Domain Scanner
Analyze your domain for potential email issues and vulnerabilities with our email domain check tool.
Bulk Sender Guidelines · DMARC Requirements
Google, Yahoo & Microsoft Bulk Sender Requirements
Gmail and Yahoo (since February 2024) and Outlook.com (since May 2025) require SPF, DKIM and a DMARC policy from domains that send email in bulk. See what each provider requires below, then check your domain's DNS against those requirements for free.
Loading...
See it in Action
May 2025
Outlook.com bulk sender rules enforced
0.3%
spam complaint rate Gmail & Yahoo bulk senders must stay under
5,000+
emails/day to Gmail or Outlook.com makes you a bulk sender
Feb 2024
Google & Yahoo bulk sender rules took effect
Gmail · Yahoo · Outlook.com
Bulk Sender Requirements by Provider
What Google, Yahoo and Microsoft each require from email senders, side by side. The DMARC requirement is the same everywhere: publish a policy of at least p=none and make sure SPF or DKIM aligns with your From: domain.
| Requirement | Google (Gmail) | Yahoo Mail | Microsoft (Outlook.com) |
|---|---|---|---|
| Who it applies to | All senders to personal Gmail accounts; extra rules for bulk senders (close to or more than 5,000 messages a day) | All senders to Yahoo Mail; extra rules for bulk senders | Domains sending more than 5,000 emails a day to Outlook.com, Hotmail.com and Live.com |
| In force since | 1 February 2024, with stricter enforcement from November 2025 | February 2024, phased in through the first half of 2024 | 5 May 2025 (announced April 2025) |
| SPF and DKIM | Bulk: both SPF and DKIM. All senders: SPF or DKIM | Bulk: both SPF and DKIM. All senders: SPF or DKIM | Both SPF and DKIM must pass |
| DMARC policy | Required for bulk senders; p=none is enough | Required for bulk senders; at least p=none, and DMARC must pass | Required; at least p=none (p=reject recommended) |
| Alignment with the From: domain | From: domain must align with the SPF or DKIM domain | From: domain must align with SPF or DKIM; relaxed alignment is fine | DMARC must align with SPF or DKIM, ideally both |
| One-click unsubscribe | Required for marketing and subscribed mail (RFC 8058 headers) plus a visible link | Required for marketing and subscribed mail; RFC 8058 POST recommended; honour within 2 days | Not part of the high-volume rules; general guidelines ask for an easy, clearly documented unsubscribe |
| Spam complaint rate | Below 0.30% in Postmaster Tools (aim for below 0.10%) | Below 0.3% | No published threshold; monitor with SNDS and JMRP |
| Reverse DNS (PTR) and TLS | Valid forward and reverse DNS; TLS required | Valid, non-generic reverse DNS; TLS not listed | Valid reverse DNS (general guidelines) |
| If you don't comply | Mail may be rate-limited, sent to spam or rejected | Mail may be deferred or rejected | Mail goes to Junk and can be rejected with 550 5.7.515 |
Active Requirements
Email Authentication Compliance Standards
Provider requirements in more detail, plus the payment-security and healthcare standards that also point to email authentication.
Google Workspace
Since February 2024
- ✓DMARC policy must be published — minimum p=none to start.
- ✓Valid SPF and DKIM records required for all sending domains.
- ✓Outbound email alignment: From header must match SPF/DKIM domain.
- ✓Spam rate below 0.10% (hard limit: 0.30%) — track yours in Google's free Postmaster Tools.
- ✓One-click unsubscribe headers required in all marketing mail.
- ✓Valid forward and reverse DNS (PTR) for sending IPs, and TLS for transmission.
Yahoo Mail
Since February 2024
- ✓All senders: SPF or DKIM, valid forward and reverse DNS, and RFC 5321/5322-compliant mail.
- ✓Bulk senders: both SPF and DKIM, plus a DMARC policy of at least p=none that passes (relaxed alignment is fine).
- ✓Valid, non-generic reverse DNS (PTR) for every sending IP.
- ✓One-click unsubscribe for marketing and subscribed mail, honoured within 2 days.
- ✓Keep spam complaints below 0.3% — enrol in Yahoo's free Complaint Feedback Loop to see yours.
- ✓Mail that does not meet the standards can be deferred or rejected.
PCI DSS v4.0
Effective March 2025
- ✓Requirement 5.4.1: processes and automated mechanisms to detect and protect personnel against phishing attacks.
- ✓PCI guidance names anti-spoofing controls such as DMARC, SPF and DKIM as ways to meet it.
- ✓Your QSA decides what evidence satisfies 5.4.1 — DMARC at p=reject is strong, easy-to-show proof.
- ✓Protect cardholder-facing mail (receipts, billing notices) from spoofing with aligned SPF and DKIM.
Microsoft Outlook.com
Outlook.com: since May 2025
- ✓Outlook.com, Hotmail.com and Live.com require SPF, DKIM and DMARC (at least p=none, aligned with SPF or DKIM) from domains sending more than 5,000 emails/day.
