Email Deliverability in 2026: What Gmail, Yahoo and Outlook Require From Bulk Senders

September 15, 2026 Marketing by Cliff Lin

Since November 2025, Gmail has been answering non-compliant bulk mail with temporary and permanent rejections. Some of that mail now bounces instead of landing in the spam folder. That ended a grace period that began in February 2024, when Gmail and Yahoo first enforced new sender rules. Microsoft followed for Outlook in May 2025. So email deliverability now starts with a short list of DNS records, headers and complaint limits that each provider publishes. I’ve run email programs for SaaS and e-commerce brands for 16 years. This is the list I would check before the holiday sending peak.

What Changed and When

The new email deliverability rules arrived in stages over nearly two years, and each provider documents its own dates.

February 2024: Gmail and Yahoo begin enforcing authentication and unsubscribe rules for bulk senders. Yahoo said it would roll enforcement out gradually through the first half of the year.
June 1, 2024: Gmail’s deadline for one-click unsubscribe in commercial and promotional mail. From June 2024, Gmail bulk senders with a spam rate above 0.3% also lost eligibility for its delivery mitigation support.
April 2025: Microsoft announces matching requirements for high-volume senders to Outlook.com, Hotmail.com and Live.com addresses.
May 5, 2025: Outlook enforcement begins. Microsoft first said failing mail would go to Junk, then updated its post in late April to say it would reject that mail instead.
November 2025: Gmail ramps up enforcement on non-compliant traffic, including rejections.

Who Counts as a Bulk Sender

Google’s definition is the most precise. Its email sender guidelines FAQ sets the line at close to 5,000 messages to personal Gmail accounts within 24 hours. Messages from the same primary domain count together, and that includes subdomains. The status is also permanent. Hit the threshold once, and Gmail treats you as a bulk sender from then on.

Microsoft draws its line at more than 5,000 messages a day to its consumer domains. Yahoo publishes no number at all. Because of that, I tell teams to meet the bulk rules regardless of volume. Most of the setup is a one-time project, and afterward you don’t have to watch for the day you cross a threshold.

Authentication Requirements: SPF, DKIM and DMARC

Authentication lets a mailbox provider confirm that mail claiming to come from your domain came from you. All three providers ask bulk senders for the same records.

SPF lists the servers allowed to send mail for your domain.
DKIM adds a cryptographic signature that receivers check against a public key in your DNS.
DMARC tells receivers what to do when a message fails those checks, and it sends you reports. A policy of p=none is the minimum all three providers accept.

For email deliverability, the part teams miss is alignment. Yahoo’s sender best practices require the domain in your From: header to align with either the SPF domain or the DKIM domain, and Microsoft asks for the same. In practice, every tool that sends as your brand needs a DKIM key on your domain instead of the vendor’s shared one. Your email platform, CRM, help desk and billing system all count. Watch SPF as you add vendors, too. RFC 7208 caps an SPF check at 10 DNS lookups, and a record that goes past the limit fails.

Microsoft’s rollout shows what failure looks like. Its announcement for high-volume Outlook senders requires SPF and DKIM to pass, plus DMARC at p=none or stronger, aligned with SPF or DKIM. Outlook rejects failing mail with an error that starts with “550; 5.7.515 Access denied,” so search your bounce logs for that string. Once your DMARC reports show every legitimate source passing, move the policy to quarantine and then to reject. That step also tells receivers to reject mail that spoofs your domain.

One-Click Unsubscribe and Spam Complaint Thresholds

Gmail and Yahoo both require a List-Unsubscribe header that supports one-click unsubscribe, and Yahoo recommends the POST method defined in RFC 8058. Gmail applies the rule to commercial and promotional mail. Transactional messages such as password resets are exempt. You can still keep an unsubscribe link in the message body. However, a body link alone doesn’t meet the one-click requirement.

Speed matters too. Google asks senders to process unsubscribe requests within 48 hours, and Yahoo says to honor them within 2 days. If your platform syncs suppression lists to other tools once a week, fix that first.

Complaint rates are the email deliverability requirement I see teams break most often. Google says bulk senders should keep their user-reported spam rate below 0.1% and never let it reach 0.3%. Yahoo also sets its ceiling at 0.3%, calculated on mail delivered to the inbox. In other words, three complaints per 1,000 delivered messages puts you at the limit.

Google Postmaster Tools reports your Gmail spam rate. Its newer version also adds a Compliance status dashboard that checks your mail against the sender guidelines. Google is deprecating the older interface, including its Domain and IP Reputation dashboards, so build your reporting on the new version.

List Hygiene That Protects Email Deliverability

Authentication gets your mail through the door. After that, email deliverability depends on whether recipients want what you send, and list hygiene keeps that true.

Remove hard bounces after the first failure, since repeated sends to dead addresses signal an old list.
Sunset inactive subscribers. Define inactive by clicks, purchases or replies, because Apple’s Mail Privacy Protection has inflated open rates since it shipped with iOS 15 in 2021.
Collect explicit consent at signup, and never buy or rent lists. Purchased lists carry spam traps and people who never asked to hear from you.
When you raise volume, such as during a holiday ramp, send to your most engaged segment first and then widen.

Before you delete inactive contacts, try a short win-back sequence. My post on re-engagement email strategies covers how to run one. For consent records, my overview of GDPR and data security explains what to store and for how long.

An Email Deliverability Checklist for Q4

List every system that sends email as your domain, including the CRM, help desk and billing tools.
Confirm that each one passes SPF and DKIM, with alignment to your From domain.
Send a test to a personal Gmail account, open Show original, and check that SPF, DKIM and DMARC all read PASS.
Publish DMARC at p=none with a reporting address, read the reports for a month, then tighten the policy.
Check that marketing messages carry List-Unsubscribe and List-Unsubscribe-Post headers, and that suppressions sync within 48 hours.
Verify your domain in Google Postmaster Tools and set an internal alert at a 0.1% spam rate.
Remove hard bounces, then set a sunset rule for subscribers with no clicks or purchases in six months.
Review your wider email marketing strategy so holiday volume goes to the segments that want it.