Email Sender Requirements 2026: Gmail, Yahoo and Microsoft Rules Side by Side (Updated Monthly)

Last checked: 17 October 2026. This page is re-checked against the official Google, Yahoo and Microsoft documentation on the first business day of every month. Changes are logged below, including "no change" entries, so you know the date the table was last confirmed. As of the last check, no provider has announced new requirements for 2027; the rules below are the ones you will be held to going into the year.

Changelog

Who counts as a bulk sender

The thresholds look similar, but each provider defines them differently, and the difference matters when you decide which rules apply to you.

Google. You are a bulk sender if you send close to 5,000 messages or more to personal Gmail accounts within a 24-hour period. Three details trip people up:

• Messages to Google Workspace accounts do not count, and the sender guidelines "don't apply to messages sent to Google Workspace accounts." Postmaster Tools data likewise covers only personal Gmail.
• Messages sent from the same primary domain count toward the limit together. Google's own example combines solarmora.com with promotions.solarmora.com. Splitting mail across subdomains does not get you under the threshold.
• Bulk sender status is permanent. Once your domain has crossed the line, Google keeps applying the bulk requirements even on days when you send less.

Microsoft. The requirements apply to "domains sending more than 5,000 emails per day" to Outlook.com, which Microsoft describes as its consumer service covering outlook.com, hotmail.com and live.com addresses. Microsoft's FAQ adds that all senders benefit from the same practices, and that adding a sender to a Safe Senders list "won't be honored" as a bypass.

Yahoo. Yahoo's Sender Best Practices page separates "all senders" from "bulk senders" but does not publish a numeric threshold. If you send marketing or subscribed mail at any meaningful volume, treat yourself as a Yahoo bulk sender. Yahoo also notes that it limits messages per SMTP connection without publishing the number, and simply terminates the connection when you reach it.

The side-by-side table

Sources for every cell are listed at the end of the page. Where a provider does not state something, the cell says so rather than guessing.

Authentication: what each protocol has to do

SPF publishes which servers may send for your domain. Google and Yahoo require it for bulk senders; Microsoft says it "must pass." One practical trap Microsoft calls out in its FAQ: if your SPF record exceeds 10 DNS lookups, the check can fail even though every include is legitimate. Flatten the record or remove unused includes.

DKIM signs each message with a key published in DNS. Google requires a key of at least 1024 bits for mail to personal Gmail and recommends 2048. Yahoo recommends a 1024-bit minimum and asks that all mail be signed. Microsoft requires DKIM to pass. If you send through several systems, use separate selectors per system. Microsoft notes this helps "isolate reputation concerns across various business units or campaigns."

DMARC tells receivers what to do when SPF and DKIM fail and where to send reports. All three accept p=none as the minimum. That policy does nothing to your mail, so it is not a reason to delay. Yahoo adds that DMARC "must pass," which means at least one of SPF or DKIM has to pass and align. Google's FAQ lists a missing DMARC record under "Delivery support or mitigations unavailable," so a domain with no record at all cannot ask Google for help when something goes wrong. Microsoft advises moving from none to quarantine to reject gradually "to avoid unintended mail loss."

Alignment means the domain in the visible From header matches the domain that passed SPF or DKIM. Google is explicit that "only one of these needs to be aligned." Yahoo accepts relaxed alignment, so a subdomain match is fine. Microsoft asks for alignment with SPF or DKIM and prefers both. The common failure here is an ESP that signs with its own domain and sends from its own return path while your From header shows your brand: SPF and DKIM both pass, but neither aligns, and DMARC fails.

PTR and TLS. Google requires valid forward and reverse DNS for sending IPs and a TLS connection. Yahoo requires valid forward and reverse DNS and recommends PTR records that look like your domain rather than a dynamically assigned address. Both items are normally handled by your ESP, but they are worth confirming if you run your own infrastructure.

Message format. Google requires RFC 5322 formatting and forbids impersonating Gmail addresses in the From header. Yahoo requires compliance with RFC 5321 and 5322. Microsoft asks for a "compliant P2 (Primary) sender address," meaning the From or Reply-To address is valid, reflects the true sending domain and can receive replies.

Forwarding. Microsoft and Yahoo both recommend ARC (Authenticated Received Chain) if you forward mail or run mailing lists, because forwarding breaks alignment. If you don't forward, you can ignore this.

