If you send 5,000 or more messages a day to personal Gmail addresses, you must authenticate with SPF, DKIM and DMARC, support one-click unsubscribe, and keep your spam complaint rate below 0.3%. Since November 2025, Gmail no longer defers non-compliant mail with a temporary error — it rejects it permanently, and Yahoo and Microsoft now enforce equivalent rules.
That shift is the story. When these requirements launched in February 2024, failures produced 421 deferrals that retried. Today a misconfigured domain gets a hard 550 bounce and the message is simply gone. Google also retired its old reputation dashboard in favour of a binary pass/fail compliance status, so there is no longer a grey zone to sit in.
Do these rules actually apply to you?
The threshold is 5,000 messages per day to personal Gmail accounts, measured per sending domain. Three details decide whether you are in scope, and the third catches most people out.
- It is per domain, not per mailbox. Ten mailboxes on
yourcompany.comsending 500 each puts the domain over the line. - It is permanent once crossed. Google treats you as a bulk sender from that point forward, even if volume later drops.
- Google Workspace recipients do not count. The threshold measures mail to
@gmail.comand@googlemail.comonly. Messages to a company running Workspace fall outside it.
That last point materially reduces who is affected. If your outbound targets B2B decision-makers at companies with their own domains, a large share of your volume never touches a personal Gmail inbox. It does not exempt you — the baseline requirements below still apply to every sender — but it may mean you are not a bulk sender at all.
| Provider | Applies to | Enforcement |
|---|---|---|
@gmail.com, @googlemail.com | Feb 2024 · hard rejections Nov 2025 | |
| Yahoo | All Yahoo-hosted consumer domains | Feb 2024 |
| Microsoft | outlook.com, hotmail.com, live.com | May 2025 |
What is required of every sender, regardless of volume?
Google splits its guidelines into two tiers. These apply to you even if you send ten emails a day, and most deliverability problems start here rather than with the bulk rules.
- SPF or DKIM configured for your sending domain
- TLS for transmission
- Valid forward and reverse DNS (PTR records) on sending IPs
- Spam rate below 0.3% in Postmaster Tools
- RFC 5322-compliant formatting, with no impersonation of Gmail
From:headers
A missing PTR record is the single most common failure in this tier, and it is invisible until mail starts bouncing. Your host or ESP configures it — you cannot set it in your own DNS.
What is additionally required of bulk senders?
Cross 5,000/day and three requirements tighten.
1. All three authentication records, not just one
SPF declares which servers may send for your domain:
v=spf1 include:_spf.google.com include:sendgrid.net -allReplace the include: values with your actual sending services. Use -all (hard fail), not ~all. SPF has a hard limit of 10 DNS lookups — exceed it and SPF fails entirely, silently.
DKIM cryptographically signs your mail. Generate the key pair in your ESP and publish the public key as a TXT record at selector._domainkey.yourdomain.com. Google’s stated floor is 1024-bit; use 2048-bit.
DMARC tells receivers what to do when authentication fails. Publish at _dmarc.yourdomain.com:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comp=none is the minimum that satisfies the requirement. It is monitoring only and does not protect your domain from spoofing. Once your aggregate reports look clean, move to p=quarantine, then p=reject.
2. Alignment — the requirement most senders fail
Valid SPF and DKIM records are not enough on their own. At least one must align with the domain in your visible From: header.
If you send as hello@yourcompany.com but your ESP signs with mail.esp-provider.com, DMARC fails even though both records pass individually. The fix is to configure a custom signing domain in your ESP so the DKIM d= value matches your From: domain.
3. One-click unsubscribe
Marketing and subscribed messages must include both headers, per RFC 8058:
List-Unsubscribe: <https://yourdomain.com/unsub?id=abc123>
List-Unsubscribe-Post: List-Unsubscribe=One-Click- The link must work without requiring a login
- Removals must be honoured within two days
- A visible unsubscribe link in the body is still required — the header does not replace it
Transactional mail is exempt. Password resets, order confirmations and shipping notifications do not need this. Most reputable ESPs add the headers automatically — verify rather than assume.
Which rules are hard-enforced and which are not?
Not every requirement carries the same consequence. Knowing which is which tells you what to fix first.
| Requirement | Enforcement | Failure mode |
|---|---|---|
| SPF / DKIM authentication | Hard | Permanent 550 rejection |
| DMARC record present | Hard | Permanent 550 rejection |
| From-domain alignment | Hard | Permanent 550 rejection |
| Spam rate below 0.3% | Hard | Filtering, then rejection |
| One-click unsubscribe headers | Softer | Reputation damage, spam placement |
| PTR / reverse DNS | Softer | Reputation damage |
| TLS | Softer | Reputation damage |
Authentication and alignment are binary and unforgiving. Fix those first — they are the difference between delivery and a bounce.
What changed in Google Postmaster Tools v2?
