# Gmail and Yahoo sender requirements: what a small shop must do > Every sender to Gmail and Yahoo needs SPF or DKIM, valid forward and reverse DNS and a spam rate below 0.3%; bulk senders also need SPF and DKIM together, an aligned DMARC record (p=none is accepted), one-click unsubscribe on marketing email and unsubscribes honored within two days. Outlook applies similar authentication rules to domains sending 5,000 or more messages to its consumer addresses. Canonical: https://tellnod.com/guides/gmail-yahoo-sender-requirements Last updated: 2026-10-22 Author: Tellnod team ## What the mailbox providers now require Since February 2024, Gmail and Yahoo have enforced written rules for anyone sending them email, with stricter rules for high-volume senders [S1][S4]. Microsoft announced comparable rules for Outlook’s consumer addresses in 2025 [S5]. Together these three providers hold a large share of the inboxes a typical online store mails, so the rules decide whether a campaign is delivered, filed as spam or refused. The rules fall into four groups: prove the mail is really from you (authentication), make leaving easy (unsubscribe), keep complaints low (spam rate), and run a technically sound mail server (DNS, encryption and message format). The sections below take each group in turn, then turn them into a checklist you can work through in an afternoon. > This page covers the providers’ rules. For a plain introduction to deliverability as a whole, start with [email deliverability basics](https://tellnod.com/guides/email-deliverability-basics). ## Who counts as a bulk sender Gmail treats you as a bulk sender once you send close to 5,000 messages or more to personal Gmail accounts within 24 hours. Messages from the same primary domain count together, and the status is permanent: sending less afterwards does not remove it [S2]. Yahoo describes a bulk sender as one sending a significant volume of mail and deliberately publishes no threshold [S4]. Its rules apply to every consumer brand Yahoo Mail hosts, including AOL [S4]. Microsoft’s threshold is 5,000 or more messages to Outlook.com, Hotmail, Live.com and MSN addresses using the same From domain [S6]. The primary-domain rule matters for shops. Suppose Ninefold, a small knitwear brand, has 9,000 subscribers, half of them on Gmail, and also sends order confirmations from the same domain. A busy Black Friday weekend can push the day’s Gmail total near 5,000, and from then on Ninefold is a bulk sender for good. Because Yahoo sets no number at all, the safest plan is to meet the bulk-sender rules from your first campaign. ## Authentication: SPF, DKIM and DMARC Gmail asks every sender to publish [SPF](https://tellnod.com/glossary#spf) or [DKIM](https://tellnod.com/glossary#dkim) for the sending domain, and bulk senders to publish both [S1]. DKIM keys must be at least 1024 bits for personal Gmail accounts; Google recommends 2048 bits where your DNS provider supports it [S1]. Yahoo sets the same split: SPF or DKIM for everyone, both for bulk senders [S3]. Bulk senders also need a [DMARC](https://tellnod.com/glossary#dmarc) record. A policy of `p=none` is accepted by Gmail, Yahoo and Microsoft, so you can start in monitoring mode [S1][S3][S6]. What all three insist on is alignment: the domain in the visible From address must match the domain that passed SPF or DKIM. Sending as hello@ninefold.com through a provider that signs only with its own domain passes DKIM but fails DMARC. Yahoo strongly recommends adding a `rua` tag to the DMARC record so aggregate reports reach you [S3]. Those reports show which services send in your name, which is useful before you ever tighten the policy. For the record syntax, see [SPF, DKIM and DMARC explained](https://tellnod.com/guides/spf-dkim-dmarc-explained) and [how to set up DMARC](https://tellnod.com/guides/how-to-set-up-dmarc). ## One-click unsubscribe and the two-day rule Bulk senders must support [one-click unsubscribe](https://tellnod.com/glossary#one-click-unsubscribe) on marketing and subscribed messages and show a clearly visible unsubscribe link in the body [S1][S3]. Transactional mail such as order confirmations and password resets is exempt [S2]. Gmail gave senders until June 1, 2024 to add it, and Yahoo began enforcing it the same month [S2][S4]. One-click is defined by RFC 8058. Each message carries a [List-Unsubscribe](https://tellnod.com/glossary#list-unsubscribe) header with an HTTPS address and a second header, `List-Unsubscribe-Post: List-Unsubscribe=One-Click`. Both headers must be covered by a valid DKIM signature, and the unsubscribe must complete from a single POST request, without a confirmation page [S7]. Yahoo highly recommends the POST method and still accepts a mailto address [S3]. The request then has to take effect quickly. Yahoo requires unsubscribes to be honored within two days [S3]. Gmail recommends 48 hours and lists slower handling as a sender issue it checks for [S2][S8]. ## Spam rate limits and technical basics Your [spam complaint rate](https://tellnod.com/glossary#spam-complaint-rate) is the share of delivered messages that recipients mark as spam. Gmail and Yahoo both require it to stay below 0.3% [S1][S3]. Gmail adds a working target: keep it below 0.10% and avoid ever reaching 0.30% [S1]. Gmail measures the rate on mail delivered to the inbox, so it can rise even when total volume is small [S8]. The remaining rules are usually handled by your email provider rather than by you, but they