Google's DMARC requirement says that anyone sending around 5,000 or more messages a day to personal Gmail accounts must publish a DMARC record, at least p=none, and send mail whose From domain aligns with SPF or DKIM. It is one of a set of rules that Gmail and Yahoo introduced in February 2024 and Microsoft followed for Outlook.com in May 2025: SPF and DKIM, an aligned DMARC record, one-click unsubscribe for marketing mail, and a spam complaint rate below 0.3%. Mail that falls short is filtered, delayed or rejected.
This guide is for anyone who sends newsletters, shop mail or notifications at volume, and for small senders who want to know which parts apply to them. It is deliberately short: each rule, what it means in practice, and where the setup is explained in depth. The records themselves are covered in the SPF, DKIM and DMARC setup guide.
Quick answer
- Every sender to Gmail or Yahoo needs SPF or DKIM, valid forward and reverse DNS for sending IPs, TLS, and a spam rate below 0.3%.
- Bulk senders (Google: close to 5,000 or more messages a day to personal Gmail accounts) also need both SPF and DKIM, a DMARC record of at least
p=none, a From domain that aligns, and one-click unsubscribe in marketing mail, honoured within 2 days. - Outlook.com, Hotmail and Live have required SPF, DKIM and DMARC from domains sending more than 5,000 messages a day since 5 May 2025, rejecting the rest with
550 5.7.515. - Google moved from warnings to rejections for non-compliant bulk mail from November 2025.
- Check your DNS side with the free email and DNS health check; check one-click unsubscribe in your sending tool.
Who counts as a bulk sender?
Google defines a bulk sender as one that sends close to 5,000 or more messages to personal Gmail accounts within 24 hours. Messages from the same primary domain count together, whatever tool sent them, so a newsletter tool and a shop that both send as example.com add up. Once a domain reaches that volume, Google treats it as a bulk sender permanently, even if the volume drops later.
Yahoo applies the same kind of rules but publishes no number. Microsoft's rule for Outlook.com consumer addresses uses more than 5,000 messages a day.
Google's threshold counts mail to personal Gmail accounts (addresses ending in @gmail.com or @googlemail.com), not mail to business addresses hosted on Google Workspace.
The rules for every sender
These apply even if you send a few messages a day:
| Requirement | What it means |
|---|---|
| SPF or DKIM | At least one passes for your sending domain |
| Forward and reverse DNS | The sending IP has a PTR record whose host name points back to the same IP |
| TLS | Mail is sent over an encrypted connection |
| Spam rate below 0.3% | As reported in Google Postmaster Tools; Google's target is below 0.1% |
| Correct message format | Valid headers under RFC 5322; no From address impersonating Gmail |
If you send through Google Workspace, Microsoft 365 or a reputable newsletter tool, the provider handles reverse DNS and TLS. The authentication part is yours to publish in DNS.
The extra rules for bulk senders
Both SPF and DKIM
A bulk sender needs SPF and DKIM, not one or the other. DKIM should be signed with your own domain: a newsletter tool signing with its own domain passes DKIM but does not help DMARC. The guide to DKIM and how to turn it on covers the setup for common tools.
The Google DMARC requirement
Publish a DMARC record for the domain in your From address. p=none is enough for the requirement:
_dmarc.example.com. 3600 IN TXT "v=DMARC1; p=none; rua=mailto:[email protected]"And the mail must pass DMARC: the From domain must match the domain that passed SPF or DKIM. That rules out sending [email protected] through a tool that authenticates only its own domain. In practice, set up custom-domain DKIM in every tool; the guide to what DMARC is explains alignment.
p=none satisfies the rule but does not protect your domain from forgery. Move to quarantine and reject once your reports are clean.
One-click unsubscribe
Marketing and subscription mail must let people unsubscribe in one click, from the mail client's own unsubscribe button, and you must honour the request within 2 days. This is defined in RFC 8058 and uses two headers:
List-Unsubscribe: <https://example.com/unsubscribe?u=8f3a2c>, <mailto:[email protected]?subject=u-8f3a2c>
List-Unsubscribe-Post: List-Unsubscribe=One-ClickThe HTTPS address must accept a POST request and unsubscribe the person without asking them to log in or confirm anything. RFC 8058 also requires both headers to be covered by a valid DKIM signature, one more reason DKIM matters. Keep a visible unsubscribe link in the message body as well.
