Gmail, Yahoo and Outlook sender requirements: what you need
Gmail, Yahoo and Outlook.com now require SPF, DKIM and DMARC from bulk senders, and reject mail that falls short. The rules side by side, and what to do.
If you send more than about 5,000 messages a day to Gmail, Yahoo or Outlook.com addresses, all three now require SPF, DKIM and a DMARC record, with your From domain aligned to at least one of them. A DMARC policy of p=none is enough to meet the rule. Smaller senders still need SPF or DKIM. Mail that falls short is no longer just filtered to spam: all three providers now reject it outright.
Why this changed
For years, authentication was a best practice. In February 2024, Google and Yahoo made it a requirement for anyone sending to their consumer mailboxes, and Microsoft followed for Outlook.com, Hotmail.com and Live.com in May 2025. The goal is simple: if mailbox providers can tie every message to a domain that has proved it is genuine, spoofing and spam get much harder to hide.
The good news is that the requirements line up closely. Meet one provider’s rules and you have met nearly all of the others.
The rules side by side
| Requirement | Gmail | Yahoo | Outlook.com |
|---|---|---|---|
| Applies to | All senders, stricter at bulk | All senders, stricter at bulk | Over 5,000 messages a day |
| Bulk threshold | About 5,000 a day to personal Gmail | Not published | 5,000 a day |
| SPF and DKIM (bulk) | Both | Both | Both |
| SPF or DKIM (everyone) | Required | Required | Not specified |
| DMARC record (bulk) | At least p=none | At least p=none, must pass | At least p=none |
From aligned with SPF or DKIM (bulk) | Required | Required | Required |
| One-click unsubscribe (bulk marketing) | Required (RFC 8058) | Required | Recommended |
| Spam complaint rate | Below 0.3%, aim for 0.1% | Below 0.3% | Not specified |
| Valid forward and reverse DNS | Required | Required | Not specified |
A few specifics behind the table:
- Gmail counts by domain. Its threshold is close to 5,000 messages to personal Gmail accounts (
@gmail.comand@googlemail.com) within 24 hours, and messages from the same primary domain count together. Once you are classed as a bulk sender, the status does not expire. - Unsubscribes have a deadline. Gmail and Yahoo both expect unsubscribe requests to be honored within two days.
- Gmail also requires TLS for the connection, and messages formatted to the email standard (RFC 5322).
What happens if you fall short
All three have moved from warnings to rejections.
- Gmail says that from November 2025 it is ramping up enforcement, and non-compliant messages see temporary and permanent rejections.
- Yahoo phased enforcement in through the first half of 2024.
- Outlook.com rejects non-compliant bulk mail with the error
550 5.7.515 Access denied, sending domain does not meet the required authentication level. Microsoft originally said such mail would go to Junk, then changed that to an outright rejection from May 2025.
If you see 5.7.515 bounces, or a sudden drop in opens from Gmail or Outlook addresses, missing authentication is the first thing to check.
What to do
For most organizations, meeting the requirements comes down to four steps:
- Publish SPF for every service that sends as your domain, staying within the 10 DNS lookup limit.
- Set up DKIM with your own domain in each sending service, so the signature aligns with your From address. This is the step most often missing on marketing and CRM platforms.
- Publish a DMARC record with at least
p=noneand a reporting address. Our guides for Microsoft 365 and Google Workspace cover the exact records. - Add one-click unsubscribe to marketing mail. Most email platforms do this for you once you turn it on.
p=none is the floor, not the goal
The providers accept p=none because it proves you have DMARC set up and are collecting reports. It does nothing to stop someone forging your domain, because it tells receivers to deliver failing mail anyway. Treat the requirement as the starting line: use the reports it switches on to find every legitimate sender, fix them, and then move to p=reject, which is what actually protects your customers from mail that impersonates you.
Not sure where your domain stands? The DMARC checker shows your policy and SPF in seconds, and the DKIM checker confirms each sending service’s key.