What Gmail, Yahoo and Microsoft now require from senders

For years, SPF, DKIM and DMARC were strong recommendations. You could skip them and still land mail, just less reliably. That era is over. Google and Yahoo made authentication and a few related rules mandatory for bulk senders in February 2024, and Microsoft brought Outlook.com and Hotmail into line in May 2025. The penalty for ignoring them is no longer a nudge toward spam, it is outright rejection: your mail bounces before it ever reaches an inbox.

Who has to comply

The rules target bulk senders, defined by Google, Yahoo and Microsoft as anyone sending roughly 5,000 or more messages per day to their users. The threshold is per day and measured across your domain, and crossing it even occasionally is enough for providers to hold you to the full standard. If you run cold outreach, newsletters, or any automated campaign at scale, assume you qualify. Lower-volume senders are still expected to authenticate, the enforcement is just gentler.

Rule one: authenticate everything

This is the non-negotiable core, and it is identical across all three providers. Three records, all required, all aligned:

• SPF. A DNS record listing the servers allowed to send mail for your domain. Keep it under the 10-lookup limit, or it silently fails.
• DKIM. A cryptographic signature on every message that proves it was not altered in transit and genuinely came from your domain.
• DMARC. A published policy at minimum p=none, with alignment: your visible From domain has to match the domain that passes SPF or DKIM (at least one of the two). Alignment is the part most senders miss, because a record can exist and still not align.

If you are not sure where you stand, run your domain through the free email auth checker to see all three records at once, and read SPF, DKIM & DMARC explained if you need to fix what it flags.

Rules two and three: unsubscribe and spam rate

Beyond authentication, bulk marketing mail has two more obligations:

• One-click unsubscribe. Marketing and promotional mail must include the RFC 8058 List-Unsubscribe and List-Unsubscribe-Post headers, so a recipient can opt out in a single click without leaving their inbox, and you must process the request within two days. Google enforced this from June 2024.
• Spam rate under 0.3 percent. Keep your reported spam complaint rate in Google Postmaster Tools below 0.10 percent, and never let it reach 0.30 percent. At 0.30 percent your domain reputation takes real damage and providers start treating you as a problem sender. This is the metric most directly tied to recipient sentiment, which is why it is the one warming and list hygiene exist to protect.

The enforcement timeline

These are the milestones that have already taken effect. Knowing the sequence matters, because enforcement was deliberately phased so that problems show up as a rising share of rejected mail rather than a single hard cutoff.

• February 2024: Google and Yahoo requirements take effect. Non-compliant bulk mail starts receiving temporary errors on a portion of traffic.
• April 2024: Google begins rejecting a percentage of non-compliant bulk traffic, increasing over time.
• June 2024: The one-click unsubscribe header requirement becomes enforceable for bulk senders.
• May 2025: Microsoft begins enforcing the same authentication standard on Outlook.com and Hotmail for high-volume senders. Non-compliant mail is routed to Junk, then rejected with a 550 5.7.515 Access denied error.

Compliance is the floor, not the goal

Here is the part the requirement checklists leave out. Meeting these rules does not get your mail into the inbox. It gets your mail accepted instead of rejected. Those are different things. Compliance is binary and one-time: your records either align or they do not, your unsubscribe header either exists or it does not. Once you pass, you pass.

Reputation is continuous and earned. After your compliant mail is accepted, the provider still has to decide between the primary inbox and the spam folder, and it makes that call on your sending history: how recipients have engaged with your mail over time, how steady your volume is, how low your complaints run. A perfectly compliant domain with no reputation still lands in spam. That gap is exactly what email warming closes.

Where MailStrike fits

Once your domain is compliant, MailStrike builds the reputation layer on top. Persona-based warming generates the engagement history providers look for: opens, replies, link clicks, mark-as-important, and spam rescues from real mailboxes, varied per inbox so the footprint reads like a real team rather than a script. It also keeps that history alive at low volume after you go live, which protects the spam rate you are now required to keep under control. Run the auth checker first to clear compliance, then start warming to earn placement.

Frequently asked questions about sender requirements