InboxRatio
Check your domain

Email sender requirements: the rules Gmail, Yahoo and Outlook now enforce

Last reviewed:

Between October 2023 and May 2025, the three largest mailbox providers stopped publishing sender guidance and started publishing sender requirements — rules with enforcement dates and error codes attached. Google and Yahoo moved first, in a deliberately coordinated announcement; Microsoft completed the set in 2025. The result is something the email ecosystem never had before: a de facto common rulebook. Authenticate with SPF and DKIM, publish an aligned DMARC record, support one-click unsubscribe, keep complaints under a published ceiling — or watch your mail get filtered and then rejected, with a documented error code telling you which rule you broke.

This page is the consolidated view: what all three providers require, where their rules genuinely differ, and when each requirement took effect. Every threshold below comes from the providers' own published documentation — Google's Email sender guidelines, Yahoo's Sender Hub, Microsoft's Outlook.com Postmaster pages — re-verified on the date shown at the top of this page. For the full per-provider detail, including complete error-code tables, each provider has its own deep dive: Gmail, Outlook and Yahoo.

The common core

Strip away the provider-specific wording and the same five obligations appear in all three rulebooks:

  1. Authenticate with both SPF and DKIM. All three providers accept either protocol from small senders; all three require both from bulk senders.
  2. Publish a DMARC record — p=none is enough, alignment is not optional. Every provider accepts a monitoring-only policy. Every provider separately requires that the From: header domain align with the SPF or DKIM domain, which is the clause third-party sending platforms fail on.
  3. Support one-click unsubscribe. Gmail and Yahoo name RFC 8058 and the list-unsubscribe header explicitly; Microsoft states the requirement functionally — the unsubscribe mechanism must be clearly documented and easy to find and use.
  4. Keep complaints down. Gmail and Yahoo publish the same number: spam rate below 0.3%. Microsoft publishes no number but blocks on complaints all the same (error SC-004).
  5. Get the plumbing right. Valid forward and reverse DNS (PTR records) for sending IPs, TLS for transmission, and RFC 5321/5322-compliant message formatting.

A sender who builds to this core is, in our reading of the three rulebooks, simultaneously compliant with the letter of all of them. The differences that remain — and they matter operationally — are in thresholds, deadlines and instrumentation, which is what the table below is for.

The reference table

Requirements as published in each provider's documentation, verified on the review date at the top of this page:

| Requirement | Gmail | Yahoo | Outlook.com | |---|---|---|---| | Bulk-sender threshold | 5,000+ msgs/day to Gmail accounts; status is permanent once crossed | None published — "significant volume," deliberately unspecified | More than 5,000 emails/day to Outlook.com accounts | | SPF / DKIM (all senders) | SPF or DKIM | SPF or DKIM | rDNS and IP rules published; authentication mandate written against the 5,000/day tier | | SPF / DKIM (bulk) | Both required | Both required | Both required (full SPF, DKIM, DMARC compliance) | | DKIM key minimum | 1024-bit (2048 recommended) | 1024-bit | Not specified | | DMARC minimum (bulk) | Publish a record; p=none accepted | At least p=none — and DMARC must pass | At least p=none; p=reject recommended | | DMARC alignment | Required (From: aligns with SPF or DKIM domain) | Required | Required | | One-click unsubscribe | Required for bulk (RFC 8058) | Required for bulk (RFC 8058) + visible link in body | Functional standard: documented, easy to find and use | | Unsubscribe deadline | Within 48 hours (per Google's FAQ) | Within 2 days | Not specified | | Spam-rate ceiling | Below 0.3% (applies to all senders); stay under 0.1% | Below 0.3% (applies to all senders) | Not published | | TLS | Required | Not stated as a numbered requirement | Not stated as a numbered requirement | | Valid PTR / reverse DNS | Required | Required | Required; dynamic IP space may be refused | | Connection limits | Rate limiting by behavior (421 4.7.x) | Rate limiting by behavior (TS deferrals) | Hard cap: max 500 simultaneous connections | | Sender telemetry | Postmaster Tools (spam rate, reputation) | Complaint Feedback Loop (ARF reports, keyed to DKIM domain) | SNDS (IP telemetry) + JMRP (feedback loop) | | Signature rejection code | 550 5.7.26 / 421 4.7.x family | TS/PH deferral classes | 550 5.7.515 |

Three rows deserve a second look, because they are where the providers genuinely diverge rather than rephrase each other.

