[ Quick answer ]
Since February 2024, Gmail and Yahoo require bulk senders (5,000+ messages a day) to authenticate with SPF and DKIM, publish DMARC (at least p=none) aligned with the From domain, offer one-click unsubscribe and keep spam complaints under 0.3%.
Key facts
- ›All senders: SPF or DKIM, valid reverse DNS, TLS, complaint rate under 0.3%.
- ›Bulk senders: SPF and DKIM, DMARC with alignment, one-click unsubscribe.
- ›Unsubscribe requests must be honored within two days.
- ›Microsoft Outlook applied similar rules for high-volume senders in 2025.
Reviewed 2026-11-02 · EmailAuth research team
In February 2024, Google and Yahoo began enforcing shared sender requirements. To land in the inbox you must authenticate with both SPF and DKIM, publish a DMARC policy, keep your spam complaint rate under 0.3 percent, offer one-click unsubscribe on marketing mail, and send from an IP with valid forward and reverse DNS (a matching PTR record). Bulk senders, roughly those sending 5000 or more messages a day to Gmail or Yahoo accounts, face the strictest checks, but the core rules now apply broadly.
What the rules require
- SPF and DKIM both configured and passing, so receivers can verify your sending sources.
- A published DMARC record. A policy of p=none is the minimum to comply, though enforcement is stronger protection.
- Alignment between the visible From domain and your authenticated SPF or DKIM domain.
- Spam complaint rate kept below 0.3 percent, monitored through tools like Google Postmaster Tools.
- One-click unsubscribe (RFC 8058) in marketing and promotional email, honored within two days.
- A valid PTR record so the sending IP resolves back to a hostname that matches its forward DNS.
Who must comply
The heaviest requirements target bulk senders sending around 5000 or more messages per day to Google or Yahoo recipients. That threshold is measured across your sending, and once you cross it the providers expect full authentication, low complaint rates, and one-click unsubscribe. Lower-volume senders still need SPF, DKIM, and valid reverse DNS, because those checks apply to everyone. Treat the bulk rules as the direction all senders are heading.
What happens if you fail
Non-compliant mail does not fail silently in a way you can ignore. Providers first move messages to spam, then begin rejecting them outright with error codes. A complaint rate that climbs past the threshold can get an entire domain filtered. Because the enforcement is gradual, many senders see delivery slip before they realize a requirement is missing, which is why monitoring matters.
How to check your status
Minimum DMARC record to comply
v=DMARC1; p=none; rua=mailto:reports@example.com
Run a domain scan to confirm SPF, DKIM, and DMARC are present and aligned, and check that your sending IPs have valid PTR records. EmailAuth generates a correct DMARC record from a free domain scan, hosts your DMARC, BIMI, and MTA-STS records by CNAME delegation, and reads your aggregate reports so you can watch alignment and complaint trends over time. That reporting is how you move safely from p=none toward enforcement without blocking legitimate mail.
Frequently asked questions
When did the Google and Yahoo requirements start?
They took effect in February 2024. Both providers announced the shared rules in late 2023 and began enforcement in the first quarter of 2024, with checks tightening through the year for bulk senders.
Who counts as a bulk sender?
Google and Yahoo define bulk senders as those sending roughly 5000 or more messages a day to their users. Crossing that volume triggers the full requirement set, including strict authentication and one-click unsubscribe.
What spam rate do Google and Yahoo require?
Keep your spam complaint rate below 0.3 percent, and ideally under 0.1 percent. Google Postmaster Tools reports this figure. Sustained rates above the threshold lead to filtering or rejection of your mail.
Do small senders need to comply?
Yes, in part. SPF, DKIM, a DMARC record, and valid reverse DNS apply to every sender, bulk or low volume. Meeting the requirements now protects your delivery as the providers extend enforcement.
What are the Google and Yahoo sender requirements?
Authenticate with SPF, DKIM and DMARC, align the From domain, support one-click unsubscribe, and keep spam complaints below 0.3%.
Does p=none meet the Gmail requirement?
Yes, p=none is the minimum. Enforced policies give real protection and are needed for BIMI.
[ Email deliverability guide ]