# Gmail and Yahoo Sender Requirements Explained

URL: https://email-validation.org/guides/gmail-yahoo-sender-requirements/
Updated: 2026-11-06

> Documentation index: https://email-validation.org/llms.txt

Since February 2024, Gmail and Yahoo expect every sender to authenticate their mail with SPF or DKIM, to send from
servers with valid forward and reverse DNS, and to keep the spam rate their users report below 0.3%. Bulk senders
must do more: publish SPF and DKIM and a DMARC policy, align the From: domain with one of them, and offer one-click
unsubscribe in marketing mail. Mail that misses a requirement can be deferred, rejected or filed as spam.

## Who counts as a bulk sender

Google defines it with a number. Its
[sender guidelines FAQ](https://support.google.com/a/answer/14229414) calls you a bulk sender once you send close to
5,000 messages or more within 24 hours to personal Gmail accounts. Messages from the same primary domain are added
together, subdomains included, so 2,500 from `example.com` and 2,500 from `news.example.com` on the same day reach the
mark. The status is permanent: a sender who has crossed the line once stays a bulk sender even if its volume drops
later.

Yahoo's [sender best practices](https://senders.yahooinc.com/best-practices/) list separate requirements for bulk
senders but publish no volume threshold. If you send marketing or newsletters at any real scale, plan to meet the
bulk rules at both providers.

Google's rules cover mail to personal Gmail accounts. The FAQ says they do not apply to mail sent to Google
Workspace accounts, although they do apply to mail sent from Workspace to personal Gmail addresses.

## Requirements for every sender

Both providers ask the same baseline of anyone who sends to their users, whatever the volume:

- **SPF or DKIM.** At least one of the two must authenticate the message. Unauthenticated mail to Gmail may be
  refused with [550 5.7.26](https://email-validation.org/bounce-codes/550-5-7-26/).
- **Valid forward and reverse DNS.** The sending IP address needs a PTR record that resolves to a host name, and
  that host name must resolve back to the same IP. Google spells out this round trip in its
  [email sender guidelines](https://support.google.com/mail/answer/81126); Yahoo also recommends that PTR names be
  meaningful, reflect your domain and not look like dynamically assigned addresses. A missing PTR record is the
  usual cause of [550 5.7.25](https://email-validation.org/bounce-codes/550-5-7-25/) ([reverse DNS for mail servers](https://email-validation.org/guides/reverse-dns-ptr/)).
- **A spam rate below 0.3%.** Google measures it in Postmaster Tools; Yahoo computes it from mail that was delivered
  to the inbox, so your own complaint figures may not match theirs exactly.
- **Standard messages.** Messages must follow RFC 5322 (the message format), and Yahoo also names RFC 5321 (the SMTP
  conversation).
- **TLS** for the connection, at Gmail. Google added this requirement in December 2023. For mail coming in to your
  own domain, [MTA-STS](https://email-validation.org/guides/mta-sts-tls-rpt/) asks other senders to use TLS too.
- **No impersonation of gmail.com** in the From: header.

## Extra requirements for bulk senders

| Requirement | Gmail | Yahoo |
|---|---|---|
| Authentication | SPF **and** DKIM | SPF **and** DKIM |
| DMARC | A published policy; `p=none` is enough | A policy of at least `p=none`, and DMARC must pass |
| Alignment | From: domain matches the SPF or the DKIM domain | The same; relaxed alignment is accepted |
| Unsubscribe | One-click for marketing and subscribed mail, plus a visible link in the body | One-click header, a visible link in the body, honored within 2 days |
| Spam rate | Below 0.3% (recommended: below 0.1%) | Below 0.3% |

### Authentication and alignment

DMARC passes when SPF or DKIM passes **and** the domain it authenticated matches the domain in the visible From:
header. If your newsletter platform signs with its own domain and uses its own bounce domain, both checks can pass
while neither aligns with your From: domain, and the bulk requirement is still not met. The fix is to let the
platform sign with a DKIM key on your domain, or to use a return-path (bounce) domain under your own domain.

