Gmail, Yahoo and Outlook.com sender rules: what applies to you if you are not a bulk sender

In February 2024 Gmail and Yahoo started enforcing rules on email sent to their users, and Outlook.com followed in May 2025. The headlines were about bulk senders: anyone sending around 5,000 messages a day. That makes it easy to assume the rules do not apply to a small business sending invoices and replies.

They do. Gmail’s email sender guidelines say that “all senders who send email to Gmail accounts must meet the requirements in this section”, and Yahoo’s sender best practices open with a list headed “Requirements for All Senders”. The list is short and most email services meet it for you. Mail goes wrong when your domain’s DNS records do not match how you actually send.

This article separates what applies to everyone from what applies to bulk senders, explains what happens to mail that fails, and covers the most common reason a small sender’s mail fails.

The three records the rules are about

The rules are mostly about three records you publish in your domain’s DNS. Each one lets a receiving server check that an email with your domain in the From line really came from you:

• SPF lists the servers allowed to send email for your domain.
• DKIM is a signature your email service adds to each message, checked against a public key in your DNS. It also shows the message was not altered on the way.
• DMARC ties SPF and DKIM to the domain in the From line the reader sees, and tells receivers what you want done with mail that fails: nothing (p=none), send it to spam (p=quarantine) or refuse it (p=reject).

The rules also mention two things your email provider looks after: reverse DNS (a PTR record mapping the sending server’s IP address back to a name) and TLS (encrypting the connection between servers). If you send through Google Workspace, Microsoft 365 or a mainstream email service, its servers already have both. If you run your own mail server, they are your job.

What every sender must do

These apply to a one-person business as much as to a retailer.

Gmail requires every sender to:

• Set up SPF or DKIM for the sending domain.
• Have valid forward and reverse DNS (PTR) records for the sending servers.
• Use TLS.
• Keep the spam rate reported in Google’s Postmaster Tools below 0.3%. Google’s FAQ says senders “should keep their spam rate below 0.1%”.
• Format messages according to RFC 5322, the standard for email messages.
• Not put a gmail.com address in the From line of mail sent through other servers. Google says it “will begin using a DMARC quarantine enforcement policy” for gmail.com, so a contact form or invoicing tool that sends “from” a gmail.com address will increasingly land in spam.
• Use a DKIM key of at least 1,024 bits when sending to personal Gmail accounts; Google recommends 2,048.

Yahoo asks the same of everyone: SPF or DKIM “at a minimum”, a spam rate below 0.3%, valid forward and reverse DNS, and compliance with the email standards (RFC 5321 and 5322). Its page does not mention TLS.

Outlook.com (Microsoft’s consumer service, including hotmail.com and live.com addresses) sets no hard requirements below its bulk threshold. Its announcement says enforcement targets large senders first, but that “all senders benefit from these best practices”.

The Gmail rules apply to mail sent to personal Gmail accounts. Google’s FAQ says they “don’t apply to messages sent to Google Workspace accounts”, meaning businesses that use Gmail with their own domain. Those businesses set their own filtering.

Who counts as a bulk sender

Gmail: “any email sender that sends close to 5,000 messages or more to personal Gmail accounts within a 24-hour period.” Three details are often missed:

• It is per day, not per month.
• “Messages sent from the same primary domain count toward the 5,000 limit”, so mail from news.example.com, billing.example.com and example.com is added together.
• It is permanent: senders who reach it once “are permanently considered bulk senders”, even if they send less later.

Outlook.com: domains sending more than 5,000 emails a day to Outlook.com, Hotmail and Live addresses, from 5 May 2025.

Yahoo: its sender page lists bulk requirements but gives no number. Pages that say Yahoo uses 5,000 a day are repeating Gmail’s figure.

A small business that sends its newsletter from its main domain can cross Gmail’s line on a single busy day without noticing, and from then on its invoices are judged by the bulk rules too.

What bulk senders must add

On top of everything above:

“Aligned” means the domain SPF or DKIM checked is the same domain (or a subdomain of the same organisation) as the one in the From line. An email can pass SPF for your invoicing provider’s domain and still fail DMARC for yours, because the two do not match.

One-click unsubscribe means two headers in the message, defined in RFC 8058, that let the mail app unsubscribe the reader with one button. Google is specific that “mailto and URL unsubscribe links” in the body do not meet the requirement on their own. Most newsletter services add the headers for you.