- ✓Non-compliant high-volume mail is sent to Junk, and can be rejected with error 550 5.7.515.
- ✓Composite Authentication in Exchange Online combines SPF, DKIM, DMARC and ARC results.
- ✓p=reject domains get full block treatment in Exchange Online Protection.
- ✓Enrol your sending IPs in Microsoft's free SNDS and JMRP programs to see reputation and complaints.
Apple Mail
Ongoing
- ✓iCloud Mail recommends that senders authenticate with SPF, DKIM and DMARC.
- ✓Prefer SPF -all (hard fail); ~all is a soft fail that only marks unlisted senders as suspicious.
- ✓BIMI logos in Apple Mail (iOS 16 / macOS Ventura and later) need DMARC at p=quarantine or p=reject and a Verified Mark Certificate.
- ✓Encrypt mail in transit with TLS — MTA-STS lets you require it for mail sent to your domain.
HIPAA — Healthcare
Ongoing Compliance
- ✓Email used for PHI transmission must be secured — DMARC recommended.
- ✓Covered entities must implement safeguards against email impersonation.
- ✓Security Risk Assessment must include email authentication protocols.
- ✓Business Associate Agreements must cover email security controls.
- ✓Breach notification requires evidence of authentication controls in place.
Need help configuring these standards for GoDaddy, Cloudflare, AWS, or Google Workspace? Refer to our step-by-step DMARC Setup Guides.
How to Check Your Domain Against the Requirements
The authentication rules live in DNS, so you can check them yourself in a minute with our free tools.
Step 1
Scan the whole domain
The domain scanner checks SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI in one pass and flags the gaps against the requirements above.
Open the domain scanner →Step 2
Check the DMARC record
Confirm a DMARC record exists, that it parses, which policy it sets (p=none, quarantine or reject) and where reports go.
Run a DMARC lookup →Step 3
Check SPF and DKIM
Make sure every service that sends as you is in SPF, stays under the 10-lookup limit, and signs with a published DKIM key.
Run an SPF lookup →Step 4
Check what DNS can't show
Spam complaint rate, one-click unsubscribe and IP reputation are not in DNS. Track them in Google Postmaster Tools, Yahoo's Complaint Feedback Loop and Microsoft SNDS.
What's at Stake
Consequences of Non-Compliance
Domains that fail to meet these requirements face immediate and severe consequences to email delivery, brand reputation, and regulatory standing.
Email Bounces
HighNon-compliant domains receive 421 (temporary) or 550 (permanent) bounce codes from Google and Yahoo, causing immediate delivery failures.
Spam Folder Delivery
HighGmail, Yahoo and Outlook.com now require SPF, DKIM and DMARC from bulk senders. Without them, even legitimate marketing email can be filtered to spam or rejected.
Brand Impersonation
CriticalWithout p=reject, attackers can freely send phishing emails from your domain. Customers lose trust when they receive fraudulent emails 'from you'.
PCI Audit Failure
CriticalPCI DSS v4.0 Requirement 5.4.1 requires anti-phishing controls. DMARC is one of the anti-spoofing controls PCI guidance names — without it you need other evidence for your QSA, and a gap becomes an audit finding.
How YourDMARC Helps You Meet the Sender Requirements
Publishing a record takes a minute. Keeping every sending service authenticated and aligned is the ongoing work.
DMARC monitoring
Point your DMARC rua address at YourDMARC and every aggregate report from Gmail, Yahoo, Outlook.com and other receivers is parsed into one dashboard: who sends as your domain, and what passes or fails alignment.
How DMARC monitoring works →Fix failing senders
See each sending source with its SPF, DKIM and alignment results, so you know which service to fix before a provider starts rejecting it. Alerts and a weekly report keep you informed when something changes.
See the features →Staged enforcement
Move from p=none to quarantine to reject only when your real senders pass, following the roadmap below. Prefer it done for you? Our managed service takes your domains to enforcement.
Managed DMARC service →Step-by-Step Roadmap
From p=none to p=reject: Staged DMARC Enforcement
Meeting the requirements takes p=none. Protecting your domain takes enforcement. This is the staged path YourDMARC walks you through.
1
Publish DMARC Record
Day 1Add a DMARC TXT record with p=none to start collecting reports without affecting delivery.
v=DMARC1; p=none; rua=mailto:{your-business-id}@mail.yourdmarc.online2
Monitor & Identify Senders
30-60 DaysAnalyze 30-60 days of aggregate reports to identify all legitimate email sources sending on your behalf.
