Gmail, Yahoo and Microsoft bulk sender requirements, side by side
What the three biggest mailbox providers require from anyone sending 5,000 or more emails a day, where they differ, and the error you get when you miss one.
Last updated 29 October 2026 · Ted Martin
Since February 2024, Gmail and Yahoo have required more from bulk senders than a working SMTP connection. Microsoft followed for Outlook.com in May 2025. The three sets of rules overlap heavily, but not completely, and the differences are where people get caught.
“Bulk sender” means roughly the same thing at all three: 5,000 or more messages a day to
their users. Gmail and Microsoft both count by the domain in your From: header, so
splitting traffic across IP addresses does not get you under the line.
What all three require
- SPF and DKIM, both passing. Below the bulk threshold Gmail and Yahoo accept either one. Above it, they want both.
- A DMARC record.
p=noneis enough. Nobody is requiring you to quarantine or reject yet, only to publish a policy and pass it. - Alignment. The domain in your
From:header has to match the domain that passed SPF or the one that signed with DKIM. This is the requirement most often missed, because a platform can pass SPF on its own bounce domain while your visible domain aligns with nothing.
Where they differ
| Gmail | Yahoo | Microsoft | |
|---|---|---|---|
| One-click unsubscribe | Required for marketing mail | Required, honour within 2 days | Not in the high-volume rules |
| Complaint rate | Below 0.3%, aim for 0.1% | Below 0.3% | Not published as a number |
| Reverse DNS, TLS | Required | Reverse DNS required | Not in the high-volume rules |
| Enforcement | Rejections ramping up since November 2025 | No public date | Rejection with 550 5.7.515 |
One-click unsubscribe means a List-Unsubscribe header plus List-Unsubscribe-Post, as
described in RFC 8058, so the mailbox’s own
unsubscribe button works without the recipient visiting a page. You still need a visible
link in the body as well. Gmail recommends honouring the request within 48 hours. Yahoo
requires it within two days.
Yahoo measures complaints against mail that reached the inbox, not mail you sent, so your own complaint rate will usually look lower than the figure Yahoo is using.
What failure looks like
Each provider tells you which rule you broke, if you read the response rather than a status label:
- Gmail returns
5.7.26for unauthenticated mail, and Google’s guidance says the4.7family is temporary while5.7is a block. - Microsoft returns
550 5.7.515 Access denied, sending domain does not meet the required authentication level.
A deferral is the cheap version of this lesson. A 4.7.x from Gmail is a warning with a
reason attached, arriving before anything has permanently failed. If you are only told that
a message “failed”, that warning never reaches you. We keep the full provider response on
every Outsend event for exactly this reason.
Sources
- Google: Email sender guidelines and the sender guidelines FAQ
- Yahoo: Sender best practices
- Microsoft: Postmaster policies and fixing error 550 5.7.515
Checked against each provider’s page on 29 October 2026. These rules change, and when they do, this post gets a dated note rather than a quiet edit.
Read the rest.
One operational note a week — incidents, trade-offs, and findings from running this thing.
Never venture-backed · operated by Martin Business Consultants