Gmail, Yahoo and Microsoft sender rules: the 2026 checklist

What do Gmail, Yahoo and Microsoft require in 2026?

Each provider publishes its rules on its own sender pages. They overlap a lot, and the differences matter at the edges. Checked on October 7, 2026:

Apple's iCloud Mail has similar bulk rules (SPF, DKIM, a published DMARC policy and an unsubscribe link) and says that if any are missing, "the email will be rejected."

Which rules apply to every sender, at any volume?

Sending a few hundred emails a day does not exempt you. Gmail and Yahoo both list requirements for all senders:

• Authenticate with SPF or DKIM. Gmail needs a DKIM key of at least 1,024 bits and recommends 2,048.
• Give every sending IP valid forward and reverse DNS (PTR) records.
• Keep the user-reported spam rate under 0.3%.
• Format messages to the internet message standard, RFC 5322. Yahoo adds RFC 5321.
• Send over TLS, which Gmail requires of everyone.
• Never put a gmail.com address in the From line of mail that doesn't go out through Gmail.

If you send from Google Workspace, DKIM for your own domain is a setting your admin turns on; Google's sender guidelines link to the steps.

Who counts as a bulk sender?

• Gmail: a sender of "close to 5,000 messages or more to personal Gmail accounts within a 24-hour period." Every message from the same primary domain counts, so mail from sales.example.com and example.com adds up. Once a domain is classed as bulk, "Bulk sender status doesn't have an expiration date."
• Yahoo: "We will not specify a volume threshold." It judges senders at the level of the authenticated domain or the From domain.
• Microsoft: domains sending more than 5,000 emails a day to Outlook.com, Hotmail and Live addresses.

The practical answer is to meet the bulk-sender list anyway. DMARC at p=none and a one-click unsubscribe header cost little, and Yahoo can treat you as bulk without telling you where the line is.

What happens when your mail fails the rules?

Failure is now visible. Gmail's FAQ says: "Starting November 2025, Gmail is ramping up its enforcement on non-compliant traffic," with "temporary and permanent rejections." Its table of current enforcement splits the rules in two:

Microsoft said in its April 2025 update that from May 5, 2025 it would reject non-compliant bulk mail with the error "550; 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level." Its Outlook.com postmaster page still describes junk-folder delivery first, so plan for either. Yahoo says failing mail "may be sent to the spam folder or rejected," with an error code when it is rejected.

What does one-click unsubscribe actually require?

One-click unsubscribe means two email headers, defined in RFC 8058, that let the mail app unsubscribe someone without opening a web page:

• List-Unsubscribe-Post: List-Unsubscribe=One-Click
• List-Unsubscribe: an HTTPS address that removes the person as soon as it receives a POST request

The details differ by provider:

• Gmail does not count a mailto link or a link to a landing page as one-click. It also wants a visible unsubscribe link in the body, which can lead to a preferences page.
• Yahoo highly recommends the RFC 8058 method and accepts mailto.
• Both require it for marketing and promotional mail and exempt transactional mail such as password resets. Google adds that recipients, "not Google, determine the nature of the messages they receive."
• Gmail does not reject mail for missing one-click on its own, but a bulk sender without it gets no help with delivery problems.
• Opt-outs should take effect within 48 hours at Gmail (recommended) and within 2 days at Yahoo.

How is the spam rate counted?

Gmail calculates the spam rate daily, as the share of messages delivered to the inbox that recipients then mark as spam, and Postmaster Tools reports it for DKIM-signed mail. Yahoo also counts against mail delivered to the inbox. So 0.3% means three spam reports for every 1,000 emails that reached an inbox, and Google's 0.1% target means one.

• Above 0.3%, a Gmail bulk sender loses help with delivery issues until its rate stays under 0.3% for 7 consecutive days.
• Google says rates above 0.1% already hurt inbox placement for bulk senders.
• Google Postmaster Tools has a Compliance status dashboard, open to all senders, that marks each requirement Compliant or Needs work. Fixes can take up to 7 days to show.
• Yahoo's Complaint Feedback Loop sends you a copy of each spam report on DKIM-signed mail.

Do these rules cover B2B email to work addresses?