Google rebuilt Postmaster Tools and retired the old Domain and IP Reputation charts. The familiar High / Medium / Low / Bad reputation gradient is gone.
In its place is a binary Compliance Status: Pass or Fail. Pass means you are meeting sender requirements. Fail means your mail is at risk of rejection. There is no partial credit and no gradual slide to watch — you are either compliant or you are not.
Practically, this is an improvement. The old reputation score told you something was wrong without telling you what. The v2 dashboard shows which specific requirement you are failing, so remediation is direct.
What do the bounce codes mean?
If mail is already failing, the SMTP response names the broken requirement.
| Code | Meaning |
|---|---|
421-4.7.26 | SPF and DKIM both failed |
421-4.7.30 | DKIM missing or failing (bulk sender) |
421-4.7.32 | No DMARC alignment |
550-5.7.26 | Unauthenticated mail — permanent rejection |
550 5.7.515 | Microsoft: bulk sender requirements not met |
A 4xx is a temporary deferral and will retry. A 5xx is permanent — that message is not delivered and will not be attempted again.
How long does it take to recover?
Fixing DNS is fast. Rebuilding standing is not.
If your spam rate breaches the threshold, your domain must hold below 0.3% for seven consecutive days before full eligibility is restored. A single bad campaign therefore costs at least a week, and any further complaints during that window restart the clock.
This is why the practical target is 0.1%, not 0.3%. The lower figure is headroom — it means one bad send does not immediately put you into a recovery period.
What is different about Yahoo and Microsoft?
Yahoo mirrors Google closely: SPF, DKIM, DMARC, one-click unsubscribe, and complaint rates under 0.3%. If you are compliant with Gmail, you are broadly compliant with Yahoo.
Microsoft adds constraints that specifically affect cold outreach:
- 14-day minimum domain age before meaningful volume
- 30-day ramp period — new domains capped near 200 messages/day
- Spam complaint rate below 0.10%, stricter than Google’s 0.30%
Buy a domain on Monday and start sending Tuesday and Outlook will reject you regardless of how clean your DNS is. Microsoft returns 550 5.7.515 for these failures.
How does this affect cold outreach at scale?
Most guidance on these rules is written for a marketing team with one domain and one ESP. Outbound teams operate differently — often ten to fifty sending domains, each with several mailboxes — and that changes the compliance problem in three ways.
Every domain needs its own complete configuration. SPF, DKIM, DMARC and PTR are per-domain. A fleet of thirty sending domains is thirty separate sets of DNS records, and one misconfigured domain fails silently while the rest deliver — which makes the problem hard to spot from reply rates alone.
Splitting volume does not exempt you. Spreading 15,000 daily sends across five domains keeps each below the bulk threshold, but every one of those domains still owes the baseline requirements, and Microsoft’s 0.10% complaint ceiling applies regardless of volume. Domain-splitting manages reputation risk; it does not avoid compliance.
Complaint rate is a list-quality problem, not a technical one. Authentication gets you to the inbox. What keeps you there is whether the message was worth receiving. Complaints come from two sources: irrelevant messages reaching people who should never have been targeted, and invalid addresses that inflate bounce rates and drag domain reputation down with them.
At 0.3%, one complaint per 333 messages puts you into a seven-day recovery window. No amount of DNS configuration compensates for a poorly targeted list. Verified contact data and tight ICP filtering do more for deliverability than any authentication tweak.
How do I verify I am compliant?
Three free tools, one per provider:
| Tool | Provider | Shows |
|---|---|---|
| Google Postmaster Tools | Gmail | Compliance status (pass/fail), spam rate |
| Yahoo Complaint Feedback Loop | Yahoo | Complaint data per campaign |
| Microsoft SNDS | Outlook | IP reputation, complaint rates |
A ten-minute self-check:
- Send a test message to a personal
@gmail.comaddress - Open it, then choose Show original from the three-dot menu
- Confirm
SPF: PASS,DKIM: PASSandDMARC: PASS - Check the
From:domain matches the DKIMd=value — this is your alignment check - Search the raw headers for
List-Unsubscribe-Post
If all five check out on every sending domain you operate, you are compliant.
The 2026 compliance checklist
- SPF record published, ending in
-all, under 10 DNS lookups - DKIM signing enabled with a 2048-bit key
- DMARC record at
_dmarc.yourdomain.com, minimump=none - SPF or DKIM aligned with your visible
From:domain List-UnsubscribeandList-Unsubscribe-Postheaders present- Unsubscribes honoured within two days
- Spam rate under 0.10% in Postmaster Tools
- Compliance Status showing Pass in Postmaster Tools v2
- Valid PTR records on all sending IPs
- TLS enabled
- New domains aged 14+ days and ramped gradually
- Every requirement above verified on every sending domain, not just the primary
The requirements themselves are not difficult — four DNS records and a header. What makes them costly is that failure is now silent and permanent: no deferral, no retry, no reputation score sliding downward to warn you. Check every domain, then check again whenever you add one.