Gmail, Yahoo and Outlook.com sender requirements checklist

Gmail and Yahoo started enforcing sender requirements in February 2024, and Outlook.com followed for high-volume senders in May 2025. The three lists overlap a lot, but not completely: who counts as a bulk sender, which spam rate is acceptable and whether a mailto: unsubscribe is enough all differ. This checklist puts them side by side, with the thresholds as each provider states them.

The rules cover mail sent to the providers’ consumer mailboxes: personal Gmail accounts (Google says its guidelines don’t apply to mail sent to Google Workspace accounts), Yahoo Mail, and Outlook.com, which serves outlook.com, hotmail.com and live.com addresses.

Who counts as a bulk sender

• Gmail: anyone who sends close to 5,000 messages or more to personal Gmail accounts within 24 hours. All mail from the same primary domain counts together, so example.com and news.example.com add up. Once you have reached that volume, Google treats you as a bulk sender permanently.
• Yahoo: a sender of “a significant volume of mail”. Yahoo deliberately publishes no threshold and evaluates senders at the level of the authenticated domain or the From domain.
• Outlook.com: domains that send more than 5,000 emails per day to Outlook.com addresses.

If you send newsletters, marketing or notifications to a list of any real size, assume the bulk rules apply. They are a sensible baseline below the thresholds too.

The checklist at a glance

Requirement	Gmail	Yahoo	Outlook.com
SPF and DKIM	SPF or DKIM for all senders; both for bulk senders	SPF or DKIM for all; both for bulk	SPF must pass and DKIM must pass
DMARC	Bulk: a DMARC record; p=none is enough	Bulk: valid policy, at least p=none; DMARC must pass	At least p=none
Alignment	Bulk: From domain aligned with SPF or DKIM	Bulk: aligned with SPF or DKIM; relaxed is fine	Aligned with SPF or DKIM, preferably both
One-click unsubscribe	Bulk: required for marketing and subscribed mail	Bulk: required for marketing and subscribed mail	Recommended: a functional, visible unsubscribe link
Processing unsubscribes	Recommended within 48 hours	Within 2 days	Not specified
Spam rate	Below 0.3% in Postmaster Tools; aim for below 0.1%	Below 0.3%	No published threshold
Forward and reverse DNS	All senders	All senders	All senders: valid reverse DNS
TLS	All senders	Not listed	Not listed
Message format	RFC 5322	RFC 5321 and RFC 5322	All senders: Internet email standards

“Not listed” means the provider’s requirement pages don’t state it, not that the provider ignores it. The Outlook.com column describes the high-volume requirements unless noted otherwise.

1. SPF and DKIM

At Gmail and Yahoo every sender needs at least one working authentication method, and bulk senders need both. Microsoft’s high-volume requirements say SPF must pass for the sending domain and DKIM must pass.

• SPF must list every service that sends with your envelope sender (bounce) domain. Check it, including the 10-lookup limit, with the SPF checker.
• DKIM should be signed with your own domain, not only the email service’s. Google requires a key of at least 1024 bits for personal Gmail accounts and recommends 2048; Yahoo also asks for at least 1024 bits. The DKIM checker shows the key type and length. You need the selector: it’s the s= value in the DKIM-Signature header of a message you sent.

2. DMARC, with alignment

All three providers accept a monitoring policy:

_dmarc.example.com.  3600  IN  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

Yahoo strongly recommends the rua tag, so you get reports while you set things up. Publishing the record is not the whole requirement, though: messages must pass DMARC, which means the domain in the From header must be aligned with a domain that passed SPF or DKIM.

One aligned method is enough at all three providers. Google and Microsoft recommend aligning both, and Google writes that alignment with both will likely become a requirement. Google doesn’t require alignment for forwarded mail and mailing list messages.

The usual failure is an email service that passes SPF and DKIM for its own domain. Turn on custom DKIM (often called domain authentication) in the service. See DMARC alignment and how to configure DMARC for the full rollout.

3. One-click unsubscribe for marketing mail

Gmail and Yahoo require bulk senders to support one-click unsubscribe (RFC 8058) in marketing and subscribed messages. Both exclude transactional messages such as password resets and order confirmations.

List-Unsubscribe: <https://example.com/unsubscribe/7f3c9a1e2b>, <mailto:unsubscribe@example.com?subject=unsubscribe-7f3c9a1e2b>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

The details differ:

• Gmail counts only the RFC 8058 headers with an HTTPS URL. A mailto: link or a link in the body doesn’t meet its requirement, although Gmail still supports mailto:.
• Yahoo highly recommends the POST method from RFC 8058 and accepts mailto:.
• Both also want a clearly visible unsubscribe link in the message body. It may lead to a preferences page.
• Processing time: Yahoo requires unsubscribes to be honored within 2 days; Google recommends 48 hours.

