For two years, the biggest mailbox providers have been rewriting the terms of entry for anyone sending email at volume. Google and Yahoo moved first, Microsoft followed, and by late 2025 the grace periods were over: mail that fails authentication or annoys recipients now gets rejected, not just filtered. Here is what each provider actually requires, verified against their own documentation, and what it means for AI-driven outbound in 2026.

How we got here: a two-year tightening cycle

On 3 October 2023, Google announced that from February 2024, senders of more than 5,000 messages a day to Gmail addresses would need to strongly authenticate their email, support one-click unsubscribe and stay under a defined spam-rate threshold — which Google called “an industry first”. Yahoo endorsed the move in the same announcement and enforced matching standards from February 2024 through its own sender hub.

Microsoft joined on 2 April 2025, announcing that domains sending more than 5,000 emails a day to its consumer services would require SPF, DKIM and DMARC. In an update to that announcement dated 29 April 2025, Microsoft went further than its original junk-foldering plan: from 5 May 2025, messages failing the required authentication level would be rejected outright with the error “550; 5.7.515 Access denied, sending domain does not meet the required authentication level”.

The most recent shift is Google’s. Its sender-guidelines FAQ now states: “Starting November 2025, Gmail is ramping up its enforcement on non-compliant traffic. Messages that fail to meet the email sender requirements will experience disruptions, including temporary and permanent rejections.” As at August 2026, no new requirements have been added beyond these — but the cost of ignoring them has moved from “some mail lands in spam” to “some mail doesn’t land at all”.

Gmail’s requirements in detail

Google’s Email sender guidelines set a baseline for everyone — SPF or DKIM, valid forward and reverse DNS, TLS, and a spam rate below 0.3% — and a stricter tier for bulk senders:

• Authentication: SPF and DKIM must both pass, and the domain must publish a DMARC record (a policy of p=none is the minimum). The From: header domain must align with SPF or DKIM.
• One-click unsubscribe: marketing and subscribed messages must support one-click unsubscribe via the List-Unsubscribe and List-Unsubscribe-Post headers, with requests honoured within two days.
• Spam rate: keep the rate reported in Postmaster Tools below 0.1%, and never let it reach 0.3% or higher. Rates are calculated daily, and a sender that crosses 0.3% becomes ineligible for mitigation support until it stays below that line for seven consecutive days.

Two definitional details from Google’s FAQ matter more than most commentary admits. First, the 5,000-a-day trigger counts messages to personal Gmail accounts across your whole primary domain — 2,500 from yourdomain.com plus 2,500 from mail.yourdomain.com makes you a bulk sender. Second, bulk-sender status has no expiration date: hit the threshold once and the requirements apply to you permanently, regardless of what you send afterwards.

Microsoft’s requirements for Outlook consumer domains

Microsoft’s rules, published on the Defender for Office 365 blog, apply to its consumer service — outlook.com, hotmail.com and live.com addresses — for domains sending more than 5,000 emails a day. The authentication bar mirrors Google’s: SPF must pass, DKIM must pass, and DMARC must be published at a minimum of p=none and align with SPF or DKIM (Microsoft says preferably both). Microsoft’s support documentation defines a high-volume sender as one sending 5,000 or more messages to its consumer email services using the same domain in the From address, and failures surface as the 550 5.7.515 rejection.

Beyond authentication, Microsoft lists hygiene practices it “reserves the right to take negative action” over: a valid From or Reply-To address that reflects the true sending domain and can receive replies, functional and clearly visible unsubscribe links, regular list hygiene and bounce management, and transparent practices — accurate subject lines, no deceptive headers, and recipients who actually consented.

Yahoo’s requirements

Yahoo’s sender hub requires bulk senders to implement both SPF and DKIM, publish a DMARC policy of at least p=none with DMARC passing, implement a functioning list-unsubscribe header supporting one-click unsubscribe (the RFC 8058 POST method is preferred), honour unsubscribes within two days, and keep the spam rate below 0.3%. Enforcement began in February 2024 and was rolled out gradually through the first half of that year.

Gmail vs Outlook vs Yahoo at a glance

Requirement	Gmail (Google)	Outlook consumer (Microsoft)	Yahoo
Authentication	SPF + DKIM + DMARC (min. p=none), From: aligned with SPF or DKIM	SPF pass + DKIM pass + DMARC (min. p=none), aligned with SPF or DKIM	SPF + DKIM + DMARC (min. p=none), DMARC must pass
One-click unsubscribe	Required for marketing/subscribed mail (RFC 8058 headers); honour within 2 days	Functional, visible unsubscribe links recommended as hygiene practice	Required (RFC 8058 POST preferred); honour within 2 days
Spam-rate threshold	Keep below 0.1%; never reach 0.3%	No published numeric threshold; Outlook reserves the right to filter or block over authentication or hygiene breaches	Keep below 0.3%
Volume trigger	~5,000 messages/day to personal Gmail accounts, summed across the primary domain; status is permanent	5,000+ emails/day to consumer domains from the same From domain	Bulk senders (no numeric definition on the requirements page)
Enforcement	From February 2024; rejections ramping up from November 2025	From 5 May 2025; authentication failures rejected with 550 5.7.515; other non-compliance routed to Junk, with wider rejections at a date Microsoft says it will announce	From February 2024, phased through H1 2024

Why this hits AI-driven outbound hardest — and how to run inside the rules

An AI email agent removes the natural rate-limiter that human reps provide. Software can enrol a thousand prospects in a sequence before lunch — which means a thousand chances to be marked as spam before lunch. Do the arithmetic on Google’s threshold: 0.3% is three complaints per thousand delivered messages, a budget one stale list segment can consume in a single send. This is one reason reply rates on AI outbound have been falling — volume grew faster than the infrastructure discipline behind it.