Spam rate rules

Google's number is the one most senders watch, because Postmaster Tools shows it. The rule has two levels: keep the user-reported spam rate below 0.10%, and never let it reach 0.30% or higher. Google calculates it daily and shows it in Postmaster Tools. Three things about this number are easy to misread:

1. It only counts personal Gmail accounts. Complaints from Workspace users don't appear, and Workspace recipients aren't covered by the guidelines.
2. On low-volume days the dashboard may show nothing. Google says data "might be missing if the total number of messages for a given day is too low," a privacy protection rather than a bug.
3. Crossing 0.3% has a lasting consequence. Since June 2024 a sender above 0.3% is ineligible for mitigation and only becomes eligible again when the rate "remains below 0.3% for 7 consecutive days." Fixing the cause and waiting a week is the minimum path back.

Yahoo also uses 0.3% but calculates it from mail delivered to the inbox, not from everything you sent. If you compute your own rate from your ESP's totals, you will usually get a lower number than Yahoo sees. Enroll in Yahoo's Complaint Feedback Loop for every DKIM domain so you see the complaints as they happen.

Microsoft publishes no threshold. It says it "reserves the right to take negative action, including filtering or blocking" for breaches of authentication or hygiene, and its recommendations focus on list hygiene and bounce management. Microsoft's own FAQ suggests cleaning inactive or invalid addresses "monthly or quarterly."

In practice the 0.1% / 0.3% pair is the standard to plan around for all three providers. One complaint per thousand delivered messages is the warning line. Three per thousand is the line you cannot cross.

One-click unsubscribe

This is the requirement with the most variation in the details, so the table row above deserves a closer look.

What it is. One-click unsubscribe means two headers in the message: List-Unsubscribe, which carries the unsubscribe URL, and List-Unsubscribe-Post with the value List-Unsubscribe=One-Click, which lets the mailbox provider send an HTTP POST to that URL when the user clicks the "Unsubscribe" link in the interface. The mechanism is RFC 8058. A visible unsubscribe link in the message body is required in addition to the headers, not instead of them.

Who must send it. Only marketing and subscribed messages. Transactional mail such as receipts, password resets and shipping notices is excluded by both Google and Yahoo.

Google. Required for bulk senders. A mailto: link alone does not satisfy the requirement. Google's FAQ states that messages without one-click unsubscribe "aren't automatically rejected or marked as spam," but the sender cannot receive mitigation. Google expects unsubscribe requests to be honored within two days. Senders that already had an unsubscribe link in their messages had until 1 June 2024 to add the headers.

Yahoo. Required for bulk senders. The RFC 8058 POST method is "highly recommended," and mailto: is acceptable. The unsubscribe link in the body may lead to a preference page, but the process must not require a login. Unsubscribes must be honored within two days.

Microsoft. Lists "functional unsubscribe links" as a hygiene recommendation, defined as a link that is "easy to find and reliable when clicked." Microsoft does not currently require the RFC 8058 headers.

With a third-party ESP. Google's advice is to check whether your provider supports adding the headers. Most major platforms do, but the setting is sometimes off by default for older accounts or for "transactional" message types that are actually marketing. Send a test to a Gmail address and look for the "Unsubscribe" link next to the sender name at the top of the message.

Enforcement timeline

Google describes its enforcement as "gradual and progressive," starting with temporary failures and moving to permanent failures or spam foldering if a sender does not fix the issue. "New" domains, meaning domains that did not send more than 5,000 daily messages to personal Gmail before 1 January 2024, follow an accelerated timetable. Microsoft's published notice is internally inconsistent on the junk-versus-reject question: the April update states that non-compliant messages will be rejected with 550 5.7.515 from 5 May 2025, while a later paragraph on the same page still describes junk-folder routing with rejection "in the future (date to be announced)." Senders on Microsoft Q&A have reported receiving the 5.7.515 rejection, so plan for rejection as the operative outcome.

What to expect in 2027

Nothing new has been announced for 2027 by any of the three providers as of the last check. What is pending is enforcement, not rules:

• Microsoft's rejection date. The April 2025 notice names the 550 5.7.515 rejection and 5 May 2025 as the start, but the same page still says a date for rejecting all non-compliant mail is "to be announced." Senders have reported rejections since 2025. Expect Microsoft to close the gap formally and to extend the same authentication expectations to lower-volume senders over time, since its FAQ already says "all senders benefit from these best practices."
• Google's old Postmaster Tools interface. Retirement was postponed after sender feedback but remains planned. The Domain and IP Reputation dashboards are being replaced. If your monitoring or alerts depend on the old reputation scale, rebuild them around spam rate, Compliance status and delivery errors before the switch is forced.
• Google's enforcement curve. The November 2025 ramp-up is described as "gradual and progressive," with an accelerated timetable for domains that only became bulk senders after 1 January 2024. Temporary 4.7.x rate limits are the early warning; permanent rejections follow if nothing changes.
• Engagement as a filter. Gmail's January 2026 inbox changes (AI summaries, "Manage subscriptions" with one-tap unsubscribe) are not sender requirements, but they make disengaged recipients easier to lose and more likely to complain. The practical 2027 rule is the same one the providers have been pushing since 2024: send to people who read, and stop sending to people who don't.

