Gmail, Yahoo and Microsoft sender requirements

Set up SPF or DKIM, add DMARC once volume rules apply, and keep complaints low. Gmail and Yahoo require both SPF and DKIM, plus DMARC, for bulk senders. Microsoft requires all three for high-volume domains sending to its consumer email services. A password reset is not exempt from authentication. Gmail and Yahoo exempt it from one-click unsubscribe, while Microsoft recommends visible, functional unsubscribe links, particularly for marketing and bulk mail.

The FAQ calls a bulk sender anyone who sends "close to 5,000 messages or more to personal Gmail accounts within a 24-hour period." The guidelines also say "more than 5,000 messages per day". Messages from the same primary domain count together, so 2,500 from solarmora.com and 2,500 from promotions.solarmora.com are one sender. Gmail's bulk-sender classification is permanent once assigned. Yahoo's FAQ says a bulk sender sends "a significant volume of mail" and that Yahoo "will not specify a volume threshold." Microsoft's policies specify more than 5,000 emails a day to Outlook.com accounts, and its NDR guide specifies 5,000 or more from one From domain.

Who the rules cover

Gmail's guidelines cover @gmail.com and @googlemail.com. They do not apply to mail sent to Google Workspace accounts, and they do apply when a Workspace user sends to a personal Gmail account. Yahoo covers "all domains and consumer email brands hosted by Yahoo Mail." Yahoo Japan is a separate entity. Spoofed mail counts, and Yahoo views the sender at the authenticated domain or the From domain. Microsoft's 2 April 2025 announcement applies to hotmail.com, live.com, and outlook.com. Under 5,000 emails a day it calls authentication a benefit and says enforcement first targets large senders. The announcement and policies do not describe a rolling 24-hour window, a primary-domain total, or a status that stays forever.

What each provider requires

DMARC, complaint rates and unsubscribe rules

Bulk senders to Gmail set up both SPF and DKIM. The sender FAQ says "only one of these needs to be aligned", and forwarded mail and mailing lists are outside that rule. Google's DMARC setup page describes p=none as taking no action and delivering the message, while logging it. That is the policy tag, not proof the message passed. Yahoo's bulk rule is at least p=none and "DMARC must pass". Missing DMARC can prevent delivery support and cause deferral or rejection. The FAQ lists 4.7.31; the SMTP catalog lists 421 4.7.40 and 550 5.7.40.

Gmail calculates the Postmaster Tools spam rate daily, and above 0.1% bulk inbox delivery is already affected. Bulk senders with a spam rate above 0.3% lose eligibility for delivery support, which returns after 7 consecutive days below 0.3%. Yahoo may defer mail from a domain with a high complaint rate. If people report your mail as spam at Outlook.com, the announcement points you at content, frequency, and the opt-out.

Gmail's one-click rule is "required only for marketing and promotional messages." Transactional messages are excluded, including password reset messages, reservation confirmations, and form submission confirmations. Headers must meet RFC 8058. Gmail's example is List-Unsubscribe-Post: List-Unsubscribe=One-Click plus an HTTPS List-Unsubscribe URL, and a mailto link does not meet Gmail's rule. The required body link may lead to a preferences page; it does not replace the unsubscribe header. Honor Gmail unsubscribe requests within 48 hours to remain eligible for delivery support. Missing one-click unsubscribe does not automatically cause rejection or spam placement. Yahoo accepts a mailto method in the List-Unsubscribe header, expects action within 2 days, and will not decide which messages need the link.

What transactional mail still has to do

At Gmail and Yahoo, staying under the bulk line does not drop authentication, DNS, or the complaint rate. Personal Gmail also requires TLS and RFC 5322, and Yahoo requires RFC 5321 and RFC 5322. One-click unsubscribe is the item the Gmail and Yahoo FAQs exclude for the transactional examples above.

Above the bulk line, DMARC applies even to receipts. On Gmail's FAQ, the gaps are failed alignment, mail without both SPF and DKIM, DNS, TLS, or RFC 5322. Any of them can mean a temporary failure, a permanent failure, or the spam folder. Spam-rate and unsubscribe compliance also affect eligibility for delivery support. A domain that has not sent more than 5,000 messages a day to personal Gmail since 1 January 2024 is on a faster timetable.