Strictly, no. Google says its sender guidelines "don't apply to messages sent to Google Workspace accounts," and Microsoft's rule covers Outlook.com, its consumer service. Most B2B prospects read email in Google Workspace or Microsoft 365, which run their own filtering.

That filtering still looks at the same signals. Microsoft 365 checks SPF, DKIM and DMARC and adds what it calls implicit authentication, built from other signals. Treat the bulk-sender list as the baseline for every domain you send from, whoever is on the other end. For scale, Google Workspace lets one user send up to 2,000 messages a day, to at most 2,000 unique external recipients, far more than one cold-outreach mailbox should send.

What do these rules mean for cold email?

Google's guidelines are written for mail that people asked for. Its list of practices to avoid includes "Don't purchase email addresses from other companies" and "Don't send messages to people who didn't sign up to get messages from you." Cold outreach starts outside that model, so it depends on how recipients react. These habits keep it within the rules:

• Write to the work addresses of people whose job matches the offer. Personal Gmail, Yahoo and Outlook.com addresses are where every rule above applies in full.
• Keep each mailbox's volume low and steady. Google advises a consistent rate without bursts, and raising volume slowly.
• Count per domain. Gmail adds up mail from a primary domain and its subdomains, and spreading sends across many domains leaves the spam rate of a bad list unchanged.
• Use honest headers. Google says no subject lines starting with Re: or Fwd: unless the message really is a reply or forward, and display names should name the sender, without subject text or the recipient's name.
• Make leaving easy. A one-click header plus a plain opt-out line in the body costs nothing and gives people an option besides the spam button.
• Remove addresses that bounce. Microsoft lists list hygiene and bounce management among its recommendations.

Laws apply on top of the providers' rules: CAN-SPAM in the US, and CASL in Canada, which requires consent before the first commercial email. Our CASL guide covers the consent routes that work for B2B.

The 2026 sender checklist

1. Publish an SPF record that includes every service sending as your domain, within the limit of 10 DNS lookups.
2. Turn on DKIM for your own domain, with a 2,048-bit key where your provider supports it.
3. Publish DMARC, starting at p=none with a rua address for reports, and move toward quarantine and reject once every sender passes.
4. Check that the From domain aligns with the SPF or DKIM domain.
5. Check that sending IPs have matching forward and reverse DNS, and that mail goes out over TLS.
6. Add List-Unsubscribe and List-Unsubscribe-Post headers with an HTTPS address, plus a visible opt-out line in the body.
7. Honour opt-outs within 48 hours, and suppress them across every tool and campaign.
8. Add your domain to Google Postmaster Tools and watch the spam rate and Compliance status; join Yahoo's Complaint Feedback Loop.
9. Keep spam reports under 0.1%, and fix the list long before you reach 0.3%.
10. Ramp new mailboxes slowly and send at a steady pace, without bursts.
11. Suppress addresses that bounce.
12. Use honest subject lines and display names.

What is still grey?

• Whether a one-to-one cold sales email counts as marketing for the one-click rule. Neither Google nor Yahoo says, and Google leaves the judgement to recipients.
• Microsoft's exact handling: its 2025 update says reject, and its postmaster page says junk first.
• Yahoo's bulk threshold, which it does not publish.
• Whether Gmail's November 2025 ramp-up has had further steps. Google's FAQ gives no later date.
• How Google Workspace and Microsoft 365 weigh spam reports for business recipients. Neither publishes a threshold.

This post reflects each provider's published pages as of October 7, 2026. Providers change these rules with little notice, so check the sources below before a large send.

Where Duckrow fits

Duckrow sends email from your own Google Workspace or Microsoft 365 mailboxes, so your domain's SPF, DKIM and DMARC records are the ones that count. Setting them up stays with you and your email admin: Duckrow does not check your DNS records, and it has no warm-up network or inbox placement tests. What Duckrow does handle:

• Every email carries the RFC 8058 one-click unsubscribe headers and a footer link, and an unsubscribe suppresses that address across the whole workspace.
• Bounces are detected, and the address is suppressed and marked Bounced.
• Each mailbox has a daily cap, 80 by default, and a new mailbox ramps from 20 a day up to its cap over 14 days.
• New leads go to the least-used mailbox, and each lead stays on its mailbox, with follow-ups in the same Gmail thread.
• Duckrow does not add open-tracking pixels to emails.