By Akash Sengar · · 5 min read
Why this matters
From February 2024, Google and Yahoo began enforcing stricter rules for mail sent to their users. In 2025, Microsoft announced similar requirements for high-volume senders to Outlook.com consumer addresses, with enforcement starting on 5 May 2025. Mail that does not meet the rules can be delayed, sent to spam or rejected.
These rules are not only for marketing teams. A business that sends invoices, statements or password resets from its own domain needs the same foundations, because the providers check authentication on every message.
If your mail is already landing in spam or junk, start with our step-by-step guide: why are my emails going to spam?
Rules for every sender
Google's email sender guidelines set requirements for anyone sending to personal Gmail accounts. In summary:
- Set up SPF or DKIM for your sending domain.
- Have valid forward and reverse DNS records (a PTR record) for your sending servers' IP addresses.
- Use a TLS connection for transmitting email.
- Keep the spam rate reported in Google Postmaster Tools below 0.3%.
- Format messages according to the Internet Message Format standard (RFC 5322).
- Do not impersonate Gmail From: headers.
Yahoo's sender best practices set out comparable baseline rules for all senders, including authentication and keeping spam complaint rates low.
Rules for bulk senders
Google defines a bulk sender as one that sends close to 5,000 messages or more to personal Gmail accounts within 24 hours. Messages from the same primary domain count together, and once you are classed as a bulk sender, the classification does not lapse. Bulk senders must also:
- Set up both SPF and DKIM.
- Publish a DMARC record for the sending domain. The policy can be p=none.
- Align the domain in the From: header with the SPF domain or the DKIM domain.
- For marketing and subscribed messages, support one-click unsubscribe as defined in RFC 8058, include a clearly visible unsubscribe link in the body, and process unsubscribe requests within two days.
Google's FAQ on the requirements clarifies that one-click unsubscribe applies to marketing and subscribed messages, not to transactional mail such as receipts or password resets. Yahoo's page sets the same expectations for bulk senders, including one-click unsubscribe and honouring requests within two days.
Microsoft Outlook.com
Microsoft's announcement for high-volume senders applies to domains sending more than 5,000 emails a day to Outlook.com consumer addresses (such as outlook.com, hotmail.com and live.com). Those senders must:
- Pass SPF for the sending domain.
- Pass DKIM to validate the message's integrity and authenticity.
- Publish DMARC with at least p=none, aligned with SPF or DKIM, and preferably both.
Microsoft also recommends a valid From: or Reply-To: address that can receive replies, a working unsubscribe link, list hygiene that removes invalid addresses, and transparent mailing practices. Enforcement began on 5 May 2025; non-compliant messages from high-volume senders can be routed to Junk or rejected.
Side by side
What this means for invoices and newsletters
Invoices, statements and system mail
These are transactional, so the unsubscribe rules do not apply. Authentication does. Billing platforms, accounting software, CRMs and helpdesks often send "as" your domain. Each one needs to be authorised in SPF or, better, sign with DKIM using your domain, so that DMARC alignment passes.
Newsletters and campaigns
Your email marketing platform must send with DKIM aligned to your domain, add the List-Unsubscribe and List-Unsubscribe-Post headers for one-click unsubscribe, and process opt-outs promptly. Watch spam complaint rates in Google Postmaster Tools and act early if they rise.
Volume is per domain, not per tool
Google counts messages from the same primary domain together. Several tools sending modest volumes can add up. Treat the domain as a bulk sender if there is any doubt, because the requirements are good practice either way.
A practical order of work
- Run our free email security check to see your current MX, SPF, DKIM and DMARC records.
- List every service that sends mail as your domain: mail platform, billing, CRM, marketing, helpdesk, website forms.
- Enable DKIM signing with your domain in each service. Add SPF includes only where needed, and keep SPF within its 10 DNS-lookup limit.
- Publish DMARC at p=none with a reporting address, and read the aggregate reports for a few weeks.
- Fix anything that fails alignment, then move towards quarantine and reject, as our DMARC guide describes.
- For marketing mail, confirm one-click unsubscribe headers are present by viewing the original message source.
- Set up Google Postmaster Tools for your domain and review spam rates regularly.
If you only send a few hundred messages a day, you may not be a bulk sender today. The same setup still improves delivery and makes your domain harder to spoof.
Common mistakes
Two SPF records
A domain may publish only one SPF record. Adding a second TXT record that starts with v=spf1 for a new tool makes SPF fail for everything. Merge the includes into the existing record instead.
Too many SPF lookups
SPF allows at most 10 DNS lookups. Every include, a, mx and redirect counts, including the lookups nested inside each include. Remove tools you no longer use, and prefer DKIM alignment for tools that support it.
DKIM signed with the vendor's domain
Many platforms sign with their own domain by default. The message passes DKIM but not DMARC alignment, because the signing domain is not yours. Set up custom-domain DKIM in each platform's settings.
Unsubscribe links that need a login
One-click unsubscribe means the recipient's mail app can unsubscribe them with a single action, without visiting a page, signing in or confirming. A link in the footer is still good practice, but it does not replace the headers.
Moving DMARC to reject too early
Jumping straight to p=reject before every legitimate sender is aligned can block your own invoices. Read the aggregate reports first, then tighten the policy in stages.
Quick answers
Do these rules apply if we send fewer than 5,000 messages a day?
The bulk-sender extras, such as one-click unsubscribe and DMARC, are formally tied to volume. The basics, SPF or DKIM, valid DNS, TLS and low spam rates, apply to everyone sending to personal Gmail and Yahoo accounts. Meeting the bulk-sender rules anyway is the safer choice.
Do the rules apply to mail sent to business mailboxes?
Google's requirements are about mail sent to personal Gmail accounts, and Microsoft's are about Outlook.com, Hotmail and Live addresses. Corporate mail systems set their own filtering, and many check the same signals, so the same setup helps there too.
What spam rate should we aim for?
Google asks senders to keep the user-reported spam rate in Postmaster Tools below 0.1% and to avoid ever reaching 0.3%. Treat 0.1% as the ceiling, not the target.
