Gmail, Yahoo and Outlook bulk sender requirements

All three providers set the rules for mail arriving at their own users. According to Google’s FAQ, the Gmail rules apply only to messages sent to personal Gmail accounts (@gmail.com, @googlemail.com), not to Google Workspace accounts.

Part of the Gmail and Yahoo rules applies regardless of volume; an organisation sending a few hundred messages a day has to meet them too:

• SPF or DKIM: at least one. Having both is a bulk sender rule.
• Forward and reverse DNS: sending domains or IPs need valid forward and reverse DNS (PTR) records. The PTR record is managed by the owner of the IP address, not the domain owner.
• Format: messages must comply with RFC 5322 (and, for Yahoo, RFC 5321).
• Spam rate: below 0.3%.
• TLS (Gmail): messages must be transmitted over a TLS connection, and the Gmail From header must not be impersonated.

The alignment rule matters directly if you send through a newsletter tool or an email service provider: if the tool signs with its own domain, DKIM passes, but it does not count for DMARC because it is not aligned with the domain in your From address. Microsoft’s FAQ also says the records must be in your own domain even when sending is outsourced.

Because anti-spam software can open the link in the older List-Unsubscribe header on its own, senders used to add a confirmation page, which made unsubscribing more than one click. With RFC 8058 the receiving system, with the user’s consent, sends a POST request to the HTTPS address in the header and the sender processes it without asking for confirmation (RFC 8058 §3.2).

Rules on the sender side (RFC 8058 §3.1): List-Unsubscribe must contain one HTTPS address (a mailto: may sit next to it); List-Unsubscribe-Post must contain only List-Unsubscribe=One-Click; the message must carry a valid DKIM signature covering both headers; the address must identify the recipient and list with a hard-to-forge token; the server must not answer the POST with a redirect.

According to the Gmail and Yahoo FAQs this rule is for marketing and promotional messages; transactional messages such as password resets and order confirmations are excluded.

Headers in the message (address and token are examples):

List-Unsubscribe: <https://ornek.com.tr/abonelik/cik?u=8f3a1c9e>, <mailto:cik@ornek.com.tr?subject=cik>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

All three providers accept a p=none policy. But p=none makes the receiver do nothing; it does not stop forged mail in your domain’s name, it only gets you reports. Yahoo’s FAQ says senders with a spoofing problem should apply quarantine or reject regardless; Microsoft also recommends moving gradually from none to quarantine and then reject.

Yahoo strongly recommends a rua address to receive reports. Without rua no aggregate reports arrive, and those reports are the only benefit of the p=none stage.

Minimum record for a bulk sender:

_dmarc.ornek.com.tr  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@ornek.com.tr"

• Gmail: unauthenticated messages may be marked as spam or rejected with a 5.7.26 error. Google says it has been tightening enforcement on non-compliant traffic since November 2025, including temporary and permanent rejections, and offers no delivery support to senders who do not meet the rules.
• Yahoo: messages may go to the spam folder or be rejected.
• Outlook: according to Microsoft’s 29 April 2025 update, from 5 May 2025 messages that fail the authentication requirements are rejected with 550; 5.7.515 Access denied. The original “first routed to Junk” sentences are still on the same post; Microsoft added the update on top of them.

Mailskop checks the part published in DNS in a single scan: the SPF record and its 10-lookup limit, the DMARC policy, the rua address and alignment modes, and the DKIM key and its length. Since DKIM selector names cannot be listed from DNS, Mailskop reports only the selectors it tried; “not found” does not mean DKIM is off.

The spam rate, the one-click unsubscribe headers and whether a message was actually signed in alignment are not visible in DNS. For the spam rate, see Google Postmaster Tools; for signing and alignment, paste the header of a message you sent into Mailskop’s header analyzer: the Authentication-Results line written by the receiver shows the SPF, DKIM and DMARC result.