Gmail, Yahoo and Outlook sender rules: a checklist

If your newsletter suddenly lands in spam or bounces with an error code, the problem is often not the words in it. Since 2024, Gmail and Yahoo have required senders to prove who they are, and Outlook.com followed in 2025. This checklist sums up what each provider asks for, using their own documentation.

The rules at a glance

Sources: Google sender guidelines, Google FAQ, Yahoo Sender Hub and Microsoft's announcement.

Gmail and Yahoo also set basic rules for every sender, whatever the volume: authenticate with SPF or DKIM, keep valid forward and reverse DNS for sending servers, and keep spam complaints below 0.3%.

The checklist

Authentication

• Publish an SPF record that lists the servers allowed to send email for your domain.
• Turn on DKIM signing with your email service. Google requires a key of at least 1024 bits for personal Gmail accounts and recommends 2048 bits.
• Publish a DMARC record. A policy of p=none is the minimum for bulk senders at all three providers.
• Make sure the domain in your From address matches the SPF or DKIM domain. This is called alignment, and DMARC needs it to pass.
• If a newsletter service sends for you, set all of this up on your own domain. Microsoft's FAQ notes you still need SPF, DKIM and DMARC in your own DNS when a vendor does the sending.

Sending setup

• Give sending servers valid forward and reverse DNS records, also called PTR records.
• Send over a TLS connection, which Gmail requires.
• Format messages to the internet message standard, RFC 5322.

Most email services handle this part for you. It is still worth confirming with yours.

Unsubscribe

• Support one-click unsubscribe for marketing and subscribed email by adding the List-Unsubscribe and List-Unsubscribe-Post headers (RFC 8058). Google excludes transactional messages, such as password resets and booking confirmations.
• Keep a clearly visible unsubscribe link in the body of the email as well. Gmail and Yahoo both ask for it.
• Act on unsubscribes fast. Yahoo says within 2 days. Google recommends within 48 hours and lists unhonoured requests in its enforcement table.

Spam complaints

• Watch your spam rate in Google Postmaster Tools. Google asks you to stay below 0.10% and never reach 0.30%.
• Yahoo asks bulk senders to stay below 0.3%.
• Only email people who asked to hear from you. Yahoo warns against bought lists and pre-ticked sign-up boxes.

What happens if you don't comply

• Gmail: From November 2025, Google ramped up enforcement. Messages that don't meet the requirements can get temporary or permanent rejections. Once a domain sends close to 5,000 messages to personal Gmail accounts in a day, Google classes it as a bulk sender permanently.
• Yahoo: Enforcement began in February 2024 and was rolled out gradually.
• Outlook.com: Since 5 May 2025, messages from high-volume domains that fail the requirements are rejected with the error "550; 5.7.515". This covers outlook.com, hotmail.com and live.com addresses.

Where your email design fits

Authentication lives in your DNS and your sending service, not in the email itself. But a few rules touch the design, especially the visible unsubscribe link.

Pagestro's email builder is for designing and testing emails, not for sending campaigns. Its pre-send checks flag a missing unsubscribe link in marketing emails, empty or insecure (http) links, missing alt text and preview text, and emails big enough for Gmail to clip. You can insert an unsubscribe merge tag from the text toolbar, then export HTML or MJML to the service you send from. The one-click unsubscribe headers have to come from that service.

Heavy images don't cause clipping, but they make emails slow to load on phones. Shrink them first with Compress Image, which runs in your browser. For more on layout, see how to build an HTML email that works everywhere.

Designing and exporting needs no account. Saving designs and sending test emails to yourself need a free account, and paid plans include more of both (see pricing).

Frequently asked questions

Do these rules apply if I send fewer than 5,000 emails a day?

Some do. Gmail and Yahoo ask every sender to use SPF or DKIM, keep valid DNS and keep spam complaints low. DMARC and one-click unsubscribe are required for bulk senders, but Google and Microsoft recommend full authentication for everyone.

Do receipts and password resets need one-click unsubscribe?

No. Google's one-click requirement covers marketing and subscribed messages. Transactional messages are excluded.

Is a DMARC policy of p=none enough?

It meets the minimum at all three providers. Microsoft recommends moving gradually from none to quarantine to reject once all your legitimate senders pass.

Does Pagestro send my newsletter?

No. Pagestro helps you design, check and export the email. You send it from your own email service, which also handles authentication and unsubscribe headers.