Google, Yahoo, Microsoft sender requirements, dated

Google, Yahoo and Microsoft all enforce bulk sender rules. Bulk senders need SPF, DKIM and a passing DMARC record. Google and Yahoo add one-click unsubscribe and a spam rate under 0.3%. Since November 2025, Google answers non-compliant mail with temporary and permanent rejections. Google draws the bulk line at close to 5,000 messages a day, Microsoft at 5,000 messages from one domain, and Yahoo publishes no number.

Checked against each provider's own pages on 18 October 2026. For the order to run the checks in, see the deliverability checklist.

The requirements side by side

When enforcement started

Microsoft first planned to send failing mail to the Junk folder, then said in late April 2025 that it would reject it outright from May 5.

Who counts as a bulk sender

Google's guidelines say more than 5,000 messages a day to personal Gmail accounts, while its FAQ says close to 5,000, so do not plan around sitting just under the line. The FAQ counts every message from the same primary domain, subdomains included, and says bulk status never expires:

So one large send from any subdomain can make the whole primary domain a bulk sender for good. Plan for that before a newsletter and an outbound program share a registered domain.

Yahoo judges at the authenticated domain or the From domain and gives no volume. Microsoft counts 5,000 or more messages to its consumer services from one From domain: Outlook.com, Hotmail, Live.com and MSN.

Two scope limits matter for business lists. Google's guidelines do not apply to mail sent to Google Workspace accounts, and Microsoft's cover its consumer addresses only. If your list is mostly company addresses, most of it falls outside both. Meet the rules anyway: they cost the same whoever the recipient is.

Authentication and alignment

All three ask bulk senders for SPF and DKIM plus a DMARC record that passes, and a DMARC pass needs alignment: SPF or DKIM must pass for a domain that matches the From domain. SPF checks the envelope sender, so a platform's bounce domain can pass SPF and align with nothing. The fix is to have the platform sign DKIM with your own domain. SPF, DKIM and DMARC explained covers the records.

• Google and Yahoo require DKIM keys of 1024 bits or more.
• The DMARC specification is now RFC 9989, which obsoletes RFC 7489. Publish a rua address so you receive reports.
• p=none satisfies all three providers. Tighten it once the reports show only your own senders.

To test, send a message through your normal sending path to a Gmail address, choose More, then Show original, and read the results. An SPF pass for a vendor's domain with no aligned DKIM signature is the state to find and fix.

One-click unsubscribe

The mechanism is RFC 8058: a List-Unsubscribe header holding an HTTPS address, and a List-Unsubscribe-Post header with a fixed value.

List-Unsubscribe: <https://yourdomain.com/u/abc123>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

The RFC sets three rules that break common setups:

• A DKIM signature must cover both headers.
• The POST carries no cookies or credentials, and the sender must not answer with a redirect. An address that bounces to a login page fails.
• The mailbox provider sends the POST only with the user's consent, when someone uses its unsubscribe control.

The header does not replace the body link: Google wants a clearly visible unsubscribe link in the body as well, and Yahoo says a body link alone is not enough. Yahoo counts an unsubscribe not honored within two days as a failure, and Google recommends 48 hours. Both exempt transactional mail. Neither says whether cold outreach counts as marketing, so treat outbound to prospects as marketing and add the headers.

Spam rate

Google asks for a spam rate below 0.10% and never 0.30% or higher, calculated daily. At 0.30%, 300 complaints on 100,000 messages puts you on the line. Above it you lose eligibility for mitigation, and regain it after 7 consecutive days below 0.3%.

Read the number with care. Postmaster Tools counts complaints only on DKIM-signed mail that reached the inbox, so mail already filtered to spam makes the rate look better than it is. It also shows nothing on days with too little volume, which is common for a small program.

Yahoo wants a spam rate below 0.3% and reports complaints through a feedback loop that covers DKIM-signed mail only. Microsoft states no rate; for data it offers SNDS and its Junk Mail Reporting Program. Suppress a complaint or an unsubscribe the same day.

Bounce codes and what they mean

Enforcement shows up as a bounce code, and the code names the requirement that failed.

Google's 4.7 codes rate-limit your mail and its 5.7 codes block it. For how we handle this work, see how we run account-based outbound.