What happens to mail that does not comply

Gmail. Google’s FAQ says: “Starting November 2025, Gmail is ramping up its enforcement on non-compliant traffic. Messages that fail to meet the email sender requirements will experience disruptions, including temporary and permanent rejections.” Its table splits failures into two kinds:

• Delayed, rejected or sent to spam: no SPF or DKIM, From domain not aligned, no valid reverse DNS, no TLS, badly formatted messages.
• Losing Google’s help: no DMARC record, spam rate above 0.3%, no one-click unsubscribe. Google calls this “delivery support or mitigations unavailable”: your mail is not rejected for it, but Google will not help when other problems arise.

The bounce tells you which rule failed. A code starting with 4.7 is a temporary rate limit (the sending server retries); 5.7 is a permanent block. For example, 4.7.27 and 5.7.27 are SPF, 4.7.30 and 5.7.30 are DKIM, 4.7.32 is a From domain that is not aligned, and 4.7.23 or 5.7.25 is a missing reverse DNS record. The full list is in Google’s FAQ.

Outlook.com. Microsoft’s own pages disagree. The body of its April 2025 announcement says non-compliant mail “will first be routed to Junk”, and the Outlook.com postmaster site says the same. But an update added to the announcement on 29 April 2025 says Microsoft decided “to reject messages that don’t pass”, with the error 550 5.7.515 Access denied, sending domain does not meet the required authentication level. The update is the later statement, so treat rejection as the current behaviour, and if you see 5.7.515 in a bounce, this is why.

One practical point from the same announcement: asking recipients to add you to their safe senders list does not help. “Safe Sender list won’t be honored.”

Why a small business’s mail still fails

The most common cause is not the mailbox at all. It is the other services that send email as your domain:

• the invoicing or accounting tool that emails invoices “from” accounts@yourdomain;
• the newsletter service;
• the website’s contact form or online shop;
• a help desk, CRM or booking system.

Each one sends from its own servers. Unless your SPF record includes them, or they sign with DKIM for your domain, their mail fails alignment, and from the receiver’s side it looks exactly like someone forging your address. Most of these services have a “domain authentication” or “sender domain” page that gives you the DNS records to add.

Adding them to SPF has a limit people rarely hear about until it breaks. The SPF standard, RFC 7208, limits a record to 10 DNS lookups, and “if this limit is exceeded, the implementation MUST return ‘permerror’”. Each include: counts, and so do the includes inside it. A record with Microsoft 365, a newsletter service, an invoicing tool and a help desk can quietly cross 10, at which point SPF fails for all your mail, not just the last service added. DKIM has no such limit, which is one reason to prefer it for third-party services.

Two other small-sender problems:

• Two SPF records. A domain must have exactly one SPF record. Adding a second one (instead of adding an include to the first) breaks SPF entirely.
• A From address on a free mailbox. Sending business mail through a website or tool with a gmail.com, yahoo.com or outlook.com address in the From line will fail DMARC, because those servers are not allowed to send for those domains. Use an address on your own domain.

What to check, in order

1. Look up your domain’s records. Mailtria’s SPF, DKIM and DMARC checker reads your domain’s public DNS records, follows every SPF include and counts the lookups, checks the DMARC policy and the DKIM key length if you give it your selector, and says what to fix. It reads DNS only, so it cannot see your spam rate, your provider’s servers or a particular message.
2. List every service that sends as your domain. Check SPF covers each one, or that each signs with DKIM for your domain.
3. Publish a DMARC record if you have none. v=DMARC1; p=none; rua=mailto:you@yourdomain is enough to meet the bulk requirement and starts sending you reports of who is sending as your domain. Moving to p=quarantine or p=reject later protects your domain from being forged, but only once the reports show your own services all pass.
4. Check a real message. Send an email to a Gmail or Outlook.com address you own, open its headers (in Gmail, Show original) and look at the SPF, DKIM and DMARC results. Mailtria’s email header analyzer explains them in plain English and points out a From domain that does not match. Do this for mail from each service, not just your mailbox.
5. If you send more than a few hundred messages a day to Gmail users, set up Google Postmaster Tools for your domain. It is the only place to see the spam rate Google uses.

A note on the standard itself

DMARC was rewritten this year. RFC 9989, published in May 2026, replaces the original DMARC specification (RFC 7489). Existing records keep working: they still start with v=DMARC1, and none of the providers above has changed its requirements because of it.

Sources

• Google: Email sender guidelines, Email sender guidelines FAQ.
• Yahoo: Sender best practices.
• Microsoft: Strengthening email ecosystem: Outlook’s new requirements for high-volume senders (updated 30 April 2025), Outlook.com Postmaster.
• IETF: RFC 7208 (SPF), RFC 8058 (one-click unsubscribe), RFC 9989 (DMARC).