires a valid DKIM signature that covers both headers, so they can't be tampered with.
• Keep a visible unsubscribe link in the body too.
• Transactional messages (receipts, password resets) don't need one-click unsubscribe.

Most email service providers add these headers for you once your sending domain is authenticated. Check a sent message's headers to confirm.

How to check your compliance

1. Publish and verify DNS records. One SPF record under 10 lookups, DKIM for every sending service, a DMARC record with rua. Our email authentication checklist covers each one, and you can run a free audit to check SPF, DKIM, DMARC, MTA-STS and BIMI in one scan.
2. Check a real message. In Gmail, Show original shows SPF, DKIM and DMARC results and the domains they passed for.
3. Register for Google Postmaster Tools. It shows your spam rate and compliance status for Gmail. If the numbers look wrong, check whether your domain is blacklisted too.
4. Join Yahoo's Complaint Feedback Loop through the Sender Hub, and Microsoft's SNDS and JMRP.
5. Read DMARC reports to find services sending as your domain without alignment. See how to read DMARC reports.
6. Test unsubscribe from a seed account and confirm it takes effect within two days.

Frequently asked questions

Do these rules apply if I send fewer than 5,000 emails a day?

Partly. Gmail and Yahoo require every sender to have SPF or DKIM, valid reverse DNS and a spam rate below 0.3%. Gmail also requires TLS. The DMARC, alignment and one-click unsubscribe rules apply to bulk senders, but meeting them is good practice for any business domain.

Does p=none satisfy the DMARC requirement?

Yes. Gmail, Yahoo and Microsoft all accept p=none as the minimum. Yahoo also requires the DMARC check to pass, and Microsoft recommends p=reject. Moving to enforcement is still worth doing to stop spoofing.

Do the rules apply to Google Workspace or Microsoft 365 business mailboxes?

Gmail's bulk-sender rules are about mail sent to personal Gmail accounts. Microsoft's high-volume requirements are written for its consumer Outlook.com service (Outlook.com, Hotmail and Live addresses), not Microsoft 365 business tenants. Business mailboxes have their own filtering, which authentication also helps with.

Is 0.3% the spam rate I should aim for?

No. It's the line you must stay below. Google recommends keeping your rate under 0.1% and never reaching 0.3%. If you're near 0.3%, fix list quality and unsubscribe handling before sending more.

What to do next

Work through the table at the top and mark each row pass or fail for your domain. Authentication gaps are the fastest to fix and the ones causing outright rejections now. Then move on to unsubscribe headers and spam-rate monitoring. If mail is already going to junk, start with why emails go to spam.

Sources

• Google: Email sender guidelines
• Google: Email sender guidelines FAQ
• Google Workspace Admin Help: Gmail SMTP errors and codes
• Yahoo Sender Hub: Sender best practices
• Yahoo Sender Hub: FAQs
• Microsoft: Outlook.com postmaster policies, practices and guidelines