Bulk sender requirements for Gmail, Yahoo and Outlook: SPF, DKIM, DMARC

If you send around 5,000 or more messages a day to Gmail or Outlook.com addresses, or send marketing mail at volume to Yahoo, all three providers expect the same core setup: SPF and DKIM both passing, a DMARC record of at least p=none that aligns with your From domain, and a working one-click unsubscribe. Mail that misses these checks can be junked or rejected, and at Outlook.com a rejection looks like 550 5.7.515 Access denied. This guide compares the three rule sets and shows how to check your own setup.

Thresholds and enforcement differ by provider and change over time, so treat the numbers below as a snapshot and confirm them on the vendor pages linked in each section.

The short version

• Who is covered: Google and Microsoft use a figure of about 5,000 messages per day to personal mailboxes; Yahoo's best-practices page lists bulk-sender rules without stating a number. Gmail and Yahoo began enforcing in February 2024; Microsoft announced its rules in April 2025 and began enforcement for Outlook.com, Hotmail.com and Live.com on May 5, 2025.
• Authentication: SPF and DKIM, plus DMARC with at least p=none, and the From domain aligned with SPF or DKIM.
• Unsubscribe: a one-click method for marketing and subscription mail (Gmail and Yahoo), honoured within 2 days.
• Complaints: keep the spam rate under 0.3% at Yahoo; Google asks senders to stay well below that figure.
• Basics: valid forward and reverse DNS for sending IPs, and messages that follow the Internet Message Format standards.

Gmail requirements

Google splits its rules into two tiers in its email sender guidelines. Every sender needs authentication, valid DNS records for sending IPs and a low spam rate. Bulk senders, meaning those sending about 5,000 or more messages a day to Gmail addresses, must add more.

• SPF and DKIM both configured for the sending domain.
• A DMARC policy of at least p=none, with the From domain aligned to the SPF or DKIM domain.
• One-click unsubscribe for promotional and subscribed mail, using the headers from RFC 8058, plus a visible unsubscribe link in the body.
• Unsubscribe requests processed within 2 days.
• User-reported spam rate kept low in Google Postmaster Tools. Google publishes a target well under 0.3% and treats that figure as an upper limit you should not approach.
• Encrypted delivery over TLS.

Google has tightened enforcement of non-compliant traffic in stages since 2024, so check the current stage on its guidelines page rather than relying on a date in a blog post. Google's guidelines also say that once you cross the bulk threshold you remain a bulk sender.

Yahoo requirements

Yahoo's sender best practices mirror Gmail closely. For all senders: SPF or DKIM at a minimum, a spam rate below 0.3%, valid forward and reverse DNS, and compliance with RFCs 5321 and 5322. Bulk senders must use both SPF and DKIM, publish DMARC at p=none or stricter and pass it, and include a List-Unsubscribe header with one-click support, honouring unsubscribes within 2 days.

Two details are easy to miss. Yahoo calculates the spam rate from mail delivered to the inbox, not from everything you sent. And it recommends sending marketing mail from different IPs or DKIM domains than transactional and alert mail, so a complaint problem in one stream does not drag down the other.

Outlook.com, Hotmail and Live requirements

Microsoft announced its rules in a Microsoft Community Hub post in April 2025. They apply to domains sending more than 5,000 emails a day to Outlook.com, Microsoft's consumer service covering outlook.com, hotmail.com and live.com addresses. Enforcement began on May 5, 2025. SPF and DKIM must pass, and DMARC must be published with at least p=none, aligned with SPF or DKIM (Microsoft prefers both). Microsoft also asks for valid From and Reply-To addresses and a functional unsubscribe link, but unlike Gmail and Yahoo it does not specify one-click unsubscribe in that post.

The rollout was staged. After an April 29, 2025 update to the post, Microsoft said non-compliant mail from high-volume domains would be routed to Junk from May 5, with rejection to follow on a date to be announced. Microsoft documented the rejection message as:

550; 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level.

