Google, Yahoo, and Microsoft Bulk Sender Requirements (2026)

Bulk Sender Requirements Overview

As of 2026, sender requirements differ by provider and sender volume. Gmail and Yahoo enforce baseline authentication for all senders and stricter controls for bulk senders (typically 5,000+ messages/day). Microsoft's published enforcement is scoped to high-volume senders to Outlook consumer mailboxes.

This guide covers the current requirements from each provider and how to verify your compliance using mxio's free tools.

Requirements Summary

All Senders

Every sender, regardless of volume, must meet these baseline requirements:

High-Volume Senders (5,000+ messages/day)

Additional requirements apply when you exceed 5,000 messages per day to any of these providers:

SPF Authentication Requirements

All three providers require valid SPF authentication for sending IPs.

What to check:

• Run the mxio SPF Checker on your sending domain
• Ensure the record is valid (no syntax errors)
• Confirm lookup count is under the 10-lookup limit
• Verify all sending IPs and third-party services are included
• Ensure you have only one SPF record

Key detail: SPF authentication alone isn't sufficient for DMARC. The Return-Path domain must align with the From: header domain.

DKIM Authentication Requirements

DKIM authentication is now required by all three providers, not just recommended.

What to check:

• Run the mxio DKIM Checker for each sending source
• Verify that 2048-bit keys are used (1024-bit is accepted but discouraged)
• Confirm that the DKIM d= domain matches or aligns with the From: domain
• Check that each third-party service (ESP, CRM, helpdesk) has DKIM configured with your domain

Key detail: DKIM is the most reliable authentication for DMARC alignment, especially for email sent through third-party services. Always configure DKIM even if SPF is already set up.

DMARC Record Requirements

A DMARC record must be published at _dmarc.yourdomain.com.

Minimum requirement: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

What to check:

• Run the mxio DMARC Checker on your domain
• Verify a record exists
• Confirm reporting is configured (rua= for aggregate reports)
• At minimum, p=none is required; p=quarantine or p=reject is recommended

Progression path:

1. Start with p=none to monitor without affecting delivery
2. Analyze reports for 2-4 weeks
3. Move to p=quarantine once legitimate sources consistently pass
4. Move to p=reject for maximum protection

See DMARC p=none: Why You Should Move to Enforce for guidance on progressing your policy. For a complete deployment walkthrough, see the DMARC Deployment Guide.

Unsubscribe Requirements

For marketing and bulk email, Gmail and Yahoo require the following; Microsoft currently publishes these as strong guidance for high-volume Outlook consumer traffic:

One-Click Unsubscribe (RFC 8058)

Add both of these headers to marketing messages:

List-Unsubscribe: <https://yourdomain.com/unsubscribe?id=xxx>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

This enables the "Unsubscribe" button in email clients. The unsubscribe endpoint must:

• Process the unsubscribe within 2 days
• Not require the user to log in or fill out a form
• Work via a POST request

Visible Unsubscribe Link

Include a clearly visible unsubscribe link in the message body. It should be easy to find (not hidden in tiny text).

Exemptions

Transactional emails (order confirmations, password resets, security alerts) are exempt from unsubscribe requirements. However, they still must pass authentication.

Spam Complaint Thresholds

How to monitor:

• Gmail: Use Google Postmaster Tools (postmaster.google.com) to see your domain's spam rate, reputation, and authentication rates
• Microsoft: Use SNDS (Smart Network Data Services) for reputation data
• Yahoo: Monitor bounce rates and adjust based on feedback loops

PTR Records (Reverse DNS)

Sending IPs should have valid PTR records that:

• Resolve to a hostname
• The hostname resolves back to the same IP (forward-confirmed reverse DNS)
• The hostname is under your domain or your provider's domain

Check your sending IP's PTR record with the mxio PTR Lookup.

See Missing PTR Record for fixing reverse DNS issues.

TLS Requirements

All connections should use TLS (STARTTLS) for transmission. Gmail has been warning about unencrypted connections since 2023 and now strongly favors TLS-secured connections in spam filtering.

Bulk Sender Compliance Checklist

Use this checklist to verify your domain meets all bulk sender requirements:

1. SPF: Run the mxio SPF Checker — record valid, all senders included, under 10 lookups
2. DKIM: Run the mxio DKIM Checker for each sending source — keys published, 2048-bit preferred
3. DMARC: Run the mxio DMARC Checker — policy published, reporting configured
4. PTR: Run the mxio PTR Lookup — valid reverse DNS for all sending IPs
5. Blacklists: Run the mxio Blacklist Check — all sending IPs clean
6. Unsubscribe: Verify List-Unsubscribe and List-Unsubscribe-Post headers on marketing email using the mxio Header Analyzer
7. Spam rate: Check Google Postmaster Tools — rate below 0.1%
8. Alignment: Verify DMARC reports show alignment passing for all sources

What Happens If You Do Not Meet Sender Requirements

Prevention and Ongoing Monitoring

Bulk sender requirements are not a one-time checklist. Provider policies evolve, sending infrastructure changes, and DKIM keys need rotation. Staying compliant requires continuous monitoring.

1. Set up domain health monitoring — Use the mxio Domain Health tool to monitor your SPF, DKIM, and DMARC records. Get alerts when authentication breaks or when a configuration change puts you out of compliance.
2. Use Managed SPF — If your SPF record is already near the 10-lookup limit, adding new sending services risks a PermError. mxio's Managed SPF keeps your record optimized automatically, so new includes never push you over the limit.
3. Review DMARC reports monthly — Aggregate reports reveal new sending sources, authentication gaps, and spoofing attempts. Catch problems before they affect deliverability.
4. Audit quarterly — Run the full compliance checklist above every quarter to verify nothing has drifted.

Related Articles

• Emails Going to Spam — Comprehensive spam troubleshooting
• Why Is DMARC Failing? — Fixing DMARC authentication failures
• No DMARC Record Found — Setting up DMARC from scratch
• Gmail Error 550 5.7.26 — Gmail DMARC rejection
• DMARC p=none: Why You Should Enforce — Moving beyond monitoring
• DMARC Deployment Guide — From p=none to p=reject, step by step
• SPF Too Many Lookups — Fixing the 10-lookup limit PermError