Gmail, Yahoo, Outlook and iCloud sender rules: what you must do

The short version

• Every sender, even a one-person business, must pass SPF or DKIM to reach Gmail and Yahoo inboxes, and keep its spam rate below 0.3%.
• Bulk senders (Gmail and Outlook.com use about 5,000 messages a day as the line) must also pass DMARC and use a From domain that matches SPF or DKIM. Gmail and Yahoo also require one-click unsubscribe on marketing mail.
• Fail the rules and your mail goes to junk or gets rejected. Gmail stepped up enforcement in November 2025.
• In the US, marketing email also falls under the CAN-SPAM Act: honest headers and subject lines, a postal address, and opt-outs honored within 10 business days.

The rules at a glance

These are the four big mailbox providers’ published rules as of October 2026. “Bulk” means the extra rules below kick in.

Rules for every sender

These apply even if you send only a few emails a day from your own domain. Gmail has required them since February 2024, and Yahoo started enforcing a similar set that month.

• SPF or DKIM. These are DNS records that prove a server may send mail for your domain. SPF lists the servers allowed to send; DKIM adds a signature to each message. Our SPF, DKIM and DMARC guide shows how to add them.
• Forward and reverse DNS. The sending server’s name must point to its IP address, and the IP address must point back to the name.
• An encrypted connection. Gmail requires mail to arrive over TLS, the same kind of encryption that puts the padlock on websites (see HTTPS and TLS).
• A low spam rate. Keep the share of your mail that people mark as spam below 0.3% (Gmail measures it in Postmaster Tools). Google recommends staying below 0.10%.
• Standard message format. Yahoo also asks senders to follow RFCs 5321 and 5322, the basic email standards.

If you send through a provider such as Google Workspace, Microsoft 365 or an email marketing service, Google says to check that the provider follows these rules and authenticates your mail with SPF and DKIM. The SPF and DKIM records go in your own domain’s DNS, so adding them is usually your job. Not sure who hosts your mail? See email hosting.

Extra rules for bulk senders

Gmail

Google’s FAQ calls you a bulk sender if you send close to 5,000 messages or more to personal Gmail accounts within 24 hours. Its main guidelines page words it two ways: “more than 5,000 messages per day” in the requirements and “5,000 or more” in a heading. If you are anywhere near that number, plan as a bulk sender.

One day over the line is enough. Google says a sender that meets the threshold even once is treated as a bulk sender permanently.

Bulk senders to Gmail must also:

• Publish a DMARC record. A policy of p=none (monitor only) is allowed.
• Use a From address whose domain matches the domain that passes SPF or DKIM. This match is called alignment.
• Add one-click unsubscribe to marketing and promotional mail. Google’s deadline for this was June 1, 2024.
• Process unsubscribe requests within 48 hours.

Yahoo

Yahoo does not publish a number for who counts as bulk. Its FAQ says: “We will not specify a volume threshold.” If you send newsletters or promotions to a list, it is safer to meet the bulk rules.

Yahoo bulk senders need both SPF and DKIM, not just one. They also need a DMARC policy of at least p=none that passes, and an aligned From domain. Marketing and subscribed mail must have one-click unsubscribe, enforced since June 2024 for promotional and marketing messages only. Yahoo says to honor unsubscribes within 2 days. Its FAQ says mail that misses the rules may go to the spam folder or be rejected.

Outlook.com

Since May 5, 2025, domains that send more than 5,000 emails a day to Outlook.com accounts must pass SPF, DKIM and DMARC. Microsoft’s support page for error 550 5.7.515 describes the rule as 5,000 or more messages from the same From domain, without the daily timeframe. Both pages accept a DMARC record such as v=DMARC1; p=none.

Microsoft’s postmaster page says mail that fails goes to the Junk folder first. If the problems continue, it may be rejected with this error: 550; 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level. The support page describes only the rejection.

Apple iCloud Mail

Apple’s postmaster page is short and firm: “All requirements must be met in order to send a bulk email. If not, the email will be rejected.” The requirements include SPF and DKIM, a published DMARC policy, reverse DNS and an unsubscribe link.

One-click unsubscribe, explained

One-click unsubscribe lets a reader leave your list with one click from their inbox, with no login and no form. It is defined by RFC 8058, a 2017 standard from the IETF. Your messages carry two headers (hidden lines at the top of every email):

List-Unsubscribe: <https://example.com/unsubscribe?id=123>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

The link must be HTTPS. RFC 8058 also requires a valid DKIM signature that covers both headers, so DKIM has to work first.

A visible unsubscribe link in the footer is still a good idea, and Apple lists an unsubscribe link among its requirements. If you use an email marketing service, ask it whether it adds the one-click headers for you.

The deadlines differ: 48 hours at Google, 2 days at Yahoo, 10 business days under CAN-SPAM. Meeting the shortest one covers all three.

Check your own mail in 10 minutes

1. Send a test. Send a normal message from your business address to a personal Gmail address.
2. Open the headers. In Gmail on a computer, open the message, click More (next to Reply) and choose “Show original”. Look at the SPF, DKIM and DMARC results. Each should say pass.
3. Check the From domain. In the same view, the domain next to DKIM or SPF should match the domain in your From address. If neither one matches (for example, both show your sending service’s domain), alignment fails.
4. Confirm a DMARC record exists. It is a TXT record at _dmarc.example.com (with your domain). If it is missing, add one starting at p=none. The records guide has examples.
5. Test a newsletter too. Send one from your marketing tool to the same Gmail address. In “Show original”, look for the List-Unsubscribe-Post header.
6. Watch your spam rate. Sign up for Google Postmaster Tools with your Google account. Its Compliance status dashboard shows whether your mail meets Gmail’s sender requirements. If you run your own sending IP addresses, Microsoft’s SNDS service shows their reputation at Outlook.com.

Mail still landing in spam after all this? Work through the spam fixes checklist. Contact-form emails from a WordPress site are a separate problem, covered in website form emails.

CAN-SPAM basics for US senders

This section is general information, not legal advice. The CAN-SPAM Act is the US law for commercial email. It covers business-to-business email too. The Federal Trade Commission’s compliance guide lists eight requirements:

1. Do not use false or misleading header information (From, To, Reply-To).
2. Do not use deceptive subject lines.
3. Identify the message as an ad.
4. Include your valid physical postal address.
5. Tell recipients how to opt out of future email.
6. Remember that subscribers and members can opt out of marketing email too.
7. Honor opt-out requests promptly: within 10 business days.
8. Monitor what others do on your behalf, such as an agency sending for you.

Each email that breaks the law can bring a civil penalty of up to $53,088. The FTC said in September 2026 that penalty amounts stay unchanged for 2026. For other US website rules, see website laws in the US.

Sources: Google: Gmail sender guidelines, sender guidelines FAQ, Postmaster Tools dashboards, full headers in Gmail. Yahoo: sender best practices, sender requirements FAQ. Microsoft: Outlook.com postmaster policies, error 550 5.7.515, SNDS. Apple: postmaster information for iCloud Mail. Standards: RFC 8058 (one-click unsubscribe). FTC: CAN-SPAM compliance guide, 16 CFR 1.98, 2026 penalty notice.