Gmail, Yahoo and Microsoft sender rules

Last updated 12 October 2026 · By the XKey team

Who do the rules apply to?

There are two levels. Every sender to a Gmail, Yahoo or Outlook.com address must meet the basic rules. Bulk senders – roughly 5,000 or more emails a day to one provider's users – must meet the stricter ones as well. Most small businesses aren't bulk senders, but the basic rules still apply, and newsletter tools usually expect you to meet the bulk rules anyway.

The rules for every sender

• SPF or DKIM must pass for your domain. Set up both – it costs nothing. Check with the SPF checker and DKIM checker.
• Valid reverse DNS for the sending server – your email provider handles this if you use Microsoft 365, Google Workspace or a reputable newsletter service.
• A secure connection (TLS) when sending – again handled by any modern provider.
• Low spam complaints – Gmail asks you to stay below 0.3% of messages reported as spam, and recommends below 0.1%.
• Properly formatted messages that follow the email standards, and no pretending to be someone else, such as sending "from" a Gmail address through another service.

The extra rules for bulk senders

• SPF and DKIM both set up for your domain.
• A DMARC record – at least p=none (monitoring only). See how to set up DMARC and test it with the DMARC checker.
• Alignment – the domain in your visible From address must match the domain that passes SPF or DKIM. If your newsletter tool signs with its own domain rather than yours, you're not aligned: add its DKIM records to your domain.
• One-click unsubscribe for marketing emails – the List-Unsubscribe header that puts an "Unsubscribe" link next to your name in Gmail and Yahoo – and a visible unsubscribe link in the email. Requests must be honoured within two days.

What changed at Microsoft?

From May 2025, Microsoft began applying similar rules to Outlook.com, Hotmail and Live addresses for domains sending more than 5,000 emails a day: SPF, DKIM and DMARC (at least p=none, aligned with SPF or DKIM) are required, and email that doesn't comply is junked and then rejected. Microsoft also recommends a working unsubscribe link and a real reply-to address.

What happens if I don't comply?

Emails are first delayed or sent to spam, then rejected with an error that names the rule you broke – for example a bounce mentioning "5.7.26" from Gmail means authentication failed. Your newsletter tool's reports will show a jump in bounces.

A simple checklist for small businesses

1. Set up SPF listing every service that sends as your domain.
2. Turn on DKIM in your email service and in every newsletter or invoicing tool, using your own domain.
3. Add a DMARC record with p=none and an address to receive reports.
4. Send marketing only to people who opted in, with one-click unsubscribe switched on in your newsletter tool.
5. Watch complaints in Google Postmaster Tools if you send to many Gmail users.

Test as you go with the free MX lookup, SPF checker, DKIM checker and DMARC checker. DNS changes usually show within an hour, but can take up to a day.

Frequently asked questions

I only send a few emails a day. Do these rules affect me?

The basic rules do: SPF or DKIM must pass, and complaint rates must be low. The bulk rules apply above about 5,000 emails a day, but setting up SPF, DKIM and DMARC anyway is free and protects you from scammers using your name.

Does my newsletter tool handle this for me?

Partly. Mailchimp, Brevo, MailerLite and others add one-click unsubscribe and sign your emails, but you still need to add their DKIM records to your domain so the signature matches your From address.

What is a 5.7.26 bounce?

It's Gmail rejecting a message because it failed authentication: SPF and DKIM didn't pass for the From domain under its DMARC rules. Fix SPF and DKIM for the service that sent it.