Outlook and Gmail Sender Rules: Email Deliverability UK Update

Microsoft began enforcing authentication rules for high-volume senders to Outlook.com on 5 May 2025, and Google told senders that from November 2025 Gmail would step up enforcement against mail that fails its requirements. Together with Yahoo's matching rules, this means any UK business sending newsletters, offers or account emails at volume now needs SPF, DKIM and DMARC working correctly, or it risks having messages junked or refused outright. For anyone responsible for email deliverability in the UK, these rules are no longer a future concern; they are already in force.

What happened

Microsoft Outlook. On 2 April 2025 Microsoft published "Strengthening Email Ecosystem: Outlook's New Requirements for High-Volume Senders" on its Tech Community blog. The rules cover the consumer Outlook.com service, which includes hotmail.com, live.com and outlook.com addresses. They do not cover business mailboxes on Microsoft 365. Domains sending more than 5,000 emails a day to those addresses must:

• pass SPF for the sending domain;
• pass DKIM;
• publish a DMARC policy of at least p=none, aligned with SPF or DKIM (Microsoft says ideally both).

Microsoft revised the post on 29 April 2025 to change what happens to failing mail. Its current Outlook.com postmaster policy page says that, from 5 May 2025, non-compliant messages from high-volume senders are sent to the junk folder, and that if the problem is not fixed they may be rejected with the error 550; 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level. Deliverability firms have reported seeing those 5.7.515 rejections in practice. Microsoft also recommends valid reverse DNS, a clear unsubscribe option and enrolment in its SNDS and JMRP reputation programmes.

Google Gmail. Gmail's sender requirements have applied since February 2024, but on 3 November 2025 Google added a line to its bulk sender FAQ: "Starting November 2025, Gmail is ramping up its enforcement on non-compliant traffic." Google says failing messages will face disruptions, "including temporary and permanent rejections", returned as 4.7.x (temporary) or 5.7.x (permanent) SMTP errors that name the failed requirement.

Yahoo. Yahoo's sender hub sets out almost the same rules for bulk senders, including DMARC that passes, one-click unsubscribe, and handling unsubscribe requests within two days.

The requirements side by side

Two details from Google catch many senders out. First, bulk sender status is counted across your primary domain, including subdomains, so news.example.co.uk and example.co.uk add up together. Second, once you cross roughly 5,000 messages a day to personal Gmail accounts, Google says the status is permanent, even if your volume drops later.

What this means for UK businesses

Most UK small businesses do not send 5,000 emails a day. But many use a platform (Mailchimp, Klaviyo, a CRM or an e-commerce system) that sends from their domain, and a single seasonal campaign, a Black Friday offer or a data import can push them over the threshold. Gmail's basic rules (email authentication, valid forward and reverse DNS, TLS and low complaint rates) also apply to all senders, whatever their volume.

The practical risk is lost revenue and lost trust: order confirmations, password resets and invoices delivered to junk, or rejected so they never arrive at all. A rejection at SMTP level also means the recipient's "safe senders" list cannot rescue the message.

There is a UK compliance angle too. One-click unsubscribe sits well alongside the PECR rules on electronic marketing, which already require a simple way to opt out of marketing messages. Technical authentication does not replace UK GDPR and PECR obligations, but getting both right protects your domain.

What to do now

1. Check your current records. Use the MakeItFlow SPF checker, DKIM checker and DMARC checker, or the combined email deliverability checker, on every domain you send from.
2. List every service that sends as your domain. Include your newsletter platform, CRM, helpdesk, invoicing and website contact forms. Each needs to be authorised in SPF or signing with DKIM on your domain.
3. Fix SPF lookups. Adding too many services can break the 10-lookup limit. See our guide to SPF "too many DNS lookups", and use the SPF record generator to rebuild a clean record.
4. Publish DMARC with reporting. Start with p=none and a rua address so you receive aggregate reports. The DMARC record generator builds the record for you; our guide on reading DMARC reports explains what to look for.
5. Add one-click unsubscribe headers to marketing mail. Most major email platforms support RFC 8058; check that it is switched on.
6. Watch complaint rates and bounces. Register for Google Postmaster Tools and Microsoft SNDS, and look out for 4.7.x, 5.7.x and 550 5.7.515 bounces in your sending logs.
7. Re-check after any change. A free website audit on MakeItFlow checks SPF, DKIM, DMARC, MTA-STS and BIMI alongside your site's security and performance, and paid plans can re-scan on a schedule so you notice if a DNS change breaks authentication.

For a broader walk-through, see our Gmail, Yahoo and Microsoft sender requirements guide.

Frequently asked questions

Do these rules apply to emails sent to Microsoft 365 business mailboxes?

No. Microsoft's high-volume sender rules cover the consumer Outlook.com service (outlook.com, hotmail.com and live.com addresses). Mail to business mailboxes is filtered by each organisation's own Microsoft 365 settings, although proper SPF, DKIM and DMARC still help there.

We send fewer than 5,000 emails a day. Can we ignore this?

Not entirely. Google's rules for all senders still require email authentication, valid DNS, TLS and low spam rates, and Google notes that new domains face accelerated enforcement. Setting up DMARC now also protects your domain from spoofing and prepares you for growth.

Is p=none enough, or do we need p=reject?

p=none meets the minimum for Outlook, Gmail and Yahoo. Microsoft says it prefers p=reject, and moving to p=quarantine or p=reject once your reports show all legitimate mail passing gives much stronger protection against spoofing. Our DMARC explainer covers the stages.

Sources

• Microsoft Tech Community: Outlook's New Requirements for High-Volume Senders (2 April 2025, updated 29 April 2025)
• Microsoft Outlook.com Postmaster: Policies, Practices and Guidelines
• Google Workspace Admin Help: Email sender guidelines FAQ
• Yahoo Sender Hub: Sender best practices
• Spam Resource: Google warns sender requirements enforcement ramping up (6 November 2025)