Review: Mailchimp, Salesforce, GSuite, HubSpot…3
Authorize All Senders
30-45 DaysAdd all legitimate senders to your SPF record and ensure each has proper DKIM signing configured.
v=spf1 include:mailchimp.com include:_spf.google.com -all4
Move to p=quarantine
2-4 WeeksAdvance to quarantine policy once all legitimate senders pass alignment. Failing mail goes to spam.
v=DMARC1; p=quarantine; rua=mailto:{your-business-id}@mail.yourdmarc.online5
Achieve Full Enforcement
Final StageSet p=reject to block unauthenticated mail. This completes the authentication side of every major provider's requirements.
v=DMARC1; p=reject; rua=mailto:{your-business-id}@mail.yourdmarc.onlineCheck Your Compliance Status in 10 Seconds
Use our free scanner above to instantly audit the SPF, DKIM and DMARC setup of your domain against the major provider requirements. Then let YourDMARC guide you to full enforcement with step-by-step recommendations.
FAQ
Sender Requirements — Frequently Asked Questions
Answers to common questions about the Google, Yahoo and Microsoft sender requirements, PCI DSS and email authentication compliance.
All three ask bulk senders to authenticate mail with SPF and DKIM and to publish a DMARC policy of at least p=none, with the From: domain aligned to the SPF or DKIM domain. Gmail and Yahoo also require one-click unsubscribe for marketing and subscribed mail, a spam complaint rate below 0.3%, and valid reverse DNS for sending IPs; Gmail also requires TLS. Gmail and Yahoo began enforcing in February 2024 and Outlook.com on 5 May 2025.
Microsoft announced in April 2025 that domains sending more than 5,000 emails a day to its consumer addresses (Outlook.com, Hotmail.com, Live.com) must pass SPF and DKIM and publish DMARC with at least p=none, aligned with SPF or DKIM (ideally both). Enforcement started on 5 May 2025: non-compliant mail goes to Junk and can be rejected with 550 5.7.515. These rules cover Outlook.com consumer mailboxes, not Microsoft 365 business tenants.
For the authentication part, yes: Gmail, Yahoo and Outlook.com all accept p=none, as long as DMARC passes with aligned SPF or DKIM. But p=none only monitors; it does not stop anyone spoofing your domain. Microsoft recommends p=reject, and moving to p=quarantine and then p=reject once all your legitimate senders pass is how you actually protect the domain.
Google defines a bulk sender as one that sends close to or more than 5,000 messages to personal Gmail accounts within a 24-hour period, and the status sticks once reached. Microsoft applies its rules to domains sending more than 5,000 emails a day to Outlook.com, Hotmail.com and Live.com addresses. Yahoo has baseline rules for every sender and stricter rules for bulk senders. Even if you send fewer than 5,000 emails a day, the all-sender rules still apply, and DMARC is worth having for brand protection.
PCI DSS v4.0 Requirement 5.4.1, mandatory since 31 March 2025, requires processes and automated mechanisms to detect and protect personnel against phishing attacks. It does not name DMARC by itself, but PCI guidance lists anti-spoofing controls such as DMARC, SPF and DKIM as ways to meet it. Your QSA (Qualified Security Assessor) decides what evidence is acceptable; a DMARC policy at p=reject, with aligned SPF and DKIM on the domains you use for receipts and billing mail, is strong and easy to demonstrate.
Gmail can rate-limit, mark as spam or reject mail from senders that do not meet its requirements; unauthenticated mail is typically rejected with a 5.7.26 error. For transactional email like order confirmations and password resets, that means customers never receive messages they are waiting for.
No. DMARC protects recipients from receiving spoofed emails claiming to come from your domain. Inbound email security gateways filter malicious emails hitting your employees' inboxes. Both are needed: DMARC secures your outbound domain identity, while a gateway protects your inbound mail flow.
Use the compliance scanner above. Enter your domain name and click Check to instantly analyze your DNS records for SPF presence and syntax, DKIM key publication, DMARC record publication and policy level, MTA-STS / TLS-RPT configuration, and BIMI. It covers the DNS-based requirements; sending-practice rules such as spam rate and one-click unsubscribe are not visible in DNS, so check those in each provider's own postmaster program.
No, and you don't need it to. What Google, Yahoo and Microsoft require of senders comes down to SPF, DKIM and DMARC alignment, which YourDMARC monitors through your DMARC reports and helps you fix. Complaint rates and IP reputation are shown only to you, through each provider's free program. We recommend enrolling directly in Google Postmaster Tools, Yahoo's Complaint Feedback Loop, and Microsoft SNDS and JMRP.
DMARC alignment requires that the domain in the From: header (the address your recipients see) matches the domain validated by either SPF or DKIM. For SPF alignment, the domain in the Return-Path (SMTP envelope from) must match the From: header. For DKIM alignment, the d= tag in the DKIM signature must match the From: header domain. Without alignment, even a passing SPF or DKIM check will still fail DMARC — which is a common misconfiguration.
Schedule a Demo
Discover more about YourDMARC and book a demo with sales.
Choose the Right Plan
Explore our flexible plans and pricing for perfectly fit solutions.
Learn more
Explore our latest blogs for expert insights on email spoofing prevention.
As a global team, we’re always available. Let’s talk!
© 2026 YourDMARC
Download to read the eBook