Gmail, Yahoo and Outlook Sender Requirements: A 2026 Checklist
The big mailbox providers now enforce authentication, easy unsubscribes and low spam rates for bulk senders. Use this checklist to see where you stand.
Since 2024 Gmail and Yahoo, and since 2025 Microsoft for Outlook.com, apply stricter rules to senders that send in bulk (the published threshold is about 5,000 messages a day to their users). In 2026 these rules are simply the baseline. Provider rules change, so confirm details in their current sender documentation.
The checklist
- SPF and DKIM are published and pass for every message.
- DMARC exists, at least with a monitoring policy, and your From domain aligns.
- One-click unsubscribe (the List-Unsubscribe-Post header) is supported on marketing mail, and requests are honoured quickly.
- Spam complaint rate stays low. Providers publish 0.3% as a hard ceiling and recommend staying far below it, around 0.1%.
- Valid forward and reverse DNS for sending IPs, and a connection secured with TLS.
- Clean lists: high bounce rates are a negative signal on their own.
Where verification fits
Authentication proves who you are. A clean list proves you know who you are writing to. Run your list through an email checker or the bulk verifier before campaigns, and verify new sign-ups in real time.
Quick self-test
Send a message to a Gmail address, open Show original, and confirm SPF, DKIM and DMARC all show PASS. Then look at your bounce rate from the last campaign. If it is above 2%, clean the list first.
What the three providers have in common
The details differ by provider, but the direction is the same. Bulk senders must authenticate, make unsubscribing easy and keep complaints low. A sender who meets Gmail's rules rarely has trouble with Yahoo or Outlook for the same reasons.
A common failure: alignment
Many senders have SPF and DKIM passing but still fail DMARC, because the domain in the visible From address does not match the domain that SPF or DKIM authenticated. This happens often when a marketing tool signs mail with its own domain. The fix is to set up a custom signing (DKIM) domain in the tool so it aligns with your From domain.
Monitor, do not guess
- Google Postmaster Tools shows your domain reputation and spam rate for Gmail traffic, if you send enough volume.
- DMARC reports (the rua address in your policy) show who sends mail as your domain and whether it passes.
- Your sending tool's bounce and complaint reports show problems per campaign.
Order of work for a new sender
- Publish SPF and DKIM, and DMARC with `p=none` and a reporting address.
- Read the reports for a few weeks, fix legitimate sources that fail.
- Move DMARC to `quarantine`, then `reject`, once nothing legitimate fails.
- Keep your list clean with regular verification.
