# What Gmail, Yahoo and Outlook Require From Email Senders Canonical page: https://sunlocke.com/articles/gmail-yahoo-sender-requirements Page type: article ## Summary Gmail, Yahoo and Outlook.com each publish rules for commercial email, and they do not match. What each provider requires as of October 2026, where they differ, and the monthly check that keeps a small sender compliant. The three largest consumer inboxes agree on how a sender proves its identity and disagree on volume limits, unsubscribe methods and what happens to senders who fall short. Gmail, Yahoo and Outlook agree on how a sender proves who it is and disagree on much of the rest. A small business is safest meeting the large sender standard from its very first campaign. ## Article details The three largest consumer inboxes agree on how a sender proves its identity and disagree on volume limits, unsubscribe methods and what happens to senders who fall short. ## Main point Gmail, Yahoo and Outlook agree on how a sender proves who it is and disagree on much of the rest. A small business is safest meeting the large sender standard from its very first campaign. Author: Chris Martinez Section: Business Post type: Playbook Story format: standard ## Article content When a message to a personal Gmail address fails Google's sender rules, it can come back with a code that names the problem. A 4.7.30 means DKIM did not pass. A 4.7.32 means the domain in the From line does not match the domain that authenticated the message. Google's sender FAQ says it began ramping up enforcement in November 2025, and that messages failing its requirements will see disruptions, including temporary and permanent rejections. Gmail is one of three large consumer inboxes that publish rules for commercial senders. Yahoo and Microsoft's Outlook.com are the others. The three overlap on authentication and diverge on almost everything else: who counts as a large sender, how unsubscribing must work, how fast it must happen, and what a sender loses by falling short. The rules below are taken from each provider's own pages as they read on October 15, 2026. Providers change enforcement without waiting for a new year, so each section names the page it comes from. The [2025 version of this explainer](/articles/what-inbox-providers-now-require-2025) remains as a record of how the rules read then. ## Gmail sets one floor for everyone and a higher one for bulk senders Google's email sender guidelines apply to mail sent to personal Gmail accounts, meaning addresses ending in gmail.com or googlemail.com. They do not apply to mail sent to Google Workspace accounts, which many businesses use for their own email. Since February 1, 2024, every sender to Gmail must set up SPF or DKIM, keep valid forward and reverse DNS for its sending servers, send over a TLS connection, format messages to the internet message standard, avoid impersonating Gmail in the From line, and keep the spam rate shown in Google Postmaster Tools below 0.3 percent. The guidelines add a stricter target: stay below 0.1 percent and never reach 0.3. Google's FAQ defines a bulk sender as one that sends close to 5,000 messages or more to personal Gmail accounts within 24 hours. Mail from subdomains counts toward the same total. Google's example is 2,500 messages from a store's main domain and 2,500 from its promotions subdomain on the same day, which together make the store a bulk sender. The status is permanent. Google says it has no expiration date and changes in sending practice will not remove it. Bulk senders must also authenticate with both SPF and DKIM, publish a DMARC record (a policy of none is enough), align the domain in the From line with the SPF or DKIM domain, and support one click unsubscribe in marketing and subscribed messages while also showing a clearly visible unsubscribe link in the body. Google requires DKIM keys of at least 1,024 bits and recommends 2,048. ## What Gmail does when a sender falls short The FAQ includes a table that sorts failures into two kinds, and the split tells a small business what to fix first. Failures of identity and setup affect delivery directly. Mail not authenticated with both SPF and DKIM, a From domain that does not align, broken forward and reverse DNS, no TLS, or malformed messages can draw temporary or permanent failure codes, or send mail to spam. Failures of list practice cost the sender Google's help. A spam rate above 0.3 percent, a missing DMARC record, marketing messages without one click unsubscribe, and unsubscribe requests not honored within 48 hours make a bulk sender ineligible for what Google calls mitigation, its support process for delivery problems. A sender above 0.3 percent becomes eligible again only after its rate stays below that line for seven consecutive days. Google says it does not automatically reject or spam messages for lacking one click unsubscribe, though unwanted mail without it draws more spam reports. The categories are not perfectly separate. Google's list of error codes includes 4.7.31, which rate limits a message because the sending domain has no DMARC record or the record names no policy. A missing record can slow mail as well as cost support. ## Yahoo publishes the rules but not the threshold Yahoo's Sender Hub lists requirements for all senders: authenticate with SPF or DKIM at a minimum, keep the spam rate below 0.3 percent, maintain valid forward and reverse DNS, and comply with the