Gmail, Yahoo and Outlook Sender Requirements: What Your DNS Needs
Since February 2024 Gmail and Yahoo turn away mail that does not prove where it comes from, and Outlook.com joined in May 2025. The rules are not new technology — SPF, DKIM and DMARC have existed for years — but they stopped being optional. Most of the work is in DNS, and most of it takes an afternoon.
Who has to comply
The rules cover mail sent to personal mailboxes: gmail.com, Yahoo and AOL addresses, and outlook.com, hotmail.com and live.com. Some apply to every sender; the rest kick in when you send about 5,000 messages a day or more to one of those providers.
| Requirement | Every sender | 5,000+ a day |
|---|---|---|
| Authentication | SPF or DKIM | SPF and DKIM |
| DMARC record | Recommended | Required, p=none at least |
| From domain aligned with SPF or DKIM | Recommended | Required |
| Forward and reverse DNS of the sending IP | Required | Required |
| TLS when delivering | Required | Required |
| Spam complaint rate | Below 0.3% | Below 0.3%, aim for 0.1% |
| One-click unsubscribe (RFC 8058) | Recommended | Required for marketing mail |
news.example.com and example.com adds up — and once a domain has crossed the threshold, it stays classified as a bulk sender.The DNS part
Four kinds of records do the work. Your sending services (Google Workspace, Microsoft 365, newsletter tools, the shop) tell you their SPF include and DKIM key; you publish them on your domain:
; SPF — every service that sends as you, ending in ~all or -all
example.com. IN TXT "v=spf1 include:_spf.google.com include:_spf.esp.example ~all"
; DKIM — the public key your sending service gives you (often a CNAME)
s1._domainkey.example.com. IN CNAME s1.dkim.esp.example.
; DMARC — p=none is the minimum; rua collects the reports
_dmarc.example.com. IN TXT "v=DMARC1; p=none; rua=mailto:[email protected]"
; PTR — set by whoever owns the IP, must match an A record
80.113.0.203.in-addr.arpa. IN PTR mail.example.com.- Alignment means the domain in the visible From address matches the domain that passed SPF (the envelope sender) or DKIM (the
d=of the signature). A newsletter tool that signs with its own domain passes DKIM but is not aligned — set up its custom-domain or "authenticated domain" option. - One SPF record per domain, under 10 DNS lookups. Adding one more service often breaks it; the SPF guide explains the limit.
- PTR is set by whoever owns the IP address — your VPS or hosting provider, not your DNS zone. With Google, Microsoft or a mailing service it is already done. See PTR records.
- Never send as `@gmail.com` or any other address you do not control: Gmail's own DMARC policy rejects it.
One-click unsubscribe
Marketing and subscription mail from bulk senders must carry two headers that let the mailbox show its own Unsubscribe button. Clicking it makes a POST request to your URL — no landing page, no login:
List-Unsubscribe: <https://example.com/u/8f3a2c>, <mailto:[email protected]?subject=8f3a2c>
List-Unsubscribe-Post: List-Unsubscribe=One-Click- Process the request within two days.
- Sign both headers with DKIM, or receivers ignore them.
- Keep a visible unsubscribe link in the message body as well.
- Transactional mail — receipts, password resets, alerts — does not need it.
Keep complaints under 0.3%
The complaint rate is the share of delivered messages that recipients mark as spam. Above 0.3% mail starts going to spam or is refused, and recovering takes weeks of clean sending. Sending only to people who asked for it and making unsubscribing easy are the two levers that matter.
Checklist
What happens if you do not comply
Non-compliant mail first gets temporary errors and a spam-folder placement, then outright rejection. Gmail answers with codes such as 5.7.26 (unauthenticated sender) and Outlook.com with 5.7.515 (the sending domain does not meet the required authentication level). The bounce reaches the sender, not the recipient, so problems often go unnoticed until customers say they never got the invoice.
p=none, read the aggregate reports for a few weeks: a forgotten sender — the CRM, the invoicing tool — will start failing the moment you enforce. How to set up DMARC walks through it.Frequently asked questions
Do the rules apply if I send fewer than 5,000 emails a day?
The basic ones do: SPF or DKIM, valid PTR, TLS and a low complaint rate. DMARC, alignment and one-click unsubscribe are strictly required only above the threshold, but they are worth having anyway.
Is DMARC p=none enough?
For the requirement, yes. It does not protect your domain from spoofing, though — that takes p=quarantine or p=reject once the reports show every legitimate sender passing.
Do receipts and password resets need an unsubscribe header?
No. One-click unsubscribe is required for marketing and subscription mail, not for transactional messages.
Do the rules apply to Google Workspace or Microsoft 365 recipients?
The published requirements target personal mailboxes, but business mailboxes run similar filters, so the same setup is what gets mail delivered there too.
See the theory in practice — run a Email Security Check for your own domain.