Gmail, Yahoo and Microsoft Bulk Sender Requirements: The 2026 Checklist

For years, email authentication was a best practice. Today it is an entry requirement. Google and Yahoo began enforcing sender rules in February 2024, Microsoft followed for Outlook.com in May 2025, and Gmail tightened enforcement again from November 2025. The result is simple: if your mail does not meet the standard, the three largest consumer mailbox providers will defer it, reject it, or file it as spam.

This guide pulls the rules from all three providers into one place, explains who they apply to, and gives you a checklist you can work through this week.

Who counts as a bulk sender?

Google treats you as a bulk sender once you send close to 5,000 messages or more in a day to personal Gmail accounts. Messages are counted across your whole primary domain, so mail from subdomains adds up. The classification is also permanent. Dropping below the threshold later does not remove it.

Yahoo does not publish a hard number. It applies the stricter rules to senders of significant volume, and in practice the industry uses the same 5,000 a day yardstick.

Microsoft applies its rules to domains sending more than 5,000 emails a day to its consumer addresses: outlook.com, hotmail.com and live.com.

One important point: several of these rules apply to everyone. Even a sender with fifty emails a day needs basic authentication and a low complaint rate.

Rules that apply to every sender

Whatever your volume, Gmail and Yahoo expect the following:

• SPF or DKIM authentication on every message.
• Valid forward and reverse DNS records for your sending IP addresses.
• TLS encryption when transmitting mail.
• A spam complaint rate below 0.3%.
• Properly formatted messages that follow the internet message format standards.
• No impersonation of Gmail in the From header.

If you use a mainstream email provider, most of these are handled for you. Authentication is the part you still have to configure yourself.

Additional rules for bulk senders

Once you cross the bulk threshold, the list grows:

• Both SPF and DKIM, not just one of them.
• A DMARC record for your sending domain. A policy of p=none is the minimum.
• Alignment. The domain in your From address must match the domain authenticated by SPF or by DKIM.
• One-click unsubscribe on marketing and subscription messages, using the List-Unsubscribe headers described in RFC 8058.
• A visible unsubscribe link in the body of the message.
• Unsubscribe requests honored within two days.

Google's requirements in detail

Google's rules cover mail sent to personal Gmail accounts. Enforcement started in February 2024 with temporary errors on a small share of non-compliant mail, and the grace period is now over. Since November 2025, non-compliant traffic increasingly receives temporary deferrals with 4.7.x error codes and permanent rejections with 5.7.x codes.

The number to remember is the spam rate reported in Google Postmaster Tools. Google asks senders to stay below 0.1% and never reach 0.3%. A sender who goes above 0.3% also loses access to Google's mitigation support until the rate has stayed under that line for seven consecutive days.

Yahoo's requirements in detail

Yahoo's rules mirror Google's closely, and enforcement began at the same time. A few details are worth knowing:

• Yahoo measures the spam rate against mail delivered to the inbox, and expects it to stay below 0.3%.
• DMARC must pass, and relaxed alignment is accepted. Yahoo strongly recommends adding a rua tag so you receive aggregate reports.
• The one-click unsubscribe header must work. The POST method from RFC 8058 is preferred, and a mailto option is accepted.
• You should enroll your DKIM domains in Yahoo's Complaint Feedback Loop so you can see who is marking your mail as spam.

Microsoft's requirements in detail

Microsoft announced its requirements for high-volume senders in April 2025 and began enforcing them on 5 May 2025. Domains sending more than 5,000 messages a day to Outlook.com, Hotmail and Live addresses need:

• SPF that passes for the sending domain.
• DKIM that passes.
• DMARC with at least p=none, aligned with SPF or DKIM, and preferably both.

Microsoft originally planned to route non-compliant mail to the Junk folder. It changed course before enforcement began and now rejects those messages with the error 550 5.7.515 Access denied, sending domain does not meet the required authentication level.

Microsoft also recommends a set of hygiene practices: a valid From or Reply-To address that can receive replies, a working unsubscribe link, regular removal of invalid addresses, and honest subject lines.

The compliance checklist

Work through this list for every domain and subdomain you send from.

1. Inventory your senders. List every tool that sends email as your domain, including CRM, billing, support and product notifications.
2. Publish a valid SPF record that includes every legitimate source and stays under the 10 DNS lookup limit. Our SPF guide explains how.
3. Enable DKIM with your own domain in every platform. Our DKIM guide has the setup steps.
4. Publish a DMARC record with a reporting address. Start at p=none and read the reports. Our DMARC guide covers the basics.
5. Confirm alignment. Send a test message from each source and check that DMARC shows a pass for your From domain.
6. Add one-click unsubscribe headers to all marketing mail, and keep a clear unsubscribe link in the footer.
7. Process opt-outs within two days. Instant is better.
8. Check forward and reverse DNS on any dedicated IP addresses, and confirm that mail is sent over TLS.
9. Monitor your spam rate in Google Postmaster Tools and investigate anything above 0.1%.
10. Clean your list regularly. Remove hard bounces immediately and stop mailing people who have not engaged in months.

What about transactional email?

Receipts, password resets and account alerts are not exempt from authentication. They need SPF, DKIM and DMARC like everything else. The one-click unsubscribe rule, however, applies to marketing and promotional messages only.

A sensible pattern is to send transactional and marketing mail from separate subdomains, such as notify.yourcompany.com and news.yourcompany.com. A complaint spike on a campaign then has less chance of dragging down your password reset emails. Remember that Google still counts volume across the whole primary domain when deciding whether you are a bulk sender.

Does this apply to B2B and cold email?

Technically, Google's rules cover personal Gmail accounts and Microsoft's cover its consumer domains. In practice, it would be a mistake to treat business mailboxes as a free zone. Google Workspace and Microsoft 365 run on the same filtering infrastructure and reward the same signals. Any B2B list also contains more personal addresses than most teams expect.

Cold outreach is where the spam rate threshold bites hardest. A complaint rate of 0.3% means three complaints for every thousand delivered emails. A poorly targeted sequence can cross that line in a single afternoon.

What happens if you ignore the rules?

• Temporary deferrals. Your mail is delayed and retried, and delivery slows down.
• Permanent rejections. Messages bounce with authentication error codes.
• Spam folder placement. Mail is accepted, but hardly anyone sees it.
• Reputation damage that affects your compliant mail too, and takes weeks to repair.
• No mitigation. Google will not help senders who are above the spam threshold.

Final thoughts

None of these requirements are new ideas. Authenticate your mail, make it easy to leave, and do not send messages people report as spam. What changed is that the three biggest mailbox providers now enforce them at the SMTP level. The good news is that compliance is a finite project. Most teams can complete the checklist above in a few days, and the payoff is mail that gets a fair hearing in the inbox.

If you would like a second pair of eyes on your setup, ImpactQuill runs compliance audits against all three providers' requirements and fixes the gaps we find.