Gmail, Yahoo and Outlook Sender Requirements 2026: SPF, DKIM, DMARC and Spam Rate

Gmail, Yahoo and Microsoft Outlook all require senders to authenticate their mail in 2026. Every sender needs SPF or DKIM, valid reverse DNS and a spam rate below 0.3%. Bulk senders, roughly 5,000 or more messages a day to personal accounts, also need SPF and DKIM together, a DMARC record of at least p=none that aligns with the From domain, and (for Gmail and Yahoo) one-click unsubscribe. Outlook.com has required SPF, DKIM and DMARC from domains sending more than 5,000 emails a day since May 5, 2025.

Everything below was read from each provider's own documentation on October 13, 2026, and each section links to it. Providers change these pages, so check the source before you rely on a number. We make Warmerly, a warmup and cold email tool, and say where it helps; the rules apply whatever tool you use.

Sender requirements at a glance

Gmail sender guidelines

Google's Email sender guidelines have applied since February 1, 2024. Every sender to personal Gmail accounts must set up SPF or DKIM, have valid forward and reverse DNS for its sending domains or IPs, send over TLS, format messages to RFC 5322, keep the spam rate shown in Postmaster Tools below 0.3%, and not impersonate Gmail From headers.

Bulk senders must also set up both SPF and DKIM, publish DMARC (a policy of none is enough), align the From domain with the SPF or DKIM domain, and support one-click unsubscribe on marketing and subscribed messages: a List-Unsubscribe-Post header with the value List-Unsubscribe=One-Click, a List-Unsubscribe header with an https link, and a visible unsubscribe link in the body. Google recommends keeping the spam rate under 0.1% and never reaching 0.3%, and DKIM keys of 2048 bits where your provider supports them.

Google's FAQ defines a bulk sender as one that sends close to 5,000 messages or more to personal Gmail accounts within 24 hours, counting every message from the same primary domain. The status is permanent: hit the threshold once and you stay a bulk sender even if you send less later. From November 2025 Google says it is ramping up enforcement, and non-compliant mail can be delayed, sent to spam or rejected. The guidelines do not apply to mail sent to Google Workspace accounts, only to personal Gmail.

Yahoo sender requirements

Yahoo's rules match Gmail's closely. All senders need SPF or DKIM at minimum, a spam rate below 0.3%, valid forward and reverse DNS, and compliance with RFC 5321 and RFC 5322. Bulk senders need both SPF and DKIM, a DMARC policy of at least p=none that passes, and a From domain aligned with the SPF or DKIM domain (relaxed alignment is fine). They also need a working one-click List-Unsubscribe header on marketing and subscribed mail, a visible unsubscribe link, and to honour unsubscribes within 2 days. Yahoo notes that it calculates spam rate on mail delivered to the inbox, so your own figure may differ from theirs.

Microsoft Outlook sender requirements

Since May 5, 2025, Microsoft requires domains sending more than 5,000 emails a day to Outlook.com, Hotmail and Live addresses to pass SPF, pass DKIM, and publish DMARC of at least p=none aligned with SPF or DKIM (Microsoft recommends p=reject and both aligned). Mail from high-volume senders that falls short goes to Junk first. If the problem continues it can be rejected with the error 550 5.7.515 Access denied, sending domain does not meet the required authentication level.

Microsoft also asks for valid reverse DNS, an unsubscribe that is easy to find, no retries after a permanent 5xx failure, and no address verification without sending (namespace mining). These rules cover Outlook.com consumer mailboxes. Microsoft 365 business mailboxes are filtered separately by Exchange Online Protection, and authentication counts there too.

Do the bulk sender rules apply to cold email?

Most cold email senders stay well under 5,000 messages a day per domain, so strictly only the all-sender rules apply to them. Treat the bulk rules as the minimum anyway. A new domain with no DMARC record and no unsubscribe has nothing to fall back on when a few recipients mark it as spam, and Gmail counts every message from your primary domain, including any newsletter or product mail you send from it. Cold email is also where spam complaints come from, so a 0.3% ceiling is easy to hit: three complaints in a thousand sends.

1. Publish SPF and DKIM for every domain you send from, and check that they pass. Our free SPF checker and DKIM checker show the record and what is wrong with it.
2. Publish DMARC with at least p=none and a rua address, so you get reports on who is sending as you. Our DMARC checker reads it, and DMARC monitoring turns the reports into something readable.
3. Make sure your From domain matches the domain SPF or DKIM signs for. Sending from a Google Workspace or Microsoft 365 mailbox on your own domain does this once DKIM is switched on.
4. Add one-click unsubscribe headers and a visible opt-out line to cold email as well as marketing. Warmerly adds an unsubscribe header and a visible unsubscribe line to every campaign email, in the RFC 8058 one-click form whenever a link can be included.
5. Keep complaints low: send to verified addresses, ramp new mailboxes slowly, and keep each mailbox's daily volume modest. See our cold email limits per mailbox for the numbers.
6. Watch the providers' own data: Google Postmaster Tools for Gmail, and SNDS if you send from your own IP addresses.

What happens if you do not comply

Each provider escalates. Gmail says non-compliant bulk mail can be rate-limited with temporary errors, sent to spam, or rejected outright, with a reason in the bounce. Outlook.com sends non-compliant high-volume mail to Junk and may then reject it with 550 5.7.515. Yahoo enforces its rules gradually. In every case the first sign is usually not a bounce but a quiet drop in replies, because the mail still arrives, just in spam. A placement test shows that long before your reply rate does.