Gmail, Yahoo and Outlook sender requirements: a practical checklist for marketing email

Since February 2024, Gmail and Yahoo have required more from anyone who sends email in volume. In May 2025, Microsoft's Outlook.com added its own rules for high-volume senders. Mail from senders who don't meet them can land in spam or be rejected outright.

This guide covers what each provider asks for, as of October 2026, based on their own published pages. If you send marketing email, it is the checklist to work through.

Bulk sender requirements: who counts as a bulk sender

Each provider draws the line a little differently.

• Gmail: a bulk sender is one that sends close to 5,000 messages or more to personal Gmail accounts within 24 hours. Google counts all messages sent from the same primary domain, so mail from subdomains adds to the total. Once a domain reaches that level even once, Google treats it as a bulk sender permanently.
• Yahoo: Yahoo publishes separate rules for "all senders" and "bulk senders", but its sender pages don't set a fixed daily number.
• Outlook: Microsoft's rules apply to domains sending more than 5,000 emails a day to Outlook.com, its consumer service, which covers outlook.com, hotmail.com and live.com addresses.

Gmail and Yahoo also have a shorter list of rules for all senders, at any volume. In practice, the safest approach is to meet the bulk-sender rules from day one. They are good practice at any size, and a growing list can cross a threshold without anyone noticing.

1. Authenticate with SPF and DKIM

Publish an SPF record that lists the services allowed to send for your domain, and sign every message with DKIM.

• Gmail and Yahoo require all senders to use SPF or DKIM, and bulk senders to use both.
• Google asks for DKIM keys of at least 1024 bits and recommends 2048 bits where your DNS provider supports it.
• Microsoft says SPF must pass for the sending domain and DKIM must pass, for domains over its 5,000-a-day threshold.

If you send through an email service, the records still go in your own domain's DNS. Microsoft states this directly: authentication is tied to your domain even when you outsource sending.

2. Publish a DMARC record and align your From domain

Bulk senders need a DMARC record for the domain in their From address. All three providers accept a policy of p=none as the minimum. That lets you start monitoring without risking legitimate mail.

DMARC also needs alignment: the domain in your From header must match the domain that passed SPF or the domain that signed with DKIM. All three providers require at least one of the two to align. Google and Microsoft both recommend aligning both.

A minimal record looks like this:

_dmarc.example.com  TXT  "v=DMARC1; p=none; rua=mailto:[email protected]"

Microsoft notes that a stricter policy (p=reject) gives the best protection against spoofing once all your legitimate sources are aligned, and advises moving gradually from none to quarantine to reject.

Don't send from a free-mail address such as @gmail.com through a third-party service. Google says Gmail applies a DMARC quarantine policy to mail that impersonates Gmail From headers. Use your own domain.

3. Offer one-click unsubscribe

Gmail and Yahoo require bulk senders to support one-click unsubscribe on marketing and subscribed messages. In practice that means two headers, as defined in RFC 8058:

List-Unsubscribe: <https://example.com/unsubscribe/abc123>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

With these in place, the mailbox provider can show its own unsubscribe button next to your From name.

• Gmail also requires a clearly visible unsubscribe link in the message body, and recommends processing unsubscribe requests within 48 hours.
• Yahoo requires unsubscribes to be honoured within 2 days. It highly recommends the POST method from RFC 8058 and also accepts a mailto link.
• Microsoft lists a functional unsubscribe link as a recommended practice for large senders: an easy, clearly visible way to opt out, particularly for marketing or bulk mail.

4. Keep spam complaints low

Google requires senders to keep the spam rate reported in Postmaster Tools below 0.3%, and recommends staying under 0.1%. Yahoo also sets the limit at 0.3%. Microsoft doesn't publish a spam-rate number, but recommends list hygiene and consent to reduce complaints.

Complaints come from people who don't remember agreeing to hear from you, or who get more email than they expected. The fixes are consent and relevance:

• send only to people who opted in, and keep a record of when and how;
• confirm sign-ups with double opt-in where you can;
• segment, so each campaign goes to the people it is relevant to;
• limit how often you send;
• remove invalid and long-inactive addresses regularly. Microsoft suggests cleaning lists monthly or quarterly.

5. Get the infrastructure basics right

• Forward and reverse DNS: Gmail and Yahoo require sending IPs to have valid forward and reverse DNS (PTR) records.
• TLS: Gmail requires a TLS connection for transmitting email.
• Message format: Gmail requires messages to follow RFC 5322, and Yahoo requires compliance with RFCs 5321 and 5322.
• A real From and Reply-To: Microsoft recommends From and Reply-To addresses that are valid, reflect the true sending domain and can receive replies.

Established email delivery providers handle the server side of this for you. Your part is the DNS records for your own domain.

