Checklist of the Gmail, Yahoo and Outlook.com sender requirements: SPF, DKIM, DMARC alignment, PTR records, TLS, one-click unsubscribe and spam rate limits for anyone sending 5,000+ emails a day, plus how to check each one.
Home › Guides › Bulk sender requirements
Last updated 17 October 2026
If a domain sends 5,000 or more messages a day to personal Gmail, Yahoo or Outlook.com (Hotmail, Live) mailboxes, all three providers expect the same core setup:
p=none is the minimum) that passes, meaning the visible From domain aligns with the SPF domain or the DKIM signing domain.Smaller senders still need SPF or DKIM, PTR records, TLS, RFC 5322-compliant messages and a low spam rate. Run your domain through the Email Deliverability Checker to see SPF, DKIM, DMARC and MX in one pass.
example.com plus 2,500 from news.example.com makes you a bulk sender, and once you cross the line you are treated as a bulk sender permanently.Mail to Google Workspace or Microsoft 365 business mailboxes isn't counted toward these consumer thresholds, but meeting the same bar is still the best way to land in the inbox there too.
| Requirement | Gmail (5,000+/day) | Yahoo (bulk) | Outlook.com (5,000+/day) |
|---|---|---|---|
| SPF | Required, passing | Required, passing | Required, must pass |
| DKIM | Required, passing | Required (1024-bit minimum key) | Required, must pass |
| DMARC | Record required, p=none allowed | Valid policy, at least p=none, must pass | At least p=none (p=reject recommended) |
| Alignment | From domain aligned with SPF or DKIM domain | Aligned with SPF or DKIM, relaxed is fine | Aligned with SPF or DKIM (both preferred) |
| PTR / reverse DNS | Valid forward and reverse DNS | Valid forward and reverse DNS | Not part of the 2025 rules, but standard practice |
| TLS | Required | Not listed, but standard practice | Not part of the 2025 rules, but standard practice |
| One-click unsubscribe | Required for marketing and subscribed mail | Required, honour within 2 days | Recommended practice |
| Spam rate | Below 0.3% in Postmaster Tools, aim for 0.1% | Below 0.3% | Recommended practice (list hygiene, low complaints) |
| What happens if you miss | Temporary or permanent rejections (5.7.26 and related errors) or spam folder | Spam folder or deferrals | Junk folder, then 550 5.7.515 rejections |
Providers update these pages often, so treat the table as a summary and check their own sender guidelines before a big send.
Publish exactly one TXT record starting with v=spf1 at the domain used in the envelope sender (Return-Path). Include every platform that sends for you, for example include:_spf.google.com for Google Workspace or include:spf.protection.outlook.com for Microsoft 365, plus your email service provider. Stay under the limit of 10 DNS lookups.
Build one with the SPF Record Builder and verify the live record and lookup count with the SPF Record Checker. Microsoft 365 admins can follow SPF for Microsoft 365.
Watch for: email service providers that use their own bounce domain (for example bounces.esp.example). SPF passes for their domain, so it doesn't align with your From domain. Set up a custom return-path or bounce domain at the provider, or rely on aligned DKIM.
Turn on DKIM signing with d= set to your domain (or a subdomain of it) on every platform that sends as you. Most providers give you CNAME or TXT records to publish under selector._domainkey. Use 2048-bit keys where the provider allows it; Yahoo's floor is 1024 bits.
Find which selectors a domain already publishes with the DKIM Checker, inspect a key with the DKIM Record Explainer, or follow DKIM for Microsoft 365.
Watch for: a provider signing only with its shared domain (for example d=esp-mail.example). That passes DKIM but not DMARC alignment.
Publish a TXT record at _dmarc.yourdomain. The minimum the providers accept is:
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com
The rua tag isn't strictly required, but without reports you can't see which senders are failing. "DMARC must pass" means at least one of SPF or DKIM passes and its domain matches the visible From domain (relaxed alignment lets mail.example.com match example.com). Once reports are clean, move to p=quarantine and then p=reject.
Generate a record with the DMARC Record Generator, check it with the DMARC Record Checker, and see the full rollout in DMARC for Microsoft 365.
Every sending IP needs a PTR record that resolves to a hostname, and that hostname needs an A or AAAA record pointing back to the same IP (forward-confirmed reverse DNS). If you send through Google Workspace, Microsoft 365 or a major email service provider, they handle this for their shared IPs. It matters when you run your own mail server or have dedicated IPs; ask the IP owner (usually your hosting or cloud provider) to set the PTR.
Check a PTR with the DNS Lookup tool (type PTR, or paste the IP). For TLS, make sure your server offers STARTTLS with a valid certificate; the SSL Certificate Checker shows expiry and chain issues for the hostname.
Marketing and subscribed messages need both of these headers, as defined in RFC 8058, plus a visible unsubscribe link in the body:
List-Unsubscribe: <https://example.com/unsubscribe/abc123>, <mailto:unsubscribe@example.com?subject=unsubscribe> List-Unsubscribe-Post: List-Unsubscribe=One-Click
The mailbox provider sends an HTTPS POST with the body List-Unsubscribe=One-Click to that URL. Your endpoint must unsubscribe the recipient without a login or confirmation page. Yahoo requires unsubscribes to be honoured within 2 days, which is a sensible limit everywhere. Most email service providers add these headers automatically when you enable their unsubscribe feature. Transactional mail such as password resets and receipts doesn't need them.
Confirm the headers are present by sending a test to a Gmail address, choosing Show original, and pasting the headers into the Email Header Analyzer, which also decodes the SPF, DKIM and DMARC results.
_dmarc record with a typo or smart quotes, so providers see no valid policy.Need SPF, DMARC and MX checks across a whole client list? Run the Bulk SPF / DMARC / MX Auditor on Apify ($2 per 1,000 domains).
Check everything at once with the Email Deliverability Checker, then fix individual records with the SPF Record Checker, DKIM Checker and DMARC Record Checker. Decode a test message with the Email Header Analyzer and look up MX and PTR records with MX Record Lookup and DNS Lookup. Microsoft 365 step-by-step guides: SPF, DKIM and DMARC.
Since 1 February 2024, anyone sending more than 5,000 messages a day to personal Gmail accounts must pass SPF and DKIM, publish a DMARC record (p=none is allowed) with the From domain aligned to SPF or DKIM, have valid forward and reverse DNS, use TLS, keep the Postmaster Tools spam rate below 0.3%, and support one-click unsubscribe on marketing mail.
Yes. All three accept a DMARC policy of p=none, as long as the record is valid and messages pass DMARC through an aligned SPF or DKIM result. Microsoft recommends p=reject, and moving to quarantine or reject also protects your domain from spoofing.
It is the rejection Outlook.com uses for high-volume senders whose domain does not meet the authentication requirements. Make sure SPF and DKIM both pass for the sending domain and that a DMARC record exists and passes with an aligned SPF or DKIM domain.
Authentication, PTR, TLS and spam-rate rules apply to all mail from a bulk-sending domain, including receipts and password resets. The one-click unsubscribe requirement applies only to marketing and subscribed messages.
Count all mail from your primary domain and its subdomains to gmail.com and googlemail.com addresses in a single day. If you ever cross 5,000, Google treats the domain as a bulk sender permanently, so it is simplest to meet the bulk requirements as soon as you get close.
Runbooks, checklists and helpdesk templates: IT Admin Packs on Gumroad.