Microsoft requires high-volume senders to pass SPF, DKIM and DMARC, with at least p=none. Safe-sender lists do not bypass Microsoft's high-volume authentication enforcement.

Rejection codes

Gmail's 5.7.26 is an authentication or DMARC failure, not a missing mailbox. A missing mailbox is covered in 550 5.1.1 user unknown.

Gmail's wording is on the SMTP error list. The guidelines also say unauthenticated mail might be rejected with a 5.7.26 error. The FAQ and that catalog disagree on the temporary code for a missing DMARC record, 4.7.31 versus 4.7.40, so match the sentence you received. Yahoo's SMTP error page says not to retry a 5xx. After a code from 500 through 599, Microsoft's policies page says not to retransmit that message. Sendtier suppresses on an Amazon SES bounce type of Permanent, and on complaints, not on the SMTP digits.

What changed since 2024

Gmail's requirement list is still the 1 February 2024 list. Senders who already had an unsubscribe link had until 1 June 2024 to add one-click unsubscribe on commercial and promotional mail. From November 2025 the FAQ says Gmail "is ramping up its enforcement on non-compliant traffic", including temporary and permanent rejections. It does not say the requirement text changed, and it names no end date. Postmaster Tools has a Compliance status dashboard.

Yahoo's pages still describe a February 2024 start and a rollout through the first half of that year, with List-Unsubscribe enforcement from June 2024. They do not document a 2025 or 2026 rule change.

Microsoft's April 2025 update announced authentication rejections from 5 May 2025 using 550 5.7.515, and the previous junk-first timeline is crossed out. Its NDR guide documents this rejection, although the Postmaster policies retain junk-then-reject wording.

Check DNS and the reports

Look up the TXT record that starts with v=spf1, the DKIM record at your selector, and the TXT record at _dmarc plus the domain.

_dmarc.example.com.    TXT    "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

Yahoo still requires a DMARC pass when the policy is p=none. The rua mailbox receives aggregate reports. Google's setup page says Gmail does not support ruf, and Microsoft's announcement says it sends those reports and does not plan to send ruf. Yahoo recommends rua and does not require it. Use the reports to see which sources fail SPF, DKIM, or alignment.

Relaxed alignment compares organizational domains, so example.com and send.example.com align, while strict alignment requires an exact domain match (RFC 7489, section 3.1).

For Gmail's PTR rule, the hostname in the PTR record needs an A or AAAA record back to the sending IP. Postmaster Tools shows spam rate, authentication, delivery errors, and compliance. Updates typically land within 24 hours and can take longer. The Compliance status dashboard can take up to 7 days to reflect a fix, and it aggregates subdomain data under the primary domain. Yahoo's FAQ describes an ARF report from the Complaint Feedback Loop when a user marks enrolled DKIM mail as spam. Microsoft's policies page lists the Junk Email Reporting Program and Smart Network Data Services.

What Sendtier sets up

Sendtier sends through Amazon SES in AWS eu-central-1 (Frankfurt). A sending domain uses these six DNS records.

Sendtier's p=none record meets the minimum DMARC policy level, and messages must still pass authentication. You can later change the policy to quarantine or reject after reviewing reports. The Domains guide explains the records and verification checks.

Pending domains are re-checked every 30 seconds until they verify, then every 6 hours. A verified domain loses verification only after two failed checks in a row.

On a bounce, Sendtier keeps the SES type (Permanent, Transient, or Undetermined), the subtype, and each recipient's action, status, and diagnostic code. Status is the enhanced code, such as 5.7.26, when SES includes it. The diagnostic code is the receiving server's reply when that server returns one. Permanent bounces and complaints suppress the address, and transient and undetermined bounces do not. A later send to a suppressed address fails with 422 recipient_suppressed. The suppressions API lets you add, list and remove your organization's suppression entries.

Test-key emails are never delivered. Live sending is limited during the public preview. Start free with a test key in the quickstart.