The bulk-sender threshold. Google and Microsoft draw the same line at the same number — 5,000 messages per day, counted against each provider's own mailboxes. Yahoo pointedly refuses to draw one: its FAQ defines a bulk sender as one sending "a significant volume of mail" and states it will not specify a threshold. Two corollaries follow. If you plan around the 5,000 number, you are planning for two providers out of three; the only threshold that satisfies all three rulebooks simultaneously is treating every systematic sending program as bulk. And at Gmail the number is sticky — per Google's FAQ, a domain that crosses the line once is a bulk sender permanently, subdomains counted together under the primary domain.

The complaint ceiling. Gmail and Yahoo publish the identical number — complaint rate below 0.3% — but attach it differently. Yahoo applies it to all senders as a baseline requirement. Google applies it to everyone too, but adds a second level: aim below 0.1%, because at 0.3% or above a bulk sender loses eligibility for mitigation until the rate has stayed below the ceiling for 7 consecutive days. Microsoft publishes no number at all — the complaint-driven block (550 SC-004) is real, the threshold is internal. The operational conclusion is the same for all three: treat 0.1% as the working target and 0.3% as the cliff edge, and the unpublished Microsoft threshold takes care of itself.

The DMARC wording. All three set the same floor (p=none, aligned), but the flavor text differs in ways that predict where each provider is heading. Yahoo requires that DMARC pass on real mail — a published record whose alignment fails does not satisfy the requirement. Microsoft is the only one of the three whose policy page recommends p=reject outright. Google stops at "publish a record" but enforces alignment as a separate clause. If your record is still p=none years after publishing it, the direction of travel is visible in Microsoft's wording; our DMARC setup guide covers the path from monitoring to enforcement.

What changed when

The requirements arrived in waves, and the dates matter because each one converted a best practice into a rejection code:

| When | What changed | |---|---| | October 2023 | Google and Yahoo jointly announce bulk-sender requirements — authentication, one-click unsubscribe, complaint ceiling — with enforcement set for the following year | | February 2024 | Enforcement begins at both Gmail and Yahoo. Gmail starts with rate-limiting unauthenticated traffic (421 4.7.26); Yahoo rolls out gradually per its Sender Hub | | June 2024 | Yahoo begins enforcing the one-click unsubscribe requirement (RFC 8058) | | August 1, 2024 | Yahoo completes its Complaint Feedback Loop database migration — senders who did not re-register stopped receiving ARF complaint reports | | Spring 2025 | Microsoft announces "Strengthening the Email Ecosystem": SPF, DKIM and DMARC become mandatory for domains sending 5,000+ emails/day to Outlook.com | | May 5, 2025 | Outlook.com enforcement begins — non-compliant high-volume mail is routed to junk folders | | Later 2025 | Microsoft's rejection phase: non-compliant mail refused outright with 550 5.7.515 | | November 2025 | Per Google's sender guidelines FAQ, Gmail ramps up enforcement on non-compliant traffic again |

The pattern across all three providers is identical: announce, filter to junk, then reject. Every provider gave senders a grace window between the junk-folder phase and the rejection phase — and every error-code table now contains the code that marks the window's end.

Beyond the big three

Apple's iCloud Mail publishes sender guidance too — a single postmaster page with a best-practices list, but no volume threshold, no numeric complaint ceiling and no feedback loop. It is a materially thinner rulebook than the three above, and we cover exactly what it does and does not document in our iCloud Mail sender guidance page. The short version: a sender meeting the big-three requirements above also satisfies everything Apple asks for.

