Gmail
Google's rules cover mail sent to personal Gmail accounts, the addresses that end in @gmail.com or @googlemail.com. Google says they do not apply to mail sent to Google Workspace accounts.
Google calls you a bulk sender if you send “close to 5,000 messages or more to personal Gmail accounts within a 24-hour period”. It counts all mail from the same primary domain, subdomains included. Once you have been a bulk sender, you stay one.
Every sender, since 1 February 2024
- SPF or DKIM for the sending domain.
- Valid forward and reverse DNS records (PTR records) for the sending servers.
- A TLS connection for sending.
- A spam rate below 0.3 percent, as Google Postmaster Tools reports it.
- Messages formatted to the Internet Message Format standard, RFC 5322.
- No From addresses that impersonate Gmail.
Bulk senders, on top of that
- Both SPF and DKIM.
- A DMARC record. In Google's words: “Your DMARC enforcement policy can be set to none.”
- For mail sent directly, the domain in the From address aligned with the SPF domain or the DKIM domain.
- One-click unsubscribe in marketing and subscribed messages, and a clearly visible unsubscribe link in the message body.
Google's FAQ says that from November 2025 Gmail is increasing its enforcement: “Messages that fail to meet the email sender requirements will experience disruptions, including temporary and permanent rejections.”
Yahoo
Yahoo's FAQ says its requirements apply to all domains and consumer email brands that Yahoo Mail hosts. Enforcement began in February 2024, and for the unsubscribe rule in June 2024.
Yahoo names no number for bulk senders: “A ‘bulk’ sender is classified as an email sender sending a significant volume of mail. We will not specify a volume threshold.”
Every sender
- SPF or DKIM, at a minimum.
- A spam rate below 0.3 percent.
- Valid forward and reverse DNS records for the sending servers.
- Mail that follows RFC 5321 and RFC 5322, the standards for sending and formatting email.
Bulk senders
- Both SPF and DKIM.
- A valid DMARC policy of at least p=none, and mail that passes DMARC. Yahoo strongly recommends a rua tag, so that you receive reports.
- The domain in the From address aligned with the SPF domain or the DKIM domain. Relaxed alignment is acceptable.
- One-click unsubscribe through a list-unsubscribe header in marketing and subscribed messages, a clearly visible unsubscribe link in the body, and unsubscribes honoured within 2 days.
- A spam rate below 0.3 percent, as for every sender.
Outlook.com
Microsoft's rules cover Outlook.com, its consumer service for hotmail.com, live.com and outlook.com addresses. They apply to domains that send more than 5,000 emails a day.
Since 5 May 2025
- SPF must pass for the sending domain.
- DKIM must pass.
- DMARC with a policy of at least p=none, aligned with SPF or DKIM, and preferably both.
In an update of 29 April 2025, Microsoft says it rejects messages that do not meet these requirements, with the error “550; 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level.” Other text in the same post says such messages go to the Junk folder first.
Microsoft also recommends a From or Reply-To address that can receive replies, working unsubscribe links, regular removal of invalid addresses, and accurate subject lines.
What this means for a small business
Count all your mail, not one tool's. Google counts every message your primary domain sends to personal Gmail accounts, so your newsletter, your invoices and your team's own mail add up.
Below their numbers, Google and Microsoft do not require DMARC of you. Yahoo names no number. Google and Yahoo ask every sender for SPF or DKIM.
A DMARC record with p=none is the record all three ask for. Its reports then show whether your mail passes DMARC: which services pass SPF and DKIM, and whether each pass aligns with your domain.
Some of the rules are outside DMARC: spam rates, unsubscribe links, reverse DNS and TLS. Those sit with your sending services and your mail server. Google Postmaster Tools shows the spam rate Gmail measures for your domain.
SPF, DKIM and DMARC together explains alignment and what to set up for each service.