The requirements of Gmail, Yahoo and Microsoft

Module 5: Reputation and the major providers · Reading time: 11 minutes

Learning objective: After this lesson you can list the requirements that Gmail, Yahoo and Microsoft set for all senders and for bulk senders, explain what one-click unsubscribe is, and check your own domain against those requirements.

Key concepts: sender guidelines, bulk sender (5,000 per day), SPF or DKIM, SPF and DKIM, DMARC with at least p=none, alignment, PTR and FCrDNS, TLS, complaint rate (0.1% and 0.3%), List-Unsubscribe, One-Click (RFC 8058), Postmaster Tools, SNDS, 550 5.7.515

Why these requirements exist

Gmail, Yahoo and Microsoft (Outlook.com, Hotmail, Live.com, MSN) together receive a large share of all personal mail. For a long time, SPF, DKIM and DMARC were "recommended". In October 2023, Google and Yahoo announced that they would start setting requirements from February 2024. Microsoft followed for Outlook.com and its other consumer addresses, with requirements enforced from May 2025.

The requirements are aimed at forged senders and unwanted bulk mail. For most small senders, this means: make sure the basics from module 4 are in order. If you send newsletters or a lot of transactional mail, more requirements apply.

Requirements for everyone

Gmail and Yahoo set these requirements for all senders to their users:

Google also says: don't pretend to be Gmail. If you send mail with a @gmail.com address as the sender via a server other than Google's own (for example, via a newsletter service), it fails DMARC: that server isn't allowed to sign on behalf of gmail.com and isn't listed in gmail.com's SPF. Google states that Gmail treats such mail with a quarantine policy. So always send from an address on your own domain.

Extra requirements for bulk senders

Google classes you as a bulk sender if you send around 5,000 or more emails in 24 hours to personal Gmail addresses. Mail from subdomains counts towards the main domain. And importantly: once you've reached that threshold once, you stay a bulk sender. That status doesn't expire. Yahoo doesn't use a hard number, but Microsoft also uses 5,000 per day.

For bulk senders, the following is added:

1. SPF and DKIM must both be set up (not just one of them).
2. DMARC must be in place, with at least p=none. A stricter policy is allowed, but not required. Yahoo strongly recommends a reporting address (rua).
3. Alignment: the domain in the visible From: address must match the SPF domain (Return-Path) or the DKIM domain (d=). That's exactly what DMARC checks (lesson 4.4). In short: the mail must pass DMARC.
4. One-click unsubscribe for marketing and subscription mail, plus a clearly visible unsubscribe link in the text.
5. Process unsubscribe requests within two days.
6. Complaints below 0.3%, and preferably below 0.1%.

This lines up exactly with the advice from module 4: start DMARC with p=none and a reporting address. That way you meet the requirement without risking your own mail being rejected.

Microsoft: SPF and DKIM and DMARC

For senders of 5,000 or more emails per day to Outlook.com, Hotmail, Live.com and MSN (all with the same domain in the From: address), Microsoft sets these requirements:

• SPF must pass;
• DKIM must pass;
• there must be a DMARC record, at least p=none, and the mail must pass DMARC.

Note the difference: with DMARC, one of the two is enough (SPF or DKIM, aligned). For bulk senders, Microsoft requires both to pass. Mail that doesn't meet this isn't sent to the Junk folder but is rejected with:

550 5.7.515 Access denied, sending domain example.com does not meet the required authentication level.

So a domain that passes DMARC via DKIM but whose SPF fails (for example, because a service is missing from the SPF record) can still get this error.

One-click unsubscribe

With a newsletter, recipients expect an unsubscribe link. Gmail, Yahoo and Apple Mail also show their own "Unsubscribe" button at the top of the email. That button works using two headers:

List-Unsubscribe: <https://nieuwsbrief.example/afmelden?id=8f3a2c>, <mailto:afmelden@example.com?subject=afmelden>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

• List-Unsubscribe (RFC 2369) provides one or more ways to unsubscribe: a web address and/or an email address.
• List-Unsubscribe-Post: List-Unsubscribe=One-Click (RFC 8058) says: if you send a POST request to that web address, the recipient is unsubscribed immediately. No extra page, no logging in, no "are you sure?".