internet standards for mail transfer and message format. Its bulk sender list closely tracks Google's. Bulk senders must use both SPF and DKIM, publish a DMARC policy of at least none that passes, and align the From domain with the SPF or DKIM domain; Yahoo accepts relaxed alignment and strongly recommends a reporting address in the DMARC record. They must support one click unsubscribe through the List Unsubscribe header for marketing and subscribed messages, show a visible unsubscribe link that may lead to a preference page, honor unsubscribes within two days, and keep spam below 0.3 percent. Yahoo calculates that rate on mail delivered to the inbox, so a sender's own arithmetic may not match it. Yahoo publishes no number. Its FAQ says a bulk sender sends a significant volume of mail and that Yahoo will not specify a volume threshold. It judges senders at the level of the authenticated domain or the From domain, and spoofed mail sent in a domain's name counts toward the volume Yahoo reviews. Yahoo phased in enforcement starting in February 2024 and began enforcing one click unsubscribe in June 2024. ## Outlook.com's rules for high volume senders Microsoft announced its rules on April 2, 2025, in a post on its Defender for Office 365 blog. They cover Outlook.com, the consumer service behind hotmail.com, live.com and outlook.com addresses, and apply to domains sending more than 5,000 emails a day. Those domains must pass SPF, pass DKIM, and publish DMARC with a policy of at least none, aligned with SPF or DKIM and preferably both. Microsoft's statements about the penalty conflict. An update to the post dated April 29, 2025, says Microsoft decided to reject noncompliant messages with the error 550 5.7.515 starting May 5, 2025. The same post still says such mail would first go to junk, and Microsoft's Postmaster policies page, checked October 15, 2026, also says noncompliant mail goes to the junk folder and may be rejected if problems continue. A sender should plan for rejection. Microsoft also says adding a sender to a recipient's safe senders list will not bypass enforcement. Microsoft lists further practices as recommendations rather than requirements: a From or Reply To address that is valid and can receive replies, a functional unsubscribe link, regular removal of invalid addresses, and accurate subject lines sent only to people who consented. It also says it may filter or block senders that fall short, especially for serious lapses in authentication or hygiene. The post publishes no complaint rate ceiling and no unsubscribe deadline. Microsoft's Postmaster policies page says the 5,000 counts mail sent to Outlook.com accounts. ## Where Gmail, Yahoo and Outlook sender requirements differ They differ in five places: * Threshold. Gmail uses close to 5,000 messages to personal Gmail accounts in 24 hours, counted across a primary domain, and the label is permanent. Outlook.com uses more than 5,000 a day to Outlook.com accounts. Yahoo publishes none. * Unsubscribe method. Google requires List Unsubscribe headers with an HTTPS address and says a mailto link does not meet its one click requirement. Yahoo calls the RFC 8058 POST method highly recommended and mailto acceptable. Microsoft asks for a functional link. * Unsubscribe speed. Google recommends 48 hours and ties support eligibility to it. Yahoo requires two days. Microsoft names no deadline. * Complaints. Gmail and Yahoo both draw the line at 0.3 percent, measured differently. Microsoft's post sets no figure. * Consequence. Gmail can defer, reject or spam failing mail and withdraws support for poor list practice. Yahoo says mail that misses its requirements may go to spam or be rejected. Microsoft says it will reject or junk high volume mail that fails authentication and reserves the right to filter or block senders for serious hygiene problems. A practitioner's recommendation is to build once to the strictest version of each rule: SPF and DKIM on every sending system, a DMARC record with reports, alignment, HTTPS one click unsubscribe, and suppression within two days. Meeting the bulk standard from the first campaign spares a small business from watching for a line it may cross without notice. Gmail's count includes every subdomain and does not reset, Yahoo has no line to watch, and volume can cross Gmail's line in a single day. A hypothetical store with 2,000 Gmail addresses on its list that sends three messages on Black Friday has sent 6,000 messages to personal Gmail accounts in 24 hours, and under Google's rules the bulk label then stays. ## What one click unsubscribe means in the message The one click unsubscribe Gmail and Yahoo describe comes from RFC 8058, an internet standard. A message carries two headers. The List Unsubscribe header must contain one HTTPS address. A second header, List Unsubscribe Post, tells the mailbox provider it may send an automatic request to that address. The standard requires a valid DKIM signature that covers both headers, forbids the sender from answering the request with a redirect, and bars cookies or login details from the request. The footer link still matters, because a person reading the message needs a visible way out, and both Google and Yahoo allow it to lead to a preference page. It does not satisfy the requirement on its own. An email platform may add the headers automatically; the test that follows shows whether they work. To check, unsubscribe from a real