When any of these changes, it will appear in the changelog at the top of this page with the date and the source.

What rejection looks like: the error codes

When a provider refuses or delays your mail, the SMTP response tells you which requirement failed. These are the codes that matter for the sender requirements, as documented by each provider.

Google says temporary 4.7.x codes "indicate which sender requirement is causing the failure," which makes them the most useful diagnostic you have. Pull the exact response from your ESP's bounce logs rather than relying on the ESP's category label.

How to check your status

Google: Postmaster Tools v2. Verify your domain with a DNS TXT record (verification status can take up to 10 minutes to update). The Compliance status dashboard shows whether you meet each sender requirement: authentication and alignment, one-click unsubscribe, spam rate, DMARC. The Spam rate dashboard shows the daily user-reported rate. Remember that the data covers personal Gmail only and can be empty on low-volume days. Google has postponed the retirement of the old interface after sender feedback, but the Domain and IP Reputation dashboards are being retired and replaced, so build your monitoring around spam rate, compliance status and delivery errors rather than the old reputation scale. Our separate guide to Postmaster Tools v2 covers each dashboard.

Yahoo: Complaint Feedback Loop and Sender Hub. Enroll each DKIM domain in the CFL once you sign with DKIM. If you see the same deferral code consistently over an extended period, Yahoo asks you to submit a Sender Support Request with the specific error and diagnostic codes from your logs.

Microsoft: SNDS and JMRP. Smart Network Data Services shows complaint rates, spam trap hits and filtering results per sending IP. The Junk Mail Reporting Program sends you a copy of each message Outlook.com users mark as junk. Both are free and both require registration of your sending IPs.

Not sure which of these you actually pass? The Data & Deliverability Audit checks authentication, alignment, unsubscribe headers and spam-rate exposure across your sending domains, and shows which segments of your list are driving complaints. Request the audit →

Common failure modes we see

1. SPF and DKIM pass, DMARC fails. The ESP signs with its own domain and uses its own return path. Fix by setting up a custom DKIM selector and, where offered, a custom return-path domain on your own domain.
2. DMARC record exists but has no policy. Google's 4.7.31 fires when the record is missing or "doesn't specify a DMARC policy." A record without p= is as bad as no record.
3. One-click headers on some streams but not others. Marketing mail sent from an automation or "transactional" template that is really promotional goes out without the headers.
4. Subdomain accounting. A brand with three sending subdomains assumes each is under 5,000 a day. Google counts them together.
5. SPF over 10 lookups. Years of accumulated includes push the record over the limit and SPF returns a permanent error. Microsoft explicitly flags this one.
6. Spam rate spikes from an old segment. The authentication is perfect; the complaint rate jumps after a send to subscribers who haven't heard from you in a year. This is a list problem, not a configuration problem, and it is the most common way a compliant sender ends up above 0.3%. See the dormant list reactivation playbook before mailing a cold segment.

What to do if you're being rejected

1. Read the code, not the category. Get the raw SMTP response from your ESP's logs. A 4.7.3x from Google names the failing requirement. A 5.7.515 from Microsoft means authentication, full stop.
2. Fix authentication first. Confirm SPF, DKIM and DMARC pass and that the From domain aligns. Send a message to a Gmail address and read the "Show original" headers: you want spf=pass, dkim=pass and dmarc=pass with the right domains.
3. Pause marketing sends, not transactional ones. Keep receipts and password resets flowing. Stop promotional volume until the cause is fixed.
4. Cut to your engaged core. Send only to recipients who clicked or purchased in the last 30 to 90 days while reputation recovers.
5. Watch the spam rate for seven days. Google's mitigation eligibility requires seven consecutive days below 0.3%. Postmaster data lags, so expect several days before you see the effect of a change.
6. Do not switch domains or ESPs mid-recovery. A new domain starts with no reputation and, as a "new" domain, faces Google's accelerated enforcement timetable. Switching ESPs resets your data without fixing the cause.
7. Rebuild volume in steps. Expand the audience gradually and watch bounces and complaints at each step.