Four practices separate outbound teams that keep sending from those that get rejected:

• List hygiene as a pipeline stage, not a quarterly clean-up. Bounces and spam-trap hits are exactly what Microsoft’s hygiene guidance targets. Validate addresses before the agent ever sees them, and suppress hard bounces immediately.
• Engagement-based pacing. Sending schedules should respond to engagement signals — throttling a segment that isn’t opening or replying — rather than marching through a fixed cadence. We’ve written about how follow-up pacing can be tuned as a first-class variable rather than a hard-coded “day 1, day 3, day 7” loop.
• Unsubscribe handling wired into the agent. One-click unsubscribe is a machine-to-machine protocol: the mailbox provider sends an HTTPS POST, and your system must process it — Gmail and Yahoo both expect requests honoured within two days. An AI agent must also treat a reply saying “take me off your list” with the same finality as the header-based signal.
• Reply-based warmup, honestly done. New domains need gradually increasing volume with genuine engagement. Simulated-engagement warmup networks sit uneasily with the transparent-practices language in Microsoft’s guidance; earning real replies on low volume is the durable route.

There’s also a structural answer: stop depending on one inbox. When a single channel’s gatekeepers tighten, email-only sequencers absorb the full impact, because every conversation they can start passes through the filters described above. Multi-channel orchestration spreads that dependency: Zian’s AI agents work across live phone, SMS, email and WhatsApp, with SmartReach AI™ choosing the message, channel and timing for each prospect by country, industry and profile. To be clear about what that is and isn’t: it’s a workload-distribution capability, not a deliverability guarantee — authentication records, list quality and complaint rates remain the sender’s responsibility on every channel, and each channel brings its own compliance obligations.

The 2026 bulk-sender checklist

1. Publish SPF listing every service that sends for your domain, and DKIM-sign all outbound mail — both must pass, on every sending subdomain.
2. Publish a DMARC record (at least p=none) and confirm alignment between your From: domain and SPF or DKIM. Review DMARC aggregate reports monthly.
3. Implement RFC 8058 one-click unsubscribe headers on marketing and sequence mail, and process every unsubscribe — header or reply — within two days.
4. Register for Google Postmaster Tools; watch the daily spam rate and treat 0.1% as your alarm line, not 0.3%.
5. Count daily volume across the whole primary domain, including subdomains — that’s how Google decides you’re a bulk sender, and the status is permanent.
6. Validate lists before sending, suppress bounces immediately, and pace sends on engagement rather than fixed cadence.
7. Send from an address that can receive replies, with accurate subject lines — and route those replies somewhere they get answered.

Frequently asked questions

What counts as a bulk sender under Gmail’s rules?

A sender that has sent close to 5,000 messages or more to personal Gmail accounts within a 24-hour period, counted across the whole primary domain — mail from yourdomain.com and mail.yourdomain.com is summed together. According to Google’s sender guidelines FAQ, bulk-sender status doesn’t have an expiration date: once you reach the threshold, the requirements apply to you permanently.

What is one-click unsubscribe under RFC 8058?

RFC 8058, “Signaling One-Click Functionality for List Email Headers”, is the IETF standard behind the requirement. The message carries a List-Unsubscribe header with an HTTPS URI plus a List-Unsubscribe-Post header, and the mailbox provider unsubscribes the user by sending an HTTPS POST to that URI — no landing page, no login. The full specification is at datatracker.ietf.org. Gmail and Yahoo both require it for bulk marketing mail and expect requests honoured within two days.

What happens if my domain fails Microsoft’s authentication requirements?

Since 5 May 2025, Outlook.com rejects mail from high-volume domains that fail the required authentication level, returning “550; 5.7.515 Access denied, sending domain does not meet the required authentication level”. Microsoft’s support page for the error confirms the fix: publish SPF and DKIM so both pass, publish a DMARC record, and ensure SPF or DKIM aligns with the domain in the From address.

Have the Gmail and Yahoo rules changed since February 2024?

The requirements themselves have been stable — the same authentication, one-click unsubscribe and spam-rate rules apply in 2026 as in 2024. What changed is enforcement: Google’s FAQ states that starting November 2025, Gmail is ramping up enforcement on non-compliant traffic, with disruptions including temporary and permanent rejections. Yahoo’s published requirements have not materially changed since its February 2024 rollout.

What spam rate should an outbound team actually target?

Treat 0.1% as the operating ceiling, because that’s the level Google tells senders to stay below; 0.3% is the point where consequences become severe and mitigation support is withdrawn until you hold below it for seven consecutive days. In practical terms, 0.1% is one complaint per thousand delivered messages — which is why list quality and message relevance matter more than any sending trick.

Do these rules apply to cold outbound, or only to newsletters?

The thresholds are volume-based, not intent-based: if your domain sends 5,000+ messages a day to a provider’s mailboxes, the authentication and spam-rate rules apply regardless of whether the mail is marketing, transactional or cold outreach. Cold email is in practice more exposed, because unsolicited mail draws complaints at a higher rate — and recipients who can’t find an unsubscribe path use the spam button instead, which counts against the threshold.

Deliverability infrastructure now decides whether your outbound is heard at all — and the teams navigating 2026 best stopped treating any single inbox as the only door. Zian is currently accepting partner applications for its beta.

Apply For Partnership