Administrators in the replies to that post report receiving this bounce, so plan for refusal rather than Junk placement. I could not confirm an official rejection start date. The 5.7.515 code points to one cause: the sending domain failed the authentication requirements. This applies to the consumer Outlook.com family. Mail to Microsoft 365 business tenants follows the tenant's own policies and is judged by Microsoft's composite authentication checks instead.

What alignment means

Passing SPF or DKIM is not enough. DMARC asks whether the domain that passed matches the domain in the visible From address.

• SPF alignment: the envelope sender (Return-Path) domain must match the From domain. Many email platforms use their own bounce domain by default, which fails alignment until you set up a custom one.
• DKIM alignment: the d= domain in the signature must match the From domain. Platforms that sign with their own domain fail here too.

DMARC passes if either one passes and aligns. Relaxed alignment, the default, accepts a subdomain of the same organisational domain. The DMARC standard is now RFC 9989, which obsoletes the original RFC 7489 and keeps relaxed alignment as the default.

How to read an Authentication-Results header

Send a test message to a Gmail or Outlook.com account, open the original message source and find the Authentication-Results header. You are looking for three results:

1. spf=pass with smtp.mailfrom showing your domain.
2. dkim=pass with header.d showing your domain.
3. dmarc=pass with header.from showing your domain.

If SPF or DKIM passes but DMARC fails, the cause is almost always alignment: a third-party sender is using its own domain. Fix it by adding the custom return-path and DKIM records your provider documents.

One-click unsubscribe under RFC 8058

RFC 8058 defines the mechanism. The message carries a List-Unsubscribe header with an HTTPS URI and a List-Unsubscribe-Post header whose value is List-Unsubscribe=One-Click. The mailbox provider sends an HTTPS POST to that URI with the same key and value in the body, and your server must unsubscribe the recipient without further steps. The message also needs a valid DKIM signature that covers both headers, otherwise receivers should not offer the one-click button.

Rolling out DMARC safely

The bulk-sender rules only require p=none, but that policy does not stop spoofing. A common sequence is:

1. Publish p=none with a rua address for aggregate reports and read them for a few weeks.
2. Fix every legitimate source that fails alignment, including marketing tools, CRMs and ticketing systems.
3. Move to p=quarantine. RFC 7489 offered pct to apply a policy to a share of mail first; RFC 9989 removes it in favour of a t=y test flag, so check which one your DMARC tooling and receivers support.
4. Move to p=reject once reports show no legitimate failures.

With p=reject, receivers are told to refuse mail that fails DMARC for your domain. That is the strongest protection against forged mail, and the step where a forgotten sender gets blocked, which is why the reports come first.

Tools for monitoring

• Google Postmaster Tools: domain and IP reputation, spam rate and authentication results for Gmail traffic.
• Microsoft SNDS and JMRP: IP-level data and complaint feedback for Outlook.com traffic.
• Yahoo Complaint Feedback Loop: complaint reports for Yahoo and AOL mail.
• DMARC aggregate reports: XML reports from receivers, usually read through a parsing service.

For related infrastructure topics, see our Security, Networks and Tooling sections, and our explainer on TLS certificate lifetimes, since mail servers depend on valid certificates too.

Frequently asked questions

What counts as a bulk sender for Gmail, Yahoo and Outlook?

Google and Microsoft use a figure of about 5,000 messages a day to their personal accounts; Yahoo does not publish a number on its best-practices page. Count all mail from your primary domain, including transactional and marketing streams together.

What does error 550 5.7.515 Access denied mean?

It is Outlook.com's rejection message for a sending domain that does not meet the required authentication level. Check that SPF, DKIM and DMARC all pass and align with your From domain.

Is DMARC p=none enough?

It satisfies the bulk-sender requirements at Gmail, Yahoo and Outlook.com, but it only monitors and does not block spoofed mail. Moving to quarantine and then reject gives actual protection.

Do small senders need SPF, DKIM and DMARC?

Google and Yahoo require authentication from all senders, and unauthenticated mail can be spam-foldered or refused even at low volume. Setting up all three records is cheap and avoids delivery problems later.

What does DMARC p=reject mean?

It tells receiving servers to refuse messages that claim your domain but fail DMARC. Use it after aggregate reports confirm that all legitimate sources pass.