Gmail, Yahoo and Outlook Sender Requirements (2026)

#01What do the three providers require?

Microsoft's rule applies from 5 May 2025 to domains sending more than 5,000 messages a day to Outlook.com, Hotmail.com and Live.com addresses. Non-compliant messages get:

550; 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level.

#02How does Gmail count bulk senders?

Gmail treats you as a bulk sender if you have sent close to 5,000 or more messages to personal Gmail accounts in 24 hours. The count combines all mail from the same primary domain, so news., app. and the root domain count together. Once you hit the threshold, you are a bulk sender permanently. Plan for bulk rules even if you are smaller today.

#03How does one-click unsubscribe work?

RFC 8058 defines two headers that a mailbox provider uses to unsubscribe the reader without them visiting a page:

List-Unsubscribe: <https://news.ledgerline.example/u/7f3a9c>, <mailto:unsub@news.ledgerline.example?subject=unsub-7f3a9c>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

• The HTTPS URL must accept a POST with List-Unsubscribe=One-Click and unsubscribe the recipient without further steps or login.
• Both headers must be covered by the DKIM signature.
• The URL should be unique per recipient and list, without exposing the email address in plain text.
• You still need a visible unsubscribe link in the body. That link may go to a preference centre.

Most modern ESPs add these headers automatically for marketing sends on authenticated domains. Check by opening "Show original" in Gmail. Custom sending setups (for example, product email via an API) need to add them in code for any marketing content.

#04How does the spam rate work?

The spam rate in Gmail Postmaster Tools is the share of messages delivered to the inbox that users marked as spam on a given day. It only counts users who report spam, and only mail that reached the inbox.

Common causes of spikes: sending to a dormant segment, a new lead source with weak consent, a misleading subject line, a frequency increase, or making unsubscribe hard to find (people use the spam button instead).

#05What does enforcement look like now?

Gmail says it started ramping up enforcement in November 2025. Non-compliant traffic can receive temporary errors (4xx, deferrals) or permanent rejections (5xx). Gmail's FAQ publishes an enforcement table and the error codes. Typical signals:

• A rise in 421 or 550 responses in your ESP's bounce logs, with text mentioning authentication, unsubscribe or "unsolicited".
• A "Needs work" status in the Postmaster Tools Compliance status dashboard (lesson 6).
• Delivery rate drops at Gmail but not at other providers.

Gmail also says that if you fix the problem, delivery improves automatically. Mitigation requests through the sender contact form are only available when you meet the requirements and stay below 0.3% spam.

#06What about Google Workspace and Microsoft 365 recipients?

Most B2B recipients sit on Workspace or Microsoft 365. The consumer sender rules formally target personal accounts, but business filters use similar signals and admins add their own. Treat the requirements as the minimum for all mail. For Microsoft 365 business recipients, also watch for quarantine messages reported by customers and test with a seed account in a Microsoft 365 tenant.

#07Worked example: Ledgerline

Ledgerline is a fictional accounts-payable software company. Figures are illustrative, not benchmarks.

Ledgerline sends about 9,000 marketing messages on a typical weekday (illustrative), a third to consumer Gmail and Outlook.com addresses (founders and small-business users). After a product launch email, the ESP shows 1,200 bounces from Outlook.com with 550 5.7.515.

Walkthrough

1. Read the bounce text. It names ledgerline.example, not news.ledgerline.example. The launch went out through the product team's API tool, which sends from the root domain.
2. Check authentication with a test send. SPF passes on the vendor's bounce domain; DKIM is signed with the vendor domain; DMARC fails alignment.
3. Fix: custom DKIM and return-path for the API tool on app.ledgerline.example; marketing content moved back to the ESP.
4. Add RFC 8058 headers to any marketing template sent through the API tool.
5. Check Gmail. Postmaster Tools shows the spam rate at an illustrative 0.18% that day. The team removes recipients with no clicks in 12 months from launch-style sends.
6. Re-send only to the bounced, still-consented recipients after DMARC passes in testing.

#08Common mistakes

• Assuming you are under 5,000 per day because each subdomain is small.
• Putting the visible unsubscribe link behind a login.
• One-click URL that only accepts GET, or opens a "Are you sure?" page.
• Ignoring Outlook.com because "everyone uses Gmail".
• Treating 0.3% as the target rather than the cliff.

#09Try it yourself

Send one marketing email from each tool to a personal Gmail and Outlook.com address. In each, view the original headers. Confirm SPF, DKIM, DMARC pass and align, List-Unsubscribe and List-Unsubscribe-Post are present and DKIM-signed, and TLS was used. Note any gap with an owner and a date.

#10Quick quiz

1. How is bulk-sender volume counted at Gmail? Answer: Close to 5,000 or more messages to personal Gmail accounts in 24 hours, across the primary domain including subdomains.

2. Which two headers deliver one-click unsubscribe? Answer: List-Unsubscribe with an HTTPS URL and List-Unsubscribe-Post: List-Unsubscribe=One-Click.

3. What happens above a 0.3% spam rate at Gmail? Answer: You lose mitigation eligibility until you stay below 0.3% for seven consecutive days.

4. Since when does Outlook.com enforce high-volume rules? Answer: 5 May 2025.

#11What should you check before the next lesson?

• All marketing streams pass SPF, DKIM and aligned DMARC.
• One-click headers present and DKIM-signed.
• Unsubscribes processed in under 48 hours.
• Spam rate baseline recorded.

Previous: SPF, DKIM, DMARC and BIMI setup · Next: Postmaster Tools v2 and deliverability monitoring

Or return to the Email Marketing for Marketers track.

Related: Email compliance: GDPR, PECR, CAN-SPAM and CASL · Domain warm-up and list hygiene · How to choose an email service provider

#12Common questions

Who counts as a bulk sender for Gmail? Any sender that has sent close to 5,000 or more messages to personal Gmail accounts within a 24-hour period. The count covers all mail from the same primary domain, including subdomains, and once you qualify you stay classified as a bulk sender.

What spam rate does Gmail allow? Gmail asks senders to keep the user-reported spam rate in Postmaster Tools below 0.1% and to never reach 0.3%. At 0.3% or above you lose eligibility for mitigation until you stay below 0.3% for seven consecutive days.

Is one-click unsubscribe required for transactional email? No. Gmail requires one-click unsubscribe for marketing and subscribed messages from bulk senders. Transactional messages such as password resets are excluded.

What does Outlook error 550 5.7.515 mean? Outlook.com rejected mail from a high-volume sender because the domain does not meet the required authentication level, meaning SPF, DKIM or aligned DMARC is missing or failing.