Google and Yahoo sender requirements: what has been mandatory since 2024
Since February 2024 Google and Yahoo enforce minimum sender rules. What applies to everyone, what is added above 5,000 emails a day — and how to comply.
In February 2024, Google and Yahoo stopped asking and started enforcing: senders who fail to meet the minimum requirements see their mail delayed, sorted into spam or rejected. Microsoft followed in 2025 for Outlook.com. The rules do not only affect newsletter senders — the base tier applies to EVERY domain that writes to these mailboxes.
Tier 1: requirements for all senders
- SPF OR DKIM: at least one of the two authentication methods must pass.
- Valid PTR record: the sending server must be resolvable in reverse (your mail provider takes care of this).
- Low spam complaint rate: below 0.3 % is the hard limit, below 0.1 % the stated target.
Tier 2: from ~5,000 emails per day to Gmail
- SPF AND DKIM: both, each passing.
- DMARC: at least p=none, aligned with the visible sender address.
- One-click unsubscribe: List-Unsubscribe header (RFC 8058) plus a visible unsubscribe link; unsubscribe requests must be honoured within two days.
- Sending from your own domain, not from the free address of a freemail provider.
What this means in practice
For a typical SME this means: an SPF record covering all sending services, DKIM enabled at every service, DMARC at least on p=none with a reporting address — and a check in the newsletter tool that one-click unsubscribe is switched on (with the major services a toggle, not programming). All of this is DNS records and portal settings; none of it needs new software.
The reward is measurable: authenticated mail from domains with a clean reputation reliably arrives at Gmail and Yahoo. And the protection works in both directions — with DMARC on reject, fraudsters can no longer abuse your domain for forged invoices sent to your own customers either.
Frequently asked questions
I only send ordinary business email — does this affect me?
Yes, the base tier: SPF or DKIM must pass, otherwise Gmail and Yahoo treat your mail as second-class. And because DMARC is foreseeably becoming the standard, the full setup is worth it even well below any volume threshold.
Do the rules also apply to confirmation and invoice emails?
The authentication requirements do — they do not distinguish by content. Google requires one-click unsubscribe for marketing and bulk mail; transactional emails such as invoices do not need it.
How do I find out my spam complaint rate?
Google shows it in the free Postmaster Tools (sign in with your own domain). Anyone who regularly sends larger volumes should look in there once a month.