Both headers must fall under the DKIM signature, so no one can change them along the way (RFC 8058 requires this). A newsletter service arranges this for you. If you send mail yourself, you'll need to build it yourself (lesson 7.2).

What happens if you don't comply?

Google states that mail which doesn't meet the requirements can be rejected temporarily or permanently, or end up in spam. Since November 2025, Gmail has been stepping up this enforcement further. The error messages are specific (a full list is in lesson 6.2), for example:

A code starting with 4 is temporary (the sending server tries again later), a code starting with 5 is permanent (lesson 6.1).

Measuring: Postmaster Tools and SNDS

You can't look inside recipients' mailboxes, but the major providers do give you figures:

• Google Postmaster Tools (postmaster.google.com): after confirming your domain with a TXT record, you can see the complaint rate, whether your mail passes SPF, DKIM and DMARC, and whether it's encrypted. You only see figures once you send enough mail to Gmail.
• Microsoft SNDS (Smart Network Data Services): data per IP address. Only useful if you have your own IP address (lesson 6.4).
• Yahoo Sender Hub: Yahoo's own place for senders, including a complaint feed.

If you send through a newsletter service, that service usually shows you the complaint rate per send itself.

In practice

For an ordinary business mailbox with a hosting company or mail service, you'll usually already meet the requirements for everyone: the provider handles PTR and TLS, and you take care of SPF, DKIM and a DMARC record. At WebOké, the Set E-mail card in My WebOké shows per record whether it's correct; with other providers such a check may have a different name, or you can use an independent tool such as internet.nl.

If you send newsletters, that should include SPF and DKIM for the sending service (your own DKIM key on your domain, lessons 4.3 and 7.1), a DMARC record and an unsubscribe button that works with one click.

Summary

• Everyone: SPF or DKIM, a correct PTR, well-formed messages, TLS, complaints below 0.3%.
• Bulk senders (from around 5,000 per day, and that status stays): SPF and DKIM, DMARC with at least p=none, alignment, one-click unsubscribe, unsubscribe requests processed within two days.
• Microsoft requires bulk senders to pass both SPF and DKIM, otherwise 550 5.7.515.
• One-click unsubscribe = List-Unsubscribe with an https address plus List-Unsubscribe-Post: List-Unsubscribe=One-Click.
• Measure using Google Postmaster Tools, Microsoft SNDS or the figures from your sending service.

Quiz

Exercise

Exercise Z5.3: Your domain against the requirements. Enter your own domain and a DKIM selector you found in the headers of one of your own emails (s= in DKIM-Signature, lesson 4.3). For each requirement, fill in whether you think you meet it: SPF present and valid, DKIM key found, DMARC present with a valid p, reporting address present, PTR of your MX server correct. The tool runs the same checks live and puts the result next to your estimate. Don't have your own domain? Use sidn.nl instead (without a DKIM selector).

Further reading

The steps in these articles apply to WebOké's control panels; with other providers it works in a similar way.

• My email doesn't arrive or ends up in spam: here's how to figure it out
• What is DMARC? Explanation in plain language
• Can I send out a mailing via my hosting package with WebOké?
• WebOké manual 6.7: The Set up email card (MX, SPF, DKIM, DMARC)
• Google, Email sender guidelines: https://support.google.com/a/answer/81126
• Yahoo, Sender best practices: https://senders.yahooinc.com/best-practices/
• Microsoft, Error 550 5.7.515 in Outlook.com: https://support.microsoft.com/en-us/outlook/fix-ndr-error-550-5-7-515-in-outlook-com
• RFC 8058 (one-click unsubscribe)