In short
Gmail, Yahoo and Outlook.com require bulk senders to publish DMARC at p=none or stricter, pass SPF and DKIM, and align the From domain with at least one of them. Gmail and Outlook.com count bulk as 5,000 messages a day. UK public sector domains need DMARC whatever their volume, under gov.uk's Securing government email.
Want help with DMARC for bulk senders?
We can plan it with you or do it for you. Tell us where you are up to.
The three providers' rules side by side
| Requirement | Gmail | Yahoo | Outlook.com |
|---|---|---|---|
| Who it applies to | Mail to personal Gmail accounts (@gmail.com, @googlemail.com) | All domains and consumer brands hosted by Yahoo Mail, including AOL | Outlook.com, Hotmail and Live.com consumer addresses |
| Bulk threshold | Close to 5,000 or more messages a day | "Significant volume"; no threshold given | More than 5,000 messages a day |
| All senders | SPF or DKIM (opens in a new tab) | SPF or DKIM at a minimum | Not stated separately |
| Bulk: SPF and DKIM | Both | Both | Both must pass |
| Bulk: DMARC | Required; policy can be none | At least p=none, and DMARC must pass | At least p=none |
| Alignment | From domain aligned with SPF or DKIM | Aligned with SPF or DKIM; relaxed alignment acceptable | Aligned with SPF or DKIM (preferably both) |
| Unsubscribe | One-click (RFC 8058 headers) for marketing and subscribed mail, plus a visible link | One-click; honour within 2 days | Not part of the authentication rules |
| Spam rate | Below 0.3% in Postmaster Tools | Below 0.3% | Not part of the authentication rules |
| If you miss them | Temporary and permanent rejections as enforcement ramps up from November 2025 | Mail may go to spam or be rejected | Rejected with 550 5.7.515 since 5 May 2025 |
Sources: Google's Email sender guidelines (opens in a new tab) and FAQ (opens in a new tab), Yahoo's best practices (opens in a new tab) and FAQs (opens in a new tab), and Microsoft's high-volume sender requirements (opens in a new tab), all read on 8 November 2026. You can test your own domain's records with our DMARC checker.
Not sure which option applies to you? Ask us
Tell us about your organisation and we will point you to the right option.
Gmail DMARC requirements in detail
Google's rules took effect on 1 February 2024. For senders of 5,000 or more messages a day to personal Gmail accounts, they require SPF and DKIM, a DMARC record ("your DMARC enforcement policy can be set to none"), and a From domain aligned with either the SPF or the DKIM domain. Some details from Google's FAQ (opens in a new tab) that matter in practice:
- The count covers your whole domain. Messages from the same primary domain count together, so 2,500 from example.co.uk and 2,500 from news.example.co.uk make you a bulk sender
- Bulk status is permanent. "Senders who meet the above criteria at least once are permanently considered bulk senders"
- Only personal Gmail is covered. The guidelines "don't apply to messages sent to Google Workspace accounts", but Workspace users must meet them when they send to personal Gmail accounts
- Enforcement is increasing. "Starting in November 2025, Gmail is ramping up its enforcement on non-compliant traffic", including temporary and permanent rejections
- Forwarded mail is exempt from alignment. DMARC alignment isn't required for forwarded or mailing list messages
- Both may be required later. Google recommends aligning with both SPF and DKIM and says it is "likely" this will eventually become a requirement
When Gmail rate-limits or blocks mail for these reasons, it says which rule was missed:
| Gmail code | Meaning (Google's description, shortened) |
|---|---|
| 4.7.27 / 5.7.27 | SPF authentication did not pass |
| 4.7.30 / 5.7.30 | DKIM authentication did not pass |
| 4.7.31 | The sending domain has no DMARC record, or the record specifies no policy |
| 4.7.32 | The From header is not aligned with the authenticated SPF or DKIM domain |
Codes starting 4 are temporary (rate limited); codes starting 5 mean the message was blocked.
Yahoo DMARC requirements
Yahoo's enforcement began in February 2024 and has been rolled out gradually. Its best practices (opens in a new tab) ask bulk senders to:
- Implement both SPF and DKIM
- "Publish a valid DMARC policy with at least p=none - DMARC must pass"
- Include a rua tag that is set up to receive reports, which Yahoo "strongly recommended"
- Align the From domain with SPF or DKIM; "relaxed alignment is acceptable"
- Support one-click unsubscribe (Yahoo highly recommends RFC 8058, and the mailto method is acceptable) and honour unsubscribes within 2 days
- Keep the spam rate below 0.3%
Yahoo deliberately sets no volume threshold: a bulk sender is anyone "sending a significant volume of mail". Its FAQs (opens in a new tab) add that spoofed mail can count towards that volume, and that if you have a spoofing problem you should be using an enforcement policy (p=quarantine or p=reject) regardless. Yahoo also "strongly urges all senders to publish a DMARC policy for each domain that sends mail", whatever their volume.
Prefer a hand with this?
We can help you plan it and set it up, alongside your own team.
