Email sender requirements at Gmail, Yahoo and Outlook.com: thresholds, authentication and unsubscribe rules

Since 2024 the largest consumer mailbox providers have published concrete requirements for anyone sending to their users. Mail that does not meet them may be throttled, sent to spam or rejected. Google says it began ramping up enforcement in November 2025, with temporary and permanent rejections for non-compliant traffic.

Below is what each provider publishes today, followed by how to check your own domain. These rules concern mail sent to consumer mailboxes such as @gmail.com, @yahoo.com, @outlook.com and @hotmail.com; Google's FAQ states explicitly that its rules do not apply to messages sent to Google Workspace accounts.

Gmail

Google's Email sender guidelines apply to personal accounts ending in @gmail.com or @googlemail.com.

All senders must:

• Authenticate with SPF or DKIM.
• Have valid forward and reverse DNS (PTR) for sending IPs.
• Use TLS for transmitting email.
• Keep the spam rate reported in Postmaster Tools below 0.3%.
• Format messages according to RFC 5322, and not impersonate Gmail in the From: header.

Senders of 5,000 or more messages a day must additionally:

• Authenticate with both SPF and DKIM.
• Publish a DMARC record (a policy of p=none is enough).
• Align the From: domain with either the SPF or the DKIM domain.
• Support one-click unsubscribe in marketing and subscribed messages, plus a visible unsubscribe link in the body.

According to Google's sender guidelines FAQ, the 5,000 count covers all messages from the same primary domain within 24 hours, so subdomains add up, and once a domain is classed as a bulk sender it stays one permanently. Google also advises keeping the spam rate below 0.10%; bulk senders above 0.3% are not eligible for delivery mitigation, and the FAQ expects that alignment with both SPF and DKIM will likely become a requirement.

Yahoo

Yahoo's Sender Requirements and Recommendations took effect from February 2024.

All senders: SPF or DKIM at a minimum, spam complaint rate below 0.3%, valid forward and reverse DNS for sending IPs, and compliance with RFC 5321 and RFC 5322.

Bulk senders: both SPF and DKIM; a valid DMARC policy of at least p=none that passes, with a reporting (rua) address strongly recommended and relaxed alignment acceptable; the From: domain aligned with the SPF or DKIM domain; a working List-Unsubscribe header supporting one-click unsubscribe for marketing and subscribed mail (the RFC 8058 POST method highly recommended, mailto acceptable); a visible unsubscribe link in the body; and unsubscribes honoured within two days. Yahoo also recommends DKIM keys of at least 1024 bits and a complaint feedback loop.

Outlook.com and other Microsoft consumer services

Microsoft's support article on bounce error 550 5.7.515 covers Outlook.com, Hotmail, Live.com, MSN and related services. A domain counts as a high-volume sender when it sends 5,000 or more messages to these services using the same domain in the From: address. After that, all its messages must:

• Pass both SPF and DKIM.
• Have a published DMARC record (for example v=DMARC1; p=none).
• Pass DMARC, with SPF and/or DKIM aligned to the From: domain.

Mail that falls short is rejected with 550 5.7.515 Access denied, sending domain <domain> does not meet the required authentication level. Note the difference from Gmail and Yahoo: Microsoft expects both SPF and DKIM to pass, not just one of them.

Side by side

Check your domain

dig +short TXT example.com
dig +short TXT _dmarc.example.com
dig +short TXT selector1._domainkey.example.com
dig +short -x 203.0.113.10
dig +short mail.example.com A

The first line shows your SPF record (the TXT value starting v=spf1); the second, DMARC; the third, the DKIM public key for the selector your platform uses (replace selector1). The last two check that the sending IP has a PTR record and that the name it returns resolves back to the same IP.

Then send a test message to a personal Gmail or Outlook.com account and read the Authentication-Results header: you want spf=pass, dkim=pass and dmarc=pass, with the DKIM d= domain or the envelope sender matching your From: domain.

For marketing mail, add both headers Google documents for one-click unsubscribe:

List-Unsubscribe: <https://example.com/unsubscribe/abc123>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

Common gaps

• A newsletter or CRM platform sending with its own domain in DKIM and envelope, so nothing aligns with your From: domain. Configure it to sign with your domain.
• Invoices or alerts sent from an application server with no DKIM and no PTR record.
• A second SPF TXT record added by a new vendor instead of merging into the existing one.
• DMARC published at p=none with no rua address, so nobody sees the failures.

What you should do

• List every system that sends mail with your domain in the From: address, including marketing tools, ticketing systems and application servers.
• Make each of them pass SPF and DKIM with your domain, and publish DMARC with a reporting address.
• Check PTR records and TLS on your own sending servers.
• Add one-click unsubscribe and a visible link to all marketing mail, and process opt-outs within two days.
• Monitor complaint rates in Google Postmaster Tools and Yahoo's feedback loop, and keep Gmail spam rates under 0.1%.

Sources

• support.google.com/a/answer/81126?hl=en
• support.google.com/a/answer/14229414?hl=en
• senders.yahooinc.com/best-practices
• support.microsoft.com/en-us/outlook/fix-ndr-error-550-5-7-515-in-outlook-com
• manpages.debian.org/trixie/bind9-dnsutils/dig.1.en.html