Google, Yahoo and Microsoft sender requirements
The world’s three biggest mailbox providers now enforce the same baseline: authenticate your mail or it does not get delivered. Google and Yahoo have enforced since February 2024, Microsoft’s Outlook rules took effect May 5, 2025 — and enforcement has progressed from temporary errors to outright rejections.
Last reviewed
Does this mandate name DMARC?
This is the one set of rules on this site that requires the protocol itself, not an outcome. Bulk senders to Gmail, Yahoo and consumer Outlook must publish a DMARC record and pass alignment; there is no equivalent control you can substitute.
A DMARC record at p=none or stricter, with SPF or DKIM aligned to your visible From: domain, one-click unsubscribe on marketing mail, and a spam rate below 0.3%. Below the bulk threshold you still need SPF and DKIM.
Enforcement. p=none satisfies the letter of the rules and gives no protection against spoofing — and you cannot tell whether your own mail aligns without reading the aggregate reports it turns on.
The facts, with dates.
Anyone sending ~5,000+ messages a day to Gmail, Yahoo, or consumer Outlook (outlook.com, hotmail.com, live.com) addresses — and once you cross the threshold, the obligations stick. Smaller senders must still authenticate with SPF and DKIM.
What the providers require
Google and Yahoo announced a shared set of sender requirements that took effect in February 2024. Every sender must authenticate with SPF or DKIM, maintain valid forward and reverse DNS, and keep spam complaints low. Bulk senders — roughly 5,000+ messages a day to Gmail — must additionally pass both SPF and DKIM, publish a DMARC record (minimum p=none), align the authenticated domain with the visible From: domain, and offer one-click unsubscribe on commercial mail.
Microsoft joined in 2025: as of May 5, 2025, senders of 5,000+ messages a day to consumer Outlook domains (outlook.com, hotmail.com, live.com) must meet the same SPF, DKIM, and DMARC bar. Non-compliant mail is rejected with SMTP error 550 5.7.515.
Enforcement has hardened over time. Google’s rollout moved from temporary errors (4.7.x) on a portion of non-compliant traffic to permanent rejections (5.7.x). In 2026, failing the requirements does not mean the spam folder — it increasingly means the mail never arrives.
What happens if you do not comply
Why DMARC alignment is the hard part
Most senders technically “have” SPF and DKIM long before they comply, because the requirement is not just passing — it is alignment. The domain that passes SPF or DKIM must match your visible From: domain. Mail sent through a third-party platform that signs with the vendor’s domain authenticates without aligning, and DMARC fails.
A p=none DMARC record satisfies the letter of the bulk-sender rules, but it gives you zero protection against spoofing — and you cannot see whether your real mail aligns without reading the aggregate reports. That is the actual work: identify every service sending as your domain, fix its authentication, then move to enforcement.
DDMARC turns those raw XML reports into a readable sender inventory, shows exactly which sources fail alignment, and monitors your spam-relevant DNS posture continuously — so you stay compliant after the first fix, not just on audit day.
Every claim on this page, sourced.
Primary sources only — the standard, the regulator, or the provider's own documentation. No vendor blog posts quoting other vendor blog posts.
Your compliance checklist.
Tick these off as you go — the state stays in this browser and is sent nowhere, which matters when the list is an inventory of controls you do not yet have. The configuration steps take an afternoon; the move to enforcement is the one that takes weeks.
A free scan shows your DMARC, SPF, and DKIM status against the provider requirements in seconds.
Check your domainMarketing platforms, CRM, billing, support desk, internal tools — each one must authenticate and align, or enforcement will break it.
Configure custom DKIM signing (d=yourdomain) and correct return-path domains on every third-party sender.
How alignment worksMinimum p=none with a rua address — then read the reports.
DMARC setup guideRFC 8058 headers on commercial mail, and keep user-reported spam under 0.3% (ideally under 0.1%) in Google Postmaster Tools.
p=quarantine or p=reject is what stops spoofing — and it future-proofs you as providers keep tightening. Free monitoring needs no card, and the reports it parses are what tell you the move is safe.
Start free monitoringQuestions people ask.
The full bulk-sender obligations (DMARC, alignment, one-click unsubscribe, spam-rate cap) apply at roughly 5,000+ messages a day per provider. But every sender, regardless of volume, must authenticate with SPF or DKIM and keep clean DNS — and Google counts the threshold per sending domain, treating bulk status as permanent once crossed. If you ever run large campaigns, build to the bulk-sender bar.
It is Microsoft’s rejection code for bulk mail that fails its authentication requirements: “550 5.7.515 Access denied, sending domain does not meet the required authentication level.” It means your domain is missing SPF, DKIM, or DMARC — or they do not align with your From: domain. Fix authentication and the rejections stop.
Yes for the letter of the requirements — Google, Yahoo, and Microsoft all accept p=none as the minimum. But p=none is monitor-only: it does not stop anyone from spoofing your domain. Treat it as the starting state, use the aggregate reports to confirm your mail aligns, then move to p=quarantine or p=reject.
They are aligned on the core: SPF, DKIM, DMARC with alignment, low spam rates, and easy unsubscribe for bulk senders. The main differences are timing (Google/Yahoo enforced from February 2024, Microsoft from May 5, 2025), scope (Microsoft’s announced rules cover its consumer domains — outlook.com, hotmail.com, live.com), and error codes. Meeting Google’s bar effectively means you meet all three.
Microsoft’s announced enforcement targets its consumer domains (outlook.com, hotmail.com, live.com). Business Microsoft 365 tenants apply their own filtering, which already weighs authentication heavily — so the same SPF/DKIM/DMARC work improves your deliverability there too, even where the hard 550 5.7.515 rejection does not apply.
Most teams are covered by more than one.
All merchants and service providers that store, process, or transmit payment-card data — regardless of size or transaction volume.
Any organization applying for or renewing cyber-liability coverage — especially where the application includes email-security or ransomware supplemental questionnaires.
Essential and important entities across 18 critical sectors in the EU — energy, transport, health, digital infrastructure, ICT service management, and more — generally medium-sized and larger, plus some entities regardless of size. Non-EU organizations providing in-scope services in the EU can also be covered.
Already seeing rejections?
A free scan shows where you stand today, in about 30 seconds and with no account. A14-day trial shows every sender that fails alignment within 48 hours of the first reports. Under 60 days to go? The Enforcement sprint takes one domain from p=none to p=reject in about 30 days, for $2,500 per domain, one-time.
Free plan: 2 domains, no card, no expiry · Trial: card required, billed on day 15 unless you cancel · 14-day money-back on new paid plans