Every mainstream newsletter tool adds these headers for you. Check that it does, and if you send from your own system, add them yourself. Transactional mail such as receipts, password resets and shipping notices does not need one-click unsubscribe.
A spam rate under 0.3%
The complaint rate is the share of messages that Gmail users mark as spam, as shown in Google Postmaster Tools. Google wants it below 0.1% and treats 0.3% as the line where you lose the right to ask for mitigation. That is 3 complaints per 1,000 messages. Easy unsubscribing, confirmed opt-in and removing people who never open are what keep it down; our guide on why emails go to spam covers the reputation side.
What Yahoo and Microsoft require
Yahoo's Sender Best Practices set the same rules as Google for bulk senders: SPF and DKIM, DMARC with at least p=none, an aligned From domain, one-click unsubscribe honoured within 2 days, and a low complaint rate. Yahoo offers a complaint feedback loop to see who complained.
Microsoft applied its rules to Outlook.com, Hotmail and Live addresses on 5 May 2025. Domains sending more than 5,000 messages a day must pass SPF, DKIM and DMARC (at least p=none, aligned). Mail that does not is rejected with 550 5.7.515 Access denied, sending domain doesn't meet the required authentication level. Microsoft also recommends working unsubscribe links and list hygiene, as Google and Yahoo do.
What happens if you do not comply
Google introduced enforcement gradually through 2024, starting with temporary errors on a share of non-compliant traffic. From November 2025 it began rejecting more non-compliant bulk mail outright, with permanent errors such as 550 5.7.26 for mail that fails authentication. Microsoft rejects non-compliant high-volume mail with 5.7.515. The bounce text names the problem; the guide to DMARC fail and 554 5.7.5 bounces explains the common ones.
Short of rejection, non-compliant mail is more likely to land in spam, and Google does not offer mitigation help to senders who do not meet the requirements.
How to check you comply
The check covers the DNS side: whether SPF is valid and within 10 lookups, whether DMARC exists and what its policy is, and whether a DKIM key is published under a common selector. It reads DNS only, so it cannot see your unsubscribe headers, reverse DNS or spam rate.
For the rest:
- Headers: send a campaign to a Gmail address, choose Show original, and look for
DKIM: 'PASS' with domain example.com,DMARC: PASS, and theList-UnsubscribeandList-Unsubscribe-Postheaders. - Spam rate: verify your domain in Google Postmaster Tools. It shows your spam rate and a compliance status for the sender requirements once you send enough mail to Gmail.
- Every tool: repeat the header check for each tool that sends as your domain.
Questions people ask
Does the Google DMARC requirement apply to small senders?
Strictly, no. The DMARC requirement applies to bulk senders, around 5,000 or more messages a day to personal Gmail accounts. Smaller senders only need SPF or DKIM, reverse DNS, TLS and a low spam rate. A p=none DMARC record still takes five minutes, gives you reports, and means you already comply if your volume grows.
What counts as a bulk sender for Gmail?
Google counts a domain as a bulk sender once it sends close to 5,000 or more messages to personal Gmail accounts in 24 hours. All mail with the same primary domain in the From address counts together, across every tool. The status is permanent, so a single large campaign is enough, even if your usual volume is much lower.
What is one-click unsubscribe?
It is an unsubscribe button in the mail client, such as Gmail's, that removes a person from a list in a single click, without visiting a page or logging in. It works through the List-Unsubscribe and List-Unsubscribe-Post headers from RFC 8058. Gmail and Yahoo require it for bulk marketing mail, and requests must be honoured within 2 days.
Do transactional emails need one-click unsubscribe?
No. Google and Yahoo require one-click unsubscribe for marketing and subscription mail. Order confirmations, receipts, password resets and shipping notices are exempt, although they still need SPF, DKIM and DMARC when you are a bulk sender. Keep promotions out of transactional mail; a sales section can turn a receipt into marketing.
What happens if my mail does not meet Gmail's sender requirements?
It is more likely to land in spam, to be delayed with temporary errors, or, since Google stepped up enforcement in November 2025, to be rejected outright with a permanent error such as 550 5.7.26. Google also withholds deliverability help from non-compliant senders. Fix authentication first, since it is the part a DNS check can confirm in minutes.