Gmail, Yahoo and Outlook.com inbox and confirm each address is suppressed in the sending platform within two days. Gmail also says its own unsubscribe button appears at the top of a message only for senders that pass its eligibility checks, so a missing button is not proof the headers are absent. ## A monthly email deliverability check A business adds a booking tool, a review request service or a second store, and each one can start sending as the company domain without anyone updating DNS. Six checks, done once a month, look for those gaps: * Read the spam rate and compliance status in Google Postmaster Tools. It reports only on mail to personal Gmail accounts and may show nothing on low volume days. * Read the DMARC aggregate reports for any source sending as the domain that nobody recognizes. * List every system that sends as the business and confirm each one signs with DKIM and aligns with the From domain. * Repeat the unsubscribe test at all three providers. * Review bounce messages for codes that name a requirement, such as Gmail's 4.7 and 5.7 series or Outlook.com's 550 5.7.515. * Confirm every DKIM domain is enrolled in Yahoo's Complaint Feedback Loop, which Yahoo says is needed to process complaints quickly. [The CAN SPAM guide](/articles/can-spam-act-compliance) lists what federal law requires of a commercial message. Before a seasonal push, a sender should also [clean the list](/articles/clean-email-list-before-black-friday) and [raise volume gradually](/articles/email-warm-up-before-black-friday), as Google's guidelines recommend for any sender without a history of large sends. If the routine turns up an unsigned receipt system or a broken unsubscribe endpoint, the business learns it from a report rather than from a 550 code during Black Friday week. Source: Gmail Help: Email sender guidelines Requirements for all senders from February 1, 2024 (SPF or DKIM, forward and reverse DNS, TLS, message format, spam rate below 0.3 percent, no Gmail From impersonation); bulk requirements (SPF and DKIM, DMARC with policy none allowed, alignment, one click unsubscribe plus visible link); DKIM key of 1,024 bits minimum, 2,048 recommended; 0.1 percent target; gradual volume increases; personal Gmail definition. Opened and read October 15, 2026. Reference: https://support.google.com/a/answer/81126 Source: Gmail Help: Email sender guidelines FAQ November 2025 enforcement ramp with temporary and permanent rejections; bulk sender definition (close to 5,000 to personal Gmail in 24 hours, primary domain counting, subdomain example, permanence); Workspace recipients excluded; enforcement table; 48 hour unsubscribe recommendation; seven consecutive days below 0.3 percent; one click not enforced by rejection; mailto does not meet one click; error codes 4.7.30, 4.7.31, 4.7.32; top of message unsubscribe eligibility. Opened and read October 15, 2026. Reference: https://support.google.com/a/answer/14229414 Source: Yahoo Sender Hub: Sender Requirements and Recommendations All sender and bulk sender requirements, relaxed alignment, reporting address recommendation, RFC 8058 POST method highly recommended and mailto acceptable, two day unsubscribe, 0.3 percent spam rate calculated on inbox delivered mail, February 2024 gradual enforcement, Complaint Feedback Loop for all DKIM domains. Opened and read October 15, 2026. Reference: https://senders.yahooinc.com/best-practices/ Source: Yahoo Sender Hub: FAQs Yahoo will not specify a bulk volume threshold; mail that misses the requirements may be sent to spam or rejected; senders judged at the authenticated or From domain; spoofed mail counts; one click enforcement from June 2024; unsubscribe not honored in two days does not meet the requirement; one click required only for promotional mail. Opened and read October 15, 2026. Reference: https://senders.yahooinc.com/faqs/ Source: Microsoft Defender for Office 365 Blog: Outlook's New Requirements for High Volume Senders Posted April 2, 2025, updated April 29 and 30, 2025: Outlook.com consumer domains, more than 5,000 emails a day, SPF and DKIM pass, DMARC at least none aligned, rejection with 550 5.7.515 from May 5, 2025, leftover junk folder paragraph, safe senders not honored, recommended practices, and the right to filter or block senders for serious lapses. Opened and read October 15, 2026. Reference: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook%E2%80%99s-new-requirements-for-high%E2%80%90volume-senders/4399730 Source: Outlook.com Postmaster: Policies, Practices, and Guidelines Effective May 5, 2025, domains sending more than 5,000 emails a day to Outlook.com accounts must comply with SPF, DKIM and DMARC; noncompliant mail goes to the junk folder and may be rejected with 550 5.7.515 if issues remain. The old sendersupport.olc.protection.outlook.com address now redirects here. Opened and read October 15, 2026. Reference: https://substrate.office.com/ip-domain-management-snds/postmaster/policies Source: RFC 8058: Signaling One Click Functionality for List Email Headers One HTTPS address in the List Unsubscribe header, the List Unsubscribe Post header, DKIM signature covering both headers, no redirects, no cookies or authorization in the request. Opened and read October 15, 2026. Reference: https://www.rfc-editor.org/rfc/rfc8058.html ## Related services * [Email & SMS Marketing](/email-sms): Follow-up that runs while you work ## Next action Check my sending setup: /email-sms