Check a domain, or a message, against the rules
Authentication is the half you can verify yourself in a minute. Theemail auth checker reads SPF, DKIM, DMARC and its alignment mode, the MX records and reverse DNS straight from DNS, and names what is missing. Complaint rate and one-click unsubscribe are the halves only the receiver and the message itself can answer: Postmaster Tools for the first, the message headers for the second.
The requirements, provider by provider
Each table is the provider's own wording, checked on ; the source line links the official page. The date on these tables changes only when a rule changes.
- Bulk threshold
- ~5,000 messages per day to personal @gmail.com addresses; once classified as bulk the status is permanent
- Authentication
- SPF and DKIM must both pass for the sending domain
- DMARC record required for bulk senders (p=none minimum), aligned with SPF or DKIM
- Valid forward and reverse DNS (PTR) for sending IPs
- TLS connection for transmission
- Spam rate
- Keep below 0.10% in Postmaster Tools; never reach 0.30%. Senders above 0.3% (since June 2024) are ineligible for Google mitigation; mitigation requires 7 consecutive days below 0.3%
- Unsubscribe
- One-click unsubscribe (RFC 8058 List-Unsubscribe + List-Unsubscribe-Post headers) for marketing/promotional mail; honour within 2 days
- Also
- From: header must not impersonate Gmail; Message format per RFC 5322; ARC headers when forwarding
- Enforcement
- : Requirements take effect; temporary 4xx errors for non-compliance
- : 0.3% spam-rate mitigation cut-off
- : Enforcement ramped: temporary and permanent (5xx) rejections for non-compliant traffic
- Rejection codes
- 421-4.7.26 / 421-4.7.27 unauthenticated (temporary)
- 550-5.7.26 unauthenticated email is not accepted (permanent)
- 550-5.7.1 messages … high likelihood spam / low reputation
- Bulk threshold
- Not specified — "we will not specify a volume threshold"; any significant-volume sender
- Authentication
- SPF required
- DKIM required, key ≥1024-bit (2048 recommended)
- DMARC strongly urged (p=none minimum for bulk); p=reject causes rejection of unauthenticated mail
- Spam rate
- No numeric threshold published; high-complaint domains are deferred
- Unsubscribe
- One-click unsubscribe (List-Unsubscribe, preferably RFC 8058) for marketing mail; honour within 2 days; enforced from June 2024
- Also
- Complaint Feedback Loop enrolment (deadline was 2024-08-01)
- Enforcement
- : General rollout
- : Unsubscribe enforcement
- Rejection codes
- 421 4.7.0 [TSS04] temporarily deferred due to unexpected volume or user complaints
- 553 5.7.1 [BL21] connections not accepted (blocklist)
- 554 5.7.9 message not accepted for policy reasons
Rule one: authenticate, and align
Three DNS records, and one relationship between them. SPF lists the servers allowed to send for the domain, and silently fails past ten DNS lookups. DKIM signs each message so the receiver can verify it came from the domain unaltered; Yahoo asks for a key of at least 1024 bits and recommends 2048. DMARC publishes a policy, p=none at minimum, and this is where most senders fail: the From domain has to align with the domain that passed SPF or DKIM. A DMARC record can exist and still not align, and the receiver treats that as a failure.
The auth checker shows all three records; the DMARC generator writes the record; and SPF, DKIM and DMARC explained covers alignment in detail.
Rule two: one-click unsubscribe
Marketing and subscribed mail from a bulk sender carries the RFC 8058 pair, List-Unsubscribe with an https URL and List-Unsubscribe-Post: List-Unsubscribe=One-Click, and the sender honours the request within two days. Google enforced it from June 2024; Yahoo the same month. It does not apply to transactional mail, and it does not replace the visible unsubscribe link in the body. Most sending platforms add the headers on their marketing streams; the header check above confirms whether yours does.
Rule three: the spam rate
Keep below 0.10% in Postmaster Tools; never reach 0.30%. Senders above 0.3% (since June 2024) are ineligible for Google mitigation; mitigation requires 7 consecutive days below 0.3%. Yahoo publishes no number and defers high-complaint domains. The rate is the share of delivered Gmail messages recipients mark as spam, and it is visible in one place: Google Postmaster Tools, free, after verifying the domain with a DNS record. Google shows data only for domains that send enough mail to Gmail on the day, so a low-volume domain may see nothing while the rule still applies.
When each rule started biting
What a failure looks like in the bounce
- 550 5.7.26 and 421 4.7.26: Gmail rejecting or deferring unauthenticated mail (no SPF or DKIM pass).
- 550 5.7.27, 550 5.7.30 and 550 5.7.40: SPF failed, DKIM failed, no DMARC record.
- 421 4.7.32: the From header does not align with the authenticated domain.
- 550 5.7.1 very low reputation: compliant mail from a domain Gmail does not trust yet, which is a reputation problem rather than a compliance one.
Every verified code is in the bounce code decoder, with whether warming has anything to do with it.
And Microsoft
Microsoft brought consumer Outlook.com, Hotmail and Live into line on 5 May 2025 with the same authentication standard for senders of 5,000 or more messages a day, rejected with 550 5.7.515. Its rules, its error codes and its consoles (SNDS and the Junk Mail Reporting Program) are on Microsoft bulk sender requirements (2026).
Compliance is the floor, not the goal
Meeting these rules gets the mail accepted instead of rejected. Whether it then lands in the inbox is decided on the domain's reputation: how recipients have treated its mail over time, how steady its volume has been, how low its complaints run. Compliance is binary and configured once; reputation is continuous and earned. A compliant domain with no history still lands in spam, and that gap is what warming closes: real engagement from real mailboxes on a ramp, which keeps the spam rate you are now required to hold down.