Autonomics AI Get a free audit
Menu

Gmail, Yahoo and Outlook sender requirements, in plain English

The three biggest mailbox providers junk or refuse mail from domains without proper authentication. Here's what each one asks for, without the jargon.

Written by Sean Solano Paul, founder of AutonomicsAI LLP. Checked against provider documentation on .

Since February 2024, Gmail and Yahoo have required authentication from everyone who sends to their users, with extra rules for bulk senders. Microsoft followed for Outlook.com, Hotmail and Live addresses: from 5 May 2025, domains sending more than 5,000 messages a day there must pass SPF, DKIM and DMARC. Mail that doesn't comply goes to junk and can be refused with the error 550 5.7.515.

Every sender

  • SPF or DKIM passing for your domain. Both is better.
  • Valid forward and reverse DNS (PTR) for the sending IP. Your mail provider handles this unless you run your own server.
  • TLS on the connection.
  • A spam complaint rate below 0.3%, as Gmail measures it in Postmaster Tools. Aim for under 0.1%.
  • Correctly formatted messages (RFC 5322), and no pretending to be a Gmail address in the From line.

Bulk senders

Google treats you as a bulk sender once you've sent close to 5,000 messages to personal Gmail accounts in a day, and the label sticks. On top of the list above, bulk senders need:

  • SPF and DKIM passing.
  • A DMARC record. p=none is enough.
  • The From domain aligned with the SPF or the DKIM domain, so DMARC passes.
  • For marketing and subscribed mail: one-click unsubscribe (the List-Unsubscribe-Post header from RFC 8058) plus a visible unsubscribe link, with requests honoured within two days.

What Outlook.com asks of big senders

Microsoft's rule covers domains sending more than 5,000 messages a day to its consumer mailboxes: SPF passing, DKIM passing, and a DMARC record of at least p=none aligned with SPF or DKIM, preferably both. Microsoft also recommends working unsubscribe links, list hygiene and a reply-to address someone reads.

Quick checklist

  1. One SPF record, under 10 lookups, covering every service that sends as you.
  2. DKIM on for every sending service, signing with your domain.
  3. A DMARC record with a report address.
  4. One-click unsubscribe on marketing mail.
  5. Gmail Postmaster Tools set up for your domain, so you can see your complaint rate.

Items 1 to 3 are what our checker reads. Items 4 and 5 live outside DNS.

Questions people ask

I send far fewer than 5,000 a day. Does this apply to me?

The every-sender rules do. SPF, DKIM and DMARC are cheap to set up and help any domain's mail get through, so do all of it anyway.

Does cold email count as bulk?

Volume decides, not the type of mail. Complaint rates matter for everyone, and cold email tends to draw more complaints, so the 0.3% ceiling is the number to watch.

DNS only shows part of the picture. If mail is still landing in spam with every record right, the deliverability audit looks at the rest: blocklists, reputation, bounces, content and the sending setup.