Email Sender Rules for 2026: What Gmail, Yahoo and Microsoft Now Require

If your business sends newsletters, order confirmations or password resets, the rules for getting into the inbox changed for good over the last two years. Google, Yahoo and Microsoft now expect every serious sender to prove who they are, make unsubscribing easy and keep complaints low. In 2026 these are no longer “best practices”. Mail that ignores them is slowed down, sent to spam or rejected outright.

Here is a plain-English summary of what the big three mailbox providers expect, and a checklist you can work through this week.

Who counts as a “bulk sender”?

Gmail treats you as a bulk sender once you send around 5,000 or more messages a day to personal Gmail addresses. Microsoft uses a similar threshold of more than 5,000 messages a day for Outlook.com, Hotmail and Live addresses. Yahoo applies matching requirements.

Two things often surprise people:

• With Gmail, the classification is permanent. Dropping below the threshold later does not remove the requirements.
• Even if you are well below 5,000 a day, the authentication basics below still decide whether your mail is trusted. Smaller senders are not exempt from good deliverability, they are just checked less strictly.

The requirements in a nutshell

1. Authenticate your domain

• SPF: a DNS record listing which servers may send email for your domain.
• DKIM: a digital signature added to every message so receivers can verify it was not altered.
• DMARC: a policy record that ties SPF and DKIM to the address in your “From” line. At minimum you need p=none, and your From domain must align with SPF or DKIM.
• Reverse DNS (PTR): the IP addresses that send your mail should resolve back to a real hostname.
• TLS: mail should be delivered over an encrypted connection. Every modern email platform does this by default.

2. Make unsubscribing effortless

Marketing and promotional emails sent to Gmail must support one-click unsubscribe (the technical standard is called RFC 8058), and requests have to be honoured within 48 hours. Microsoft asks for a visible, working unsubscribe link. In practice, Mailchimp, Brevo, Klaviyo and similar platforms handle this for you, as long as you send from a properly authenticated domain.

3. Keep spam complaints very low

Gmail wants user-reported spam below 0.1% and treats 0.3% as a hard line. Cross it and you lose access to Google’s deliverability support until you have stayed below 0.3% for seven days in a row. That is just 3 complaints per 1,000 emails, so list quality matters more than ever.

What happens if you ignore it?

Since November 2025, Gmail has steadily increased enforcement against non-compliant bulk traffic: first temporary errors that slow your mail down, then permanent rejections. Microsoft started enforcing its rules for Outlook.com on 5 May 2025, routing failing mail to Junk and rejecting it with the error 550 5.7.515 (“access denied, sending domain does not meet the required authentication level”).

The worst part is that these failures are often silent. Your platform says “sent”, but customers never see the email.

Your 7-step checklist

• Run a free check with our Email Deliverability Checker to see your SPF, DKIM and DMARC status in seconds.
• Have exactly one SPF record and keep it under 10 DNS lookups.
• Enable DKIM in every tool that sends as your domain: Google Workspace or Microsoft 365, your newsletter platform, your shop, your CRM.
• Publish DMARC, starting with p=none and a reporting address, so you can see who is sending as you.
• Send marketing from a subdomain (for example news.yourcompany.com) to protect the reputation of your main domain.
• Clean your list: remove hard bounces and people who have not opened in 6 to 12 months.
• Monitor Google Postmaster Tools and Microsoft SNDS so you spot problems before customers do.

The bottom line

Email authentication is now the entry ticket to the inbox. The good news is that it is mostly a one-time setup. Get SPF, DKIM and DMARC right, keep your list healthy, and your emails will land where they belong.

Not sure where you stand? Check your domain for free, or get in touch and we will set everything up and monitor it for you.