The compliance checklist

Collapsing the three rulebooks into one working list — each item links to the tool that verifies it:

  1. SPF passes for every service sending as your domain — check with the SPF checker.
  2. DKIM signs everything with a key of 1024 bits minimum, 2048 preferred, under a domain you control.
  3. DMARC published and aligned — at least p=none, with the From: domain aligning to SPF or DKIM on real mail. Verify with the DMARC checker, or run all three protocols in one pass through the email authentication checker.
  4. One-click unsubscribe headers present (List-Unsubscribe + List-Unsubscribe-Post) plus a visible link in the body — confirm on a delivered message with the header analyzer.
  5. Unsubscribes processed within 2 days — Yahoo's deadline is the tightest published, so it is the one to build to.
  6. Complaint rate below 0.1% as the working target, with provider telemetry claimed before you need it: Postmaster Tools at Google, CFL enrollment at Yahoo, SNDS and JMRP at Microsoft.
  7. Reverse DNS valid for all sending IPs — check with the reverse DNS checker — and TLS on every connection.
  8. List hygiene running continuously — suppress hard bounces on first occurrence and remove never-engagers, because both complaint rates and bounce behavior feed every provider's reputation model.

For an outside-in read of where a domain stands on the technical items, our deliverability score checks the DNS-visible requirements in one pass.

Frequently asked questions

Are the sender requirements the same at Gmail, Yahoo and Outlook?

The core is the same — SPF and DKIM for bulk senders, DMARC at p=none minimum with alignment, one-click unsubscribe, complaint control, valid reverse DNS. The differences are at the edges: Yahoo publishes no bulk threshold where Google and Microsoft say 5,000/day; Microsoft publishes no complaint ceiling where Google and Yahoo say 0.3%; Microsoft alone recommends p=reject and caps simultaneous connections at 500.

What volume makes me a bulk sender?

At Gmail and Outlook.com, more than 5,000 messages per day to that provider's accounts — counted per primary domain at Gmail, where the status is also permanent once reached. Yahoo declines to publish a number. Since the stricter requirements are cheap to meet and every provider is converging on them, the practical answer is to treat any systematic sending program as bulk everywhere.

Do I need a DMARC policy of p=reject to comply?

No. All three providers accept p=none as the minimum policy. But alignment must actually work at all three, Yahoo requires DMARC to pass on real mail, and Microsoft's postmaster policies explicitly recommend p=reject — so enforcement is where the ecosystem is pointed, even if it is not yet the floor.

What complaint rate do mailbox providers allow?

Gmail and Yahoo both publish 0.3% as the ceiling, and Google adds 0.1% as the level to stay under — with mitigation eligibility lost at 0.3% and only restored after 7 consecutive days back below it. Microsoft publishes no number; its complaint block (SC-004) fires on an internal threshold. Building to 0.1% satisfies every published and unpublished line at once.

Is one-click unsubscribe legally required or provider-required?

These pages track provider requirements, not law. Gmail and Yahoo require RFC 8058 one-click unsubscribe from bulk senders as a condition of delivery — Yahoo also requires a visible link in the body and honoring within 2 days, Google's FAQ says within 48 hours. Microsoft requires an unsubscribe mechanism that is documented and easy to use. Whatever your legal obligations add on top, the provider rules are enforced by filters, not courts, and they act faster.

Where do I see each provider's full error-code list?

In the per-provider deep dives, each with the complete documented table: Gmail sender requirements (the 421 4.7.x / 550 5.7.x series), Outlook sender requirements (RP/SC/DY/OU families and 550 5.7.515), and Yahoo sender requirements (TS/PH deferral classes and retry semantics).

Sources

All requirements above were verified against the providers' own documentation on the review date shown at the top of this page:

The convergence is the story: three providers, one rulebook, and a shrinking set of excuses for failing it. Run your domain through the email authentication checker and the checklist above — if all eight items pass, you meet the published requirements of every major mailbox provider at once.