Google asks for DKIM keys of at least 1024 bits for mail to personal Gmail accounts and recommends 2048 bits where
your system supports it ([DKIM selectors and key rotation](https://email-validation.org/guides/dkim-selectors-key-rotation/)). Yahoo also asks for 1024 bits or more and recommends that anyone who forwards mail adds ARC
headers ([RFC 8617](https://www.rfc-editor.org/info/rfc8617/)). Google's FAQ notes that alignment is not required for
forwarded and mailing-list mail.

Check what you publish with the [SPF checker](https://email-validation.org/tools/spf-checker/), the [DKIM checker](https://email-validation.org/tools/dkim-checker/) and the
[DMARC checker](https://email-validation.org/tools/dmarc-checker/). If you have no DMARC record yet, the [DMARC generator](https://email-validation.org/tools/dmarc-generator/)
writes a `p=none` record with a reporting address (`rua`). Both providers accept `p=none`, and Yahoo strongly
recommends the reporting address: the reports show which of your services send mail as your domain before you
tighten the policy ([how to read DMARC aggregate reports](https://email-validation.org/guides/dmarc-aggregate-reports/)).

### One-click unsubscribe

[RFC 8058](https://www.rfc-editor.org/info/rfc8058/) defines one-click unsubscribe with two headers:

```
List-Unsubscribe: <https://example.com/unsubscribe?u=…>
List-Unsubscribe-Post: List-Unsubscribe=One-Click
```

When a user clicks unsubscribe in the mail app, the mailbox provider sends an HTTPS POST to that address, and your
server must remove the person without asking them to log in or confirm anything. The RFC requires both headers to be
covered by a valid DKIM signature.

The providers differ in the details. Google's FAQ says a `mailto:` address or a link to a landing page does not meet
its requirement, and that transactional messages such as password resets are exempt. Yahoo highly recommends the
POST method but also accepts `mailto:` ([one-click unsubscribe, step by step](https://email-validation.org/guides/list-unsubscribe-one-click/)). Both want a clearly visible unsubscribe link in the body as well; it may lead
to a preference page. Yahoo asks you to honor an unsubscribe within 2 days; Google recommends doing it within 48
hours.

### Spam rate

The spam rate is the share of delivered messages that users mark as spam. Google calculates it daily, recommends
staying below 0.1% and asks senders never to reach 0.3%. According to its FAQ, since June 2024 a bulk sender above
0.3% cannot get mitigation help from Gmail, and it needs seven days in a row below 0.3% to qualify again.

You can watch your rate in [Google's Postmaster Tools](https://email-validation.org/guides/google-postmaster-tools/). At Yahoo, sign your mail
with DKIM and enroll in its Complaint [Feedback Loop](https://email-validation.org/guides/email-feedback-loops/), which sends you a copy of each complaint so you can remove the person. Complaints usually come from
people who no longer expect your mail, so the practical levers are consent, a frequency people signed up for, and an
easy way out.

## How enforcement works

Both providers began in February 2024 and describe enforcement as gradual. Gmail's FAQ says that from November 2025
it is ramping up enforcement on non-compliant traffic, and that a message which misses a requirement may be
rejected, temporarily or permanently, or delivered to the spam folder. New domains, which Google defines as domains
that have not sent more than 5,000 messages a day to personal Gmail accounts since 1 January 2024, are on a faster
timetable. Google's FAQ also lists failures, such as a high spam rate, a missing DMARC policy or missing one-click
unsubscribe, that cost you Gmail's delivery support and mitigation.

The bounce code tells you which requirement failed. Common ones from Gmail:

- [550 5.7.26](https://email-validation.org/bounce-codes/550-5-7-26/): the message was not authenticated, or DMARC failed.
- [550 5.7.27](https://email-validation.org/bounce-codes/550-5-7-27/) and [550 5.7.30](https://email-validation.org/bounce-codes/550-5-7-30/): SPF or DKIM failed for a bulk
  sender.
- [5.7.32](https://email-validation.org/bounce-codes/5-7-32/): the From: domain is not aligned with SPF or DKIM.
- [550 5.7.40](https://email-validation.org/bounce-codes/550-5-7-40/): a bulk sender without a DMARC policy.
- [550 5.7.29](https://email-validation.org/bounce-codes/550-5-7-29/): no TLS.
- [421 4.7.28](https://email-validation.org/bounce-codes/421-4-7-28/): Gmail is rate limiting your mail.

