Email sender requirements: Gmail, Yahoo and Outlook, plus RFC 8058 one-click unsubscribe

Gmail, Yahoo and Outlook.com all require authentication from high-volume senders, and Gmail and Yahoo also set rules for every sender. Gmail↗ (opens in a new tab) asks every sender for SPF or DKIM, and bulk senders for SPF, DKIM and DMARC. Yahoo↗ (opens in a new tab) asks bulk senders for SPF, DKIM and a passing DMARC policy of at least p=none. Outlook.com↗ (opens in a new tab) has enforced SPF, DKIM and DMARC for domains sending over 5,000 emails a day since May 5, 2025.

The requirements side by side#

This table lists each provider's own requirements. Sources: Gmail's email sender guidelines↗ (opens in a new tab), Gmail's sender guidelines FAQ↗ (opens in a new tab), Yahoo's sender requirements↗ (opens in a new tab), Outlook.com's postmaster site↗ (opens in a new tab) and Microsoft's requirements announcement↗ (opens in a new tab).

A dash means that provider's pages listed here do not mention it, not that the provider allows it.

Gmail#

Gmail's email sender guidelines↗ (opens in a new tab) require SPF or DKIM from all senders, and SPF, DKIM and DMARC from bulk senders. For bulk senders, the DMARC policy can be none, and for direct email the From: domain must be aligned with either the SPF domain or the DKIM domain. Senders should keep the spam rate reported in Postmaster Tools below 0.10% and never reach 0.30% or higher. Bulk senders' marketing and subscribed messages must support one-click unsubscribe and include a clearly visible unsubscribe link in the message body. Messages must use TLS and follow the RFC 5322 message format, and sending domains or IPs need valid forward and reverse DNS (PTR) records.

Gmail's sender guidelines FAQ↗ (opens in a new tab) defines a bulk sender as one that sends close to 5,000 messages or more to personal Gmail accounts within 24 hours. All messages from the same primary domain count toward that number, and a sender that meets it once is permanently a bulk sender. The guidelines do not apply to mail sent to Google Workspace accounts, but Workspace users must meet them when sending to personal Gmail accounts.

Gmail began requiring this from bulk senders in February 2024, and from November 2025 it is ramping up enforcement, including temporary and permanent rejections. The FAQ lists what happens when a requirement is not met:

For the 550 5.7.26 bounce, see 550 5.7.26.

Yahoo#

Yahoo's sender requirements↗ (opens in a new tab) have been enforced since February 2024. For all senders they are: SPF or DKIM at a minimum, a spam rate below 0.3%, valid forward and reverse DNS for sending IPs, and compliance with RFC 5321 and RFC 5322.

Bulk senders must also:

• implement both SPF and DKIM;
• publish a valid DMARC policy of at least p=none, and DMARC must pass;
• align the From: domain with either the SPF domain or the DKIM domain (relaxed alignment is acceptable);
• support one-click unsubscribe for marketing and subscribed messages through a list-unsubscribe header, where the RFC 8058 POST method is highly recommended and the mail-to method is acceptable;
• show a visible unsubscribe link in the body and honor unsubscribes within 2 days.

Yahoo strongly recommends a rua reporting address in the DMARC record during initial setup, and its requirements are subject to change. A record that meets the minimum looks like this:

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

Outlook.com#

Since May 5, 2025, Outlook.com↗ (opens in a new tab) has enforced stricter authentication (SPF, DKIM and DMARC) for domains sending over 5,000 emails per day.

Microsoft's announcement↗ (opens in a new tab) requires compliance with SPF, DKIM and DMARC from those domains, and DMARC needs at least p=none and alignment with SPF or DKIM (preferably both). Non-compliant mail from those domains is routed to the Junk folder. In the future, at a date still to be announced, it will be rejected with 550; 5.7.515 Access denied. The announcement also tells senders to provide an easy, clearly visible way to opt out, particularly for marketing or bulk mail.

One-click unsubscribe (RFC 8058)#

RFC 8058↗ (opens in a new tab) defines one-click unsubscribe with two header fields. The List-Unsubscribe header must contain one HTTPS URI, and the List-Unsubscribe-Post header must contain the single pair List-Unsubscribe=One-Click. The message must have a valid DKIM signature that covers both headers. The POST request must not include cookies or other context, and the sender must not answer it with an HTTPS redirect.

In practice the message carries a List-Unsubscribe header with your HTTPS unsubscribe URI, plus this second header, exactly as written:

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Check your domain#

The DNS check is a free one-off check of the SPF, DKIM and DMARC records your domain publishes. It only reads public DNS records, and nothing is changed and no email is sent. To write a DMARC record, use the DMARC record generator. For moving past p=none, see DMARC policy not enabled; for reverse DNS problems, see reverse DNS does not match SMTP banner.

Sources#

• Google: Email sender guidelines↗ (opens in a new tab)
• Google: Email sender guidelines FAQ↗ (opens in a new tab)
• Yahoo: Sender requirements and recommendations↗ (opens in a new tab)
• Microsoft: Outlook.com postmaster↗ (opens in a new tab)
• Microsoft: Outlook's requirements for high-volume senders↗ (opens in a new tab)
• RFC 8058 §3.1: mail senders↗ (opens in a new tab)