FAQ

Does the 5,000-message threshold include transactional email? For Google, yes. The count is all messages sent from your primary domain and its subdomains to personal Gmail accounts in a 24-hour period, regardless of type. The one-click unsubscribe requirement, however, applies only to marketing and subscribed messages, not to transactional ones.

Is DMARC with p=none enough? For the requirement itself, yes: Google, Yahoo and Microsoft all accept p=none as the minimum. Two caveats. Yahoo requires that DMARC actually pass, so one of SPF or DKIM must pass and align. And Google lists a missing DMARC record under "delivery support or mitigations unavailable," so publish the record even if you keep the policy at none.

Does bulk sender status expire if my volume drops? Not with Google. Once a domain has sent close to 5,000 messages a day to personal Gmail, Google continues to apply the bulk sender requirements. Microsoft and Yahoo do not say.

What happens if my spam rate goes above 0.3%? With Google you lose eligibility for mitigation until the rate stays below 0.3% for seven consecutive days, and enforcement escalates from temporary rate limits toward rejection or spam foldering. With Yahoo, sustained complaints trigger 421/451 deferrals. The usual cause is not authentication but sending to disengaged or stale addresses.

Is a mailto: unsubscribe link acceptable? Yahoo says yes, though it highly recommends the RFC 8058 POST method. Google says no: a mailto: link alone does not satisfy the one-click requirement. Use both headers, List-Unsubscribe with an HTTPS URL and List-Unsubscribe-Post: List-Unsubscribe=One-Click, and you satisfy both providers.

How often do these rules change? The core requirements have been stable since February 2024. What changes is enforcement: Microsoft moved from junk to rejection in 2025, and Google ramped up enforcement in November 2025. Google maintains a sender guidelines FAQ with the latest updates, Yahoo points senders to its postmaster blog, and Microsoft updates its Tech Community post. This page re-reads all of them monthly and records the result in the changelog above.

Sending at volume and need someone to watch these dashboards every day? Managed Mailing Ops runs sending infrastructure, volume pacing, monitoring and sender reputation support as an ongoing service. Talk to us about Managed Mailing Ops →

Sources

• Google, Email sender guidelines: https://support.google.com/a/answer/81126 (requirements for all senders and for 5,000+/day; spam rate; one-click unsubscribe; DKIM key length; TLS update dated Dec 2023)
• Google, Email sender guidelines FAQ: https://support.google.com/a/answer/14229414 (bulk sender definition; subdomains; Workspace exclusion; mitigation eligibility; November 2025 enforcement ramp-up; temporary error codes 4.7.23–4.7.32)
• Google, Get started with Postmaster Tools: https://support.google.com/mail/answer/9981691 (personal Gmail scope; low-volume data gaps; verification timing)
• Google, Learn about the deprecation of the old Postmaster Tools interface: https://support.google.com/mail/answer/16594218 (retirement postponed; reputation dashboards retired; Compliance status)
• Google, Gmail API release notes: https://developers.google.com/workspace/gmail/release-notes (Postmaster Tools API v2 GA 3 February 2026; compliance status verdict preview 13 May 2026)
• Yahoo, Sender Best Practices: https://senders.yahooinc.com/best-practices/ (all-sender and bulk-sender requirements; 0.3% measured on inbox-delivered mail; two-day unsubscribe; mailto: acceptable; CFL; ARC)
• Yahoo, SMTP Error Codes: https://senders.yahooinc.com/smtp-error-codes/ (421/451 temporary; 553/554 permanent; causes)
• Microsoft, Strengthening Email Ecosystem: Outlook's New Requirements for High-Volume Senders, Microsoft Defender for Office 365 Blog, published 2 April 2025, version 4.0 updated 30 April 2025: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook’s-new-requirements-for-high‐volume-senders/4399730 (5,000/day; SPF, DKIM, DMARC p=none aligned; 550 5.7.515; hygiene recommendations; FAQ)
• Microsoft, Outlook.com Postmaster: https://sendersupport.olc.protection.outlook.com/pm/policies (enforcement from 5 May 2025; junk then rejection)
• Microsoft Q&A threads reporting 550 5.7.515 rejections (community reports, not official documentation)
• Gmail January 2026 inbox features (AI summaries, Manage subscriptions): reported by Google and covered by Klaviyo, Attentive and Tom's Guide, January 2026

---