Outlook (Microsoft) bulk sender requirements

Microsoft announced its rules on April 2, 2025, and enforcement started on May 5, 2025. They apply to domains sending more than 5,000 emails a day to Outlook.com, Microsoft's consumer email service, which covers outlook.com, hotmail.com and live.com addresses.

What Microsoft requires:

1. SPF must pass for the sending domain, and the record should accurately list your authorised IP addresses or hosts.
2. DKIM must pass, to validate the message's integrity and authenticity.
3. DMARC must be published with at least p=none, and must align with either SPF or DKIM, preferably both.

What Microsoft recommends for large senders:

• From or Reply-To addresses that are valid, show the true sending domain and can receive replies;
• functional, clearly visible unsubscribe links, particularly on marketing or bulk mail;
• list hygiene and bounce management: remove invalid addresses regularly;
• transparent mailing practices: accurate subject lines, no deceptive headers, and recipients who have consented.

What happens to mail that doesn't comply. Microsoft's original plan was to send non-compliant mail to Junk first. In an update dated April 29, 2025, it changed this: messages that fail the authentication requirements are rejected, starting May 5, 2025. The bounce reads 550; 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level. Microsoft also says it may filter or block senders that seriously break its authentication or hygiene practices, and that adding a sender to a Safe Senders list won't bypass enforcement.

Gmail, Yahoo and Outlook sender requirements checklist

"Bulk" means each provider's own threshold described above. "All" means the rule applies at any volume. A dash means the provider's sender page doesn't state it.

Beyond the table, work through these:

1. Sending domain verified with SPF and DKIM.
2. DMARC record published (p=none or stricter), with your From domain aligned.
3. One-click unsubscribe headers plus a visible unsubscribe link.
4. Unsubscribes honoured within 2 days, ideally immediately.
5. Spam rate below 0.3%, aiming for under 0.1%.
6. Consent recorded for every subscriber.
7. Cold outreach on separate domains.

How EterMail handles this for you

EterMail is our product, an email marketing platform. Here is what it does today to help you meet the rules above:

• Domain verification before sending. You add your sending domain in project settings, and EterMail shows the DNS records (SPF and DKIM) to publish. It also checks for a DMARC record and tells you if it is missing. Campaigns can't be sent until the domain is verified. Free-mail domains like gmail.com can't be added as sending domains.
• One-click unsubscribe on every marketing email. EterMail adds the List-Unsubscribe and List-Unsubscribe-Post headers automatically.
• A footer templates can't remove. The unsubscribe link and your postal address always appear. Unsubscribes apply immediately, including for emails that were already scheduled.
• Spam complaints handled automatically. When a recipient marks an EterMail email as spam, they are unsubscribed and suppressed.
• Automatic pause on spikes. If bounce or complaint rates spike, sending pauses so you can investigate before your reputation suffers.
• A frequency limit. Each contact gets at most one marketing email per 24 hours across campaigns.
• Cold outreach kept separate. Outreach runs from separate domains and mailboxes, so it can't drag down the reputation of your newsletters and receipts. See our guide to cold email deliverability.

Meeting the rules is the minimum. For the wider picture of what decides inbox or spam, read our email deliverability guide.

FAQ

Who counts as a bulk sender?

Gmail counts senders that send close to 5,000 or more messages to personal Gmail accounts in 24 hours, counting all mail from the same primary domain, and that status is permanent once reached. Microsoft's rules apply to domains sending more than 5,000 emails a day to outlook.com, hotmail.com and live.com addresses. Yahoo's sender pages don't publish a number, so meet its bulk rules from the start.

Do the rules apply to transactional email?

Mostly, yes. Gmail and Yahoo set their authentication, DNS and spam-rate rules for senders, and Microsoft for sending domains, not for particular kinds of message, so set them up for everything your domain sends. The clear exception is one-click unsubscribe: Google says it is required only for marketing and promotional messages, and transactional messages such as password resets are excluded. Yahoo's one-click rule likewise covers marketing and subscribed messages.

What happens if my spam rate goes over 0.3%?

Google says bulk senders with a user-reported spam rate above 0.3% are ineligible for mitigation, meaning Google's help with delivery problems. They become eligible again once their spam rate stays below 0.3% for 7 consecutive days. A higher spam rate also makes it more likely your mail goes to spam, so aim for under 0.1%.

Does Outlook require DMARC?

Yes, for domains sending more than 5,000 emails a day to Outlook.com consumer addresses. Microsoft requires a DMARC record with at least p=none that aligns with SPF or DKIM, preferably both. Since May 5, 2025, mail that fails these authentication requirements is rejected with a 550 5.7.515 error.

Do I need one-click unsubscribe for every email?

No. Gmail and Yahoo require it for marketing and subscribed messages from bulk senders, not for transactional messages like order confirmations. Gmail also requires a visible unsubscribe link in the body of those marketing messages. Microsoft recommends a functional unsubscribe link, particularly for marketing or bulk mail.