Outlook.com DMARC requirements
Microsoft's rules apply to Outlook.com, its consumer service, which covers hotmail.com, live.com and outlook.com addresses. For domains sending more than 5,000 emails a day, Microsoft's announcement (opens in a new tab) requires:
| Check | Requirement |
|---|---|
| SPF | Must pass |
| DKIM | Must pass |
| DMARC | At least p=none, aligned with either SPF or DKIM (preferably both) |
Microsoft first planned to send failing mail to Junk, then updated its post on 29 April 2025: non-compliant mail is rejected with "550; 5.7.515 Access denied, sending domain SendingDomain] does not meet the required authentication level", from 5 May 2025. Microsoft's support page on [fixing error 550 5.7.515 (opens in a new tab) gives the minimum record as v=DMARC1; p=none and lists the checks to run.
These rules are about consumer mailboxes. Mail to businesses using Microsoft 365 is filtered by each organisation's own settings; see DMARC for Microsoft 365 for your own tenant.
None of them require p=reject
All three providers accept p=none as the minimum, and none requires reject. What they do require is that DMARC passes, which means every service sending as your domain has aligned SPF or DKIM. The only way to know that across all your senders is to read your aggregate reports: Google says it recommends you "set up DMARC reports so you can monitor email sent from your domain", and Yahoo strongly recommends a working rua address.
p=none meets the rules but does not stop anyone spoofing your domain. Microsoft advises "moving gradually (none → quarantine → reject)" towards enforcement, and the UK's NCSC calls reject on all domains the best protection. The DMARC policy guide explains how to pick the end state for each domain.
Check your domain and fix your senders
Most problems with the sender rules come down to a few records and one or two unauthenticated platforms. Work through it in this order:
- Run each sending domain through the DMARC checker to confirm SPF, DKIM and a DMARC record are published
- If there is no DMARC record, publish one at p=none with a rua address, using the DMARC generator
- Read the first week of aggregate reports and list every service sending as the domain
- Authenticate each platform to sign with your domain: see the guides for Microsoft 365, Google Workspace and marketing platforms
- For marketing mail, check one-click unsubscribe headers and your spam rate in Postmaster Tools
- Once every genuine source passes, plan the move to quarantine and, where it suits the domain, reject
Readiness checks in DMARC platforms
The platforms we supply help you see where you stand against these rules:
- Valimail Monitor, which is free, includes what Valimail calls a "real-time check ... to determine if you're ready for Google, Microsoft, & Yahoo's DKIM, SPF, and DMARC requirements" (Monitor (opens in a new tab))
- EasyDMARC brings in Google Postmaster and Microsoft SNDS as reputation sources (integrations (opens in a new tab)) alongside its DMARC reporting
- Check Point DMARC Management (opens in a new tab) can alert (opens in a new tab) on errors in SPF or DMARC records, a drop in the daily DMARC success rate, reports that stop arriving and new failing sources
We can check your domains against all three providers' rules, set up reporting, help you choose and supply EasyDMARC, Valimail or Check Point DMARC Management, and work with you to fix any failing senders. EasyDMARC and Valimail licences can be billed monthly, with terms confirmed at quote. Ask us for a quote, or contact us for free advice.
Frequently asked questions
Do the Gmail and Yahoo rules apply to small senders?
Partly. Every sender to Gmail and Yahoo needs SPF or DKIM, valid reverse DNS, TLS and a low spam rate. The DMARC requirement applies to bulk senders: close to 5,000 or more messages a day for Gmail, and any "significant volume" for Yahoo, which sets no number. Yahoo urges every sender to publish DMARC anyway.
Does p=none meet Gmail's DMARC requirement?
Yes. Google's sender guidelines (opens in a new tab) say your DMARC enforcement policy can be set to none. The record must exist and specify a policy (Gmail code 4.7.31 is for a missing record or policy), and your mail must still pass DMARC with the From domain aligned to SPF or DKIM.
What is error 550 5.7.515?
It is Outlook.com's rejection for high-volume senders whose domain "does not meet the required authentication level". Since 5 May 2025, domains sending more than 5,000 messages a day to Outlook.com, Hotmail and Live.com addresses need SPF and DKIM to pass and a DMARC record of at least p=none, aligned with SPF or DKIM. Microsoft's fix guide (opens in a new tab) lists the checks.
Do these rules apply to mail sent to Google Workspace or Microsoft 365 business mailboxes?
No. Google says its sender guidelines don't apply to messages sent to Google Workspace accounts, and Microsoft's rules cover its consumer Outlook.com service. Business mailboxes are filtered by each organisation's own settings, which commonly honour your DMARC policy too.
What spam rate should I stay under?
Google and Yahoo both set 0.3% as the limit. Google's FAQ (opens in a new tab) goes further, advising senders to keep their user-reported spam rate below 0.1% and to prevent it ever reaching 0.3%, and says bulk senders above 0.3% are not eligible for its delivery mitigation.
Still have a question about DMARC for bulk senders?
Ask us and a member of our team will get back to you.