Google, Yahoo and Microsoft Sender Requirements: What They Mean for Your Business
The three largest mailbox providers now require SPF, DKIM and DMARC from bulk senders. Here is exactly what they ask for, who it applies to, and why businesses below the threshold should act anyway.
For years, email authentication was recommended rather than required. That changed in February 2024, when Google and Yahoo began requiring SPF, DKIM and DMARC from anyone sending in volume to their users. Microsoft followed for its consumer mail services from 5 May 2025. Together these three providers handle a very large share of the world’s personal email, which means their rules effectively set the standard for everyone who sends to the public. Here is what they require, who it applies to, and what it means for businesses that fall below the threshold.
What Google and Yahoo require
Google’s requirements are split into two tiers. The first applies to everyone sending to personal Gmail accounts:
- Authenticate mail with SPF or DKIM.
- Have valid forward and reverse DNS for sending servers.
- Use TLS for transmission.
- Keep reported spam rates low, below 0.3% and ideally well under 0.1%.
- Format messages to internet standards.
The second tier applies to bulk senders, defined as sending close to 5,000 or more messages to personal Gmail accounts in a day. They must additionally:
- Authenticate with both SPF and DKIM.
- Publish a DMARC record, with a policy of at least
p=none. - Align the From domain with either the SPF or DKIM domain.
- Offer one-click unsubscribe in marketing and subscription mail, and honour it within two days.
Yahoo introduced closely matching requirements at the same time. Google has stated that a domain that reaches the bulk threshold is treated as a bulk sender from then on, so a single large campaign can permanently change which rules apply to you.
What Microsoft requires
From 5 May 2025, Microsoft applied similar rules to domains sending more than 5,000 messages a day to Outlook.com, Hotmail.com and Live.com addresses. Those senders must:
- Pass SPF for the sending domain.
- Pass DKIM.
- Publish DMARC with at least
p=none, aligned with SPF or DKIM.
Microsoft initially routed non-compliant mail to the Junk folder, with rejection as the stated next step. Rejected mail carries an error in the 550 5.7.515 family, telling the sender that the domain does not meet the required authentication level.
| Requirement for bulk senders | Yahoo | Microsoft consumer | |
|---|---|---|---|
| In force since | February 2024 | February 2024 | 5 May 2025 |
| Threshold | About 5,000 per day | Bulk senders | More than 5,000 per day |
| SPF | Required | Required | Must pass |
| DKIM | Required | Required | Must pass |
| DMARC | At least p=none, aligned | At least p=none, aligned | At least p=none, aligned |
| One-click unsubscribe | Required for marketing mail | Required for marketing mail | Recommended |
Who this affects in South Africa
The 5,000 a day threshold sounds high, but it is counted per domain across every platform that sends as that domain. A retailer’s order confirmations, an insurer’s policy documents, a school’s parent communications, a membership organisation’s newsletter, or a property portfolio’s monthly statements can each cross it, especially on the days when everything goes out at once. Many South African consumers use Gmail and Outlook.com addresses, so a meaningful share of that volume lands with exactly these providers.
A business that has never thought about its sending volume may already be a bulk sender without knowing it, and may already be seeing delivery problems it has attributed to something else.
Why it matters below the threshold
If your business sends a few hundred emails a day, the strict rules do not bind you. There are still three good reasons to act.
The baseline already applies
Everyone sending to Gmail is expected to authenticate with SPF or DKIM. Businesses with broken SPF records, which are common, are already out of step.
The bar only moves one way
Each of these providers has tightened its rules over time. Authentication that is recommended for small senders today is a reasonable forecast of what will be required later.
The requirement is not the protection
The providers ask for p=none as a minimum because their goal is accountability, not your safety. A domain at p=none meets the requirement and remains fully open to impersonation. For protection against invoice fraud and spoofing, the policy has to reach p=reject. We explain the gap in why monitoring-only DMARC is a false sense of security.
What to do now
- Check your current records with our DMARC checker.
- Make sure you have exactly one valid SPF record within the lookup limit. See our SPF guide.
- Enable DKIM signing with your own domain on every platform that sends for you. See our DKIM guide.
- Publish DMARC with reporting, then work towards enforcement using the report data.
- Add one-click unsubscribe to marketing email if you send in volume.
The short version
- Google and Yahoo since February 2024, and Microsoft since May 2025, require SPF, DKIM and DMARC from bulk senders.
- The threshold is about 5,000 messages a day per domain, counted across every platform that sends for you.
- All senders to Gmail must at least authenticate with SPF or DKIM.
- The minimum policy, p=none, meets the rules but does not protect your domain.
Frequently asked questions
We send fewer than 5,000 emails a day. Do the rules apply to us?
The strict bulk sender rules do not, but the baseline requirements for all senders do, including SPF or DKIM authentication. And the direction of travel is clear: unauthenticated mail from any domain is treated with more suspicion each year.
Is p=none enough to meet the requirements?
For the bulk sender rules, yes: the providers ask for a DMARC record with at least p=none. But p=none does nothing to stop criminals using your domain. Meeting the requirement and being protected are two different things.
Do newsletters sent through a platform count towards our volume?
Yes. The threshold is about messages sent from your domain to the provider’s users, regardless of which platform sends them. Newsletters are often what pushes a business over the line.
Sources and standards
- Google: Email sender guidelines. Gmail requirements for SPF, DKIM and DMARC, including the rules for bulk senders.
- Yahoo Sender Hub: Sender best practices. Yahoo authentication requirements for senders.
- Microsoft: Outlook’s new requirements for high-volume senders. The April 2025 announcement of SPF, DKIM and DMARC enforcement for domains sending more than 5,000 messages a day.
MailMarq
MailMarq is a managed DMARC service run from Johannesburg. Our team has built and managed business websites, hosting and email infrastructure for South African companies since 2016, and writes these guides from work on real domains.
Keep reading
What Is DMARC, and Why It Is No Longer Optional
DMARC is the record that decides whether criminals can send email as your business. Here is how it works, what the three policies really do, and why monitoring alone protects nothing.
SPF Explained: Why a Pass Does Not Always Mean Safe
SPF is the oldest email authentication standard and the most misunderstood. It checks a different address to the one your recipient sees, and it breaks in ways nobody notices until mail stops arriving.
DKIM Explained: The Signature Behind Trusted Email
DKIM is the part of email authentication that survives forwarding and does most of the work for DMARC. It is also the part most often left signing with someone else's domain.
Find out where your domain stands
Send us your domain. We will review your DMARC, SPF and DKIM set-up, map the services sending as you, and tell you plainly what it would take to reach enforcement. No charge and no obligation.