## Where list quality comes in

Neither provider publishes a bounce-rate limit, but both describe consent and list care as part of the rules. Google
asks senders to email only people who want the mail, to confirm each address before subscribing it, and to avoid
pre-checked opt-in boxes. Yahoo asks senders to remove invalid recipients promptly, to monitor hard and soft
bounces, and recommends [double opt-in](https://email-validation.org/guides/double-opt-in/). Mailing addresses that no longer exist also wastes
the reputation you build with authentication, and old lists are where
[recycled spam traps](https://email-validation.org/guides/spam-traps/) hide.

Verifying a list before a large send removes the addresses that would hard-bounce today; see
[how to clean an email list](https://email-validation.org/guides/email-list-cleaning/).

## Questions

### Do these rules apply if I send fewer than 5,000 messages a day?

Yes, the baseline does: SPF or DKIM, valid forward and reverse DNS, TLS at Gmail, standard message format and a spam
rate below 0.3%. The bulk rules add DMARC, alignment and one-click unsubscribe. Meeting them anyway costs little and
protects you if your volume grows.

### Is `p=none` really enough?

For these requirements, yes: both providers accept a DMARC policy of `p=none`. It tells receivers to take no action
on failing mail and to send you reports. A stricter policy (`quarantine` or `reject`) adds protection against people
forging your domain, and it is what [BIMI](https://email-validation.org/guides/bimi-requirements/) needs before a logo shows, but move to it only once the reports show that all your legitimate mail passes
([moving DMARC from p=none to p=reject](https://email-validation.org/guides/dmarc-none-to-reject/)).

### Do transactional emails need one-click unsubscribe?

Not at Gmail: its FAQ limits the requirement to marketing and promotional messages, and names password resets and
reservation confirmations as exempt. Yahoo applies it to marketing and subscribed messages
([transactional vs marketing email](https://email-validation.org/guides/transactional-vs-marketing-email/)).

### Do Outlook.com and Hotmail have the same rules?

Similar, but not identical. Microsoft announced its own requirements for high-volume senders in 2025; see
[Outlook sender requirements](https://email-validation.org/guides/outlook-sender-requirements/).

## Try it

Check your domain's records with the [DNS tools](https://email-validation.org/tools/), look up a bounce in the
[bounce code dictionary](https://email-validation.org/bounce-codes/), and clean your list with
[bulk email verification](https://email-validation.org/bulk-email-verification/) before your next campaign.

## Related

- [Glossary: SPF, DKIM and DMARC](https://email-validation.org/glossary/#spf-dkim-dmarc) and [sender reputation](https://email-validation.org/glossary/#sender-reputation).
- [The valid status](https://email-validation.org/docs/statuses/valid/#why-complaints-hurt): why complaints hurt.

## Related guides

- [Outlook.com requirements for high-volume senders](https://email-validation.org/guides/outlook-sender-requirements/)
- [Email warm-up for new IPs and domains](https://email-validation.org/guides/email-warm-up/)
- [Reduce your email bounce rate](https://email-validation.org/guides/reduce-email-bounce-rate/)
- [Spam traps explained](https://email-validation.org/guides/spam-traps/)
- [Double opt-in (confirmed opt-in)](https://email-validation.org/guides/double-opt-in/)
- [All guides](https://email-validation.org/guides/)

## Sources

- [Google: Email sender guidelines](https://support.google.com/mail/answer/81126).
- [Google: Email sender guidelines FAQ](https://support.google.com/a/answer/14229414): bulk sender definition,
  enforcement, spam rate and unsubscribe details.
- [Yahoo: Sender best practices](https://senders.yahooinc.com/best-practices/).
- [RFC 8058, Signaling One-Click Functionality for List Email Headers](https://www.rfc-editor.org/info/rfc8058/).
- [RFC 8617, The Authenticated Received Chain (ARC) Protocol](https://www.rfc-editor.org/info/rfc8617/).

## Get up to 500 free credits. No card needed.

New accounts get 500 free credits (100 when you sign up with a free email provider such as Gmail, Outlook or Yahoo, or another personal mailbox such as a paid one like Fastmail or one from your internet provider). Try it on your own list before you buy. [Create your account](https://email-validation.org/signin/?new=1) or [open the free email checker](https://email-validation.org/email-checker/).