Gmail, Yahoo and Outlook Sender Requirements in 2026: The Complete Checklist

Since 2024, the biggest mailbox providers no longer just filter mail they do not trust: they refuse it. Gmail and Yahoo introduced sender requirements in February 2024, Microsoft followed for Outlook.com in May 2025, and Gmail stepped up enforcement in November 2025, including permanent rejections of non-compliant mail.

If your emails suddenly bounce with 550 5.7.26 from Gmail or 550 5.7.515 from Outlook, this is why. Here is what each provider requires, who counts as a "bulk sender", and a checklist to get compliant.

Who has to follow these rules

The strictest rules apply to bulk senders. Gmail and Microsoft draw the line at about 5,000 messages a day to their personal accounts (@gmail.com, @outlook.com, @hotmail.com, @live.com). Yahoo deliberately gives no number, so treat any regular volume to Yahoo addresses as bulk.

Two details catch people out:

• Gmail counts per sending domain, across all your tools (subdomains included). Your newsletter, your CRM and your cold email tool all add up if they send from the same domain.
• At Gmail, once you are a bulk sender, you stay one. Google says bulk sender status has no expiry date, even if your volume drops again.

Everyone else still has to meet the basic requirements for all senders. Even a cold email campaign at 50 messages a day needs valid authentication and a low spam rate.

What each provider requires

"Not in the published rules" means the provider does not list it as a requirement; it is still good practice.

The requirements in plain language

1. SPF: say which servers may send for you

SPF is a DNS record listing the servers allowed to send email with your domain. It lives in a TXT record on your domain and looks like this:

v=spf1 include:_spf.google.com include:sendgrid.net ~all

Keep one SPF record per domain, end it with ~all or -all (never +all), and stay under 10 DNS lookups in total, or the check fails.

2. DKIM: sign every message

DKIM adds a cryptographic signature to each message. Your email provider (Google Workspace, Microsoft 365, your sending platform) gives you a DNS record to publish, then signs outgoing mail automatically. Every tool that sends as your domain needs its own DKIM setup.

3. DMARC: tie it together

DMARC tells receivers what to do when a message has no aligned SPF or DKIM pass (see alignment below), and sends you reports about who is sending as your domain. It is a TXT record at _dmarc.yourdomain.com:

v=DMARC1; p=none; rua=mailto:[email protected]

p=none meets the requirements. Once your reports show only your own services, move to p=quarantine, then p=reject, to stop others from spoofing your domain.

Alignment is the part people miss: the domain in the visible From address must match the domain that passed SPF or DKIM. A message from [email protected] signed only by sendingplatform.com passes DKIM but is not aligned.

4. Keep spam complaints under 0.3%

Gmail measures how many recipients click "Report spam" in Postmaster Tools. Stay below 0.1% and never reach 0.3%. In practice that means emailing people who expect to hear from you, and making it easy to leave.

5. One-click unsubscribe

For marketing and subscribed mail, bulk senders must add the List-Unsubscribe and List-Unsubscribe-Post headers (RFC 8058), so Gmail and Yahoo can show their own unsubscribe button, and process requests within two days (Gmail says 48 hours). Most email platforms add these headers for you; check that yours does. Keep a visible unsubscribe link in the body too.

6. Reverse DNS and TLS

The IP address that sends your mail must have a reverse DNS (PTR) record that points to a hostname, which in turn points back to the same IP. Your email provider handles this unless you run your own mail server. Connections should use TLS, which every modern platform does by default.

Where your list quality comes in

Authentication proves who you are. Your list decides whether providers like what you send. Bounces to addresses that do not exist and complaints from people who never asked to hear from you are both reputation signals, and Microsoft explicitly asks high-volume senders to maintain list hygiene and manage bounces.

Before a campaign:

• Verify the list so hard bounces stay under 2%. See how to clean a list before a cold email campaign.
• Remove role addresses (info@, sales@) from cold outreach: shared inboxes complain more.
• Drop addresses that bounced before. Any 5.1.1 "user unknown" bounce is permanent. See what bounce codes mean.

Checklist

• One SPF record, ending in ~all or -all, under 10 lookups
• DKIM enabled for every service that sends as your domain
• DMARC record published, at least p=none, with a rua= address
• From domain aligned with SPF or DKIM for every sending tool
• One-click unsubscribe headers on marketing mail, honored within 48 hours
• Spam rate below 0.1% in Google Postmaster Tools
• Reverse DNS set on your sending IP (or handled by your provider)
• List verified before sending, hard bounces removed immediately

You can check the first three points in seconds with our free SPF and DMARC checker.

Frequently asked questions

I send fewer than 5,000 emails a day. Do these rules apply to me?

The bulk sender rules do not, but Gmail's requirements for all senders do: SPF or DKIM, valid reverse DNS, TLS and a spam rate below 0.3%. Setting up DMARC anyway is cheap, and it protects your domain from being spoofed.

Does cold email count as marketing mail for one-click unsubscribe?

Gmail requires one-click unsubscribe for marketing and subscribed messages from bulk senders. Whatever the classification, giving cold email recipients an easy way to opt out lowers complaints, and complaints are what hurt you most.

How long do DNS changes take?

Usually minutes to a few hours, depending on the record's TTL. Our checker reads public DNS, so it shows what receiving servers see.

Sources

• Gmail: email sender guidelines and sender guidelines FAQ
• Yahoo Sender Hub: best practices
• Microsoft: Outlook's new requirements for high-volume senders
• RFC 8058: one-click unsubscribe