are worth confirming: - Valid forward and reverse DNS (a PTR record) for the sending IP addresses [S1][S3]. - TLS encryption when the message is transmitted, required by Gmail since December 2023 [S1]. - Messages formatted to RFC 5322, and no From headers that impersonate Gmail [S1]. ## How enforcement has tightened | When | Provider | What happened | | --- | --- | --- | | February 2024 | Gmail and Yahoo | Sender requirements begin, rolled out gradually [S2][S4] | | June 2024 | Gmail and Yahoo | One-click unsubscribe required on marketing email [S2][S4] | | May 2025 | Outlook | Non-compliant mail from high-volume domains routed to Junk, with rejection announced as the next step [S5] | | November 2025 | Gmail | Enforcement ramps up with temporary and permanent rejections of non-compliant mail [S2] | Microsoft now documents a rejection for domains that miss its rules, returned as error 550 5.7.515 with the message that the sending domain does not meet the required authentication level [S6]. In practice, a sender that ignores the rules no longer just sees lower open rates; some messages are refused outright. ## Checklist for a small shop | Requirement | Gmail | Yahoo | Outlook | How to check | | --- | --- | --- | --- | --- | | SPF and DKIM both pass | Bulk | Bulk | High volume | Message headers of a test email | | DMARC published, p=none or stricter | Bulk | Bulk | High volume | DNS lookup of _dmarc.yourdomain | | From domain aligned with SPF or DKIM | Bulk | Bulk | High volume | DMARC result in the headers | | One-click unsubscribe plus visible link | Bulk | Bulk | Not listed as required | Unsubscribe button in Gmail or Yahoo | | Unsubscribes honored within two days | Bulk | Bulk | Not listed as required | Unsubscribe a test address, then send again | | Spam rate below 0.3% | All | All | Not published | Spam rate dashboard in Google Postmaster Tools | | PTR record, TLS, RFC 5322 format | All | All (TLS not listed) | Not listed | Ask your email provider | To confirm Gmail’s view of your domain, add it to Google Postmaster Tools. Its Compliance status dashboard marks each requirement as compliant, needs work or no data found [S8]. Low-volume senders often see no data, which is normal. ## Meeting the requirements with Tellnod in Claude or ChatGPT Tellnod is an [MCP connector](https://tellnod.com/glossary#mcp-connector) that lets a shop write, preview and send email from Claude or ChatGPT. Most of the checklist is handled before a campaign can be sent: - Ask “Set up ninefold.com as my sending domain”. Tellnod returns the SPF, DKIM and DMARC records to add and checks them for you. Until they verify, you can send from an address named after your shop on Tellnod’s shared domain, such as hello@ninefold.tellnodmail.com, for up to 500 recipients per campaign and 1,000 emails a month. - Ask “Show me the results of last week’s campaign”. The results card lists delivered, opens, clicks, unsubscribes and bounces, so a rise in unsubscribes or bounces is visible right after a send. - Every campaign gets one-click unsubscribe headers, a visible unsubscribe link and your postal address, and unsubscribed and bounced contacts are removed from each audience. - New accounts ramp up gradually, and sending pauses automatically if complaints pass 0.1%. Before anything goes out, you see the real email on desktop and mobile, then a confirmation card with the audience, the exclusions and the send time. The AI can prepare a send but cannot confirm it; you approve every send on the [approval card](https://tellnod.com/glossary#approval-card). Setup instructions are on the [connect page](https://tellnod.com/connect), and plans start free on the [pricing page](https://tellnod.com/pricing). ## FAQ ### Do the Gmail and Yahoo rules apply if I send fewer than 5,000 emails a day? Yes, partly. SPF or DKIM, valid DNS, TLS for Gmail and a spam rate below 0.3% apply to every sender [S1][S3]. Yahoo publishes no bulk threshold, so meeting the full bulk-sender list from the start is the safer choice [S4]. ### Is DMARC p=none enough to meet the requirements? Yes. Gmail, Yahoo and Microsoft accept a DMARC policy of p=none, provided the message passes DMARC through an aligned SPF or DKIM domain [S1][S3][S6]. ### Do order confirmations need one-click unsubscribe? No. Gmail requires one-click unsubscribe only for marketing and promotional messages; transactional messages such as receipts are excluded [S2]. They still count toward Gmail’s bulk-sender volume if they come from the same primary domain [S2]. ### What happens if my spam rate goes above 0.3%? You are outside Gmail’s and Yahoo’s requirements, and more of your mail is likely to be filtered or refused. Google also says senders who do not follow its guidelines may not be considered for deliverability mitigations [S1]. ## Sources - [S1] Google Workspace Admin Help: Email sender guidelines: (checked 2026-10-22) - [S2] Google Workspace Admin Help: Email sender guidelines FAQ: (checked 2026-10-22) - [S3] Yahoo Sender Hub: Sender Best Practices: (checked 2026-10-22) - [S4] Yahoo Sender Hub: FAQs: (checked 2026-10-22) - [S5] Microsoft Tech Community: Strengthening Email Ecosystem: Outlook’s New Requirements for High‐Volume Senders: (checked 2026-10-22) - [S6] Microsoft Support: Fix NDR error “550 5.7.515” in Outlook.com: (checked 2026-10-22) - [S7] RFC 8058: Signaling One-Click Functionality for List Email Headers: (checked 2026-10-22) - [S8] Gmail Help: Postmaster Tools dashboards: (checked 2026-10-22)