An HTTPS URL plus List-Unsubscribe-Post satisfies both. RFC 8058 also requires a DKIM signature that covers both headers. Implementation details are in one-click unsubscribe for developers.

Microsoft lists a “functional unsubscribe link” among its recommendations for large senders: easy to find and reliable when clicked.

4. Keep the spam rate low

• Gmail: keep the spam rate reported in Postmaster Tools below 0.3%; this applies to all senders. Google’s guidance goes further: stay below 0.1% and never reach 0.3%. Bulk senders above 0.3% are not eligible for mitigation, and become eligible again once the rate stays below 0.3% for 7 consecutive days. Rates are calculated daily.
• Yahoo: keep the spam rate below 0.3%. Yahoo calculates it from mail delivered to the inbox, so it can differ from your own numbers. The Yahoo Complaint Feedback Loop sends you copies of complaints for your DKIM domains.
• Outlook.com: Microsoft’s requirements don’t publish a threshold. SNDS gives you data about your sending IPs.

0.3% is three complaints per thousand messages. Complaints usually come from people who don’t remember signing up or can’t find the unsubscribe link; see why emails go to spam.

5. Valid forward and reverse DNS

Each sending IP address needs a PTR record, and the name in it must resolve back to the same address. Gmail and Yahoo require this from all senders; Microsoft’s policies say email servers must have valid reverse DNS records. Yahoo adds that the PTR name should be meaningful and not look like a dynamically assigned address.

25.113.0.203.in-addr.arpa.  3600  IN  PTR  mail.example.com.
mail.example.com.           3600  IN  A    203.0.113.25

The PTR record is set by whoever controls the IP address — your hosting provider or email service — not in your domain’s zone. Check both directions with the reverse DNS lookup; details are in reverse DNS for mail servers.

6. TLS

Gmail requires all senders to use a TLS connection for transmitting email. Yahoo’s and Microsoft’s requirement pages don’t list TLS, but meeting it costs nothing. Email services handle this for you; if you run your own server, make sure it uses STARTTLS when the receiving server offers it.

To confirm, look at the Received headers of a delivered message. The email header analyzer marks each hop as encrypted or not, where the receiving server records it.

7. Message format and identity

• Format messages according to RFC 5322 (Gmail), and comply with RFC 5321 and RFC 5322 (Yahoo). In practice: exactly one From header, a Date and a valid Message-ID, no duplicate headers. Gmail rejects several of these errors outright.
• Don’t put a @gmail.com address in the From header of mail that isn’t sent through Gmail; Google treats that as impersonation.
• Microsoft recommends a From or Reply-To address that is valid, reflects the real sending domain and can receive replies.

What happens if you don’t comply

• Gmail: since November 2025, Google has been ramping up enforcement. Non-compliant messages can get temporary (4.7.x) or permanent (5.7.x) rejections, or land in spam. A missing DMARC record, a spam rate above 0.3%, missing one-click unsubscribe or unsubscribes not honored within 48 hours make you ineligible for delivery support and mitigation.
• Yahoo: enforcement began in February 2024 and was rolled out gradually. Non-compliant mail may be deferred (4xx), delivered to the spam folder or rejected (5xx); Yahoo also defers mail from domains with a high complaint rate.
• Outlook.com: Microsoft’s policy page says non-compliant high-volume mail goes to the junk folder and, if problems persist, may be rejected with:

550; 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level.

The April 2025 update to Microsoft’s announcement describes rejecting such messages with this code. Either way, the fix is authentication. For what each code means and how to read a bounce, see email bounce codes.

Check your setup

1. Send a real marketing message to Gmail and Outlook.com mailboxes you control, and paste its headers into the email header analyzer. You want spf=pass, dkim=pass and dmarc=pass, an aligned From domain, TLS on the hops, and the one-click unsubscribe headers, with list-unsubscribe and list-unsubscribe-post among the DKIM signed headers.
2. Run the DMARC checker for your From domain.
3. Check SPF and DKIM.
4. Look up every sending IP in the reverse DNS lookup.
5. Watch the providers’ own data: the compliance status dashboard and spam rate in Google Postmaster Tools, Yahoo’s Complaint Feedback Loop and Microsoft SNDS.

Providers change these rules from time to time. The pages listed in the references are the authoritative versions; check them when something stops working.