Between February 2024 and May 2025, the three largest consumer mailbox providers moved from publishing best practices to enforcing requirements. Google, Yahoo and Microsoft now apply concrete technical rules to bulk senders, and mail that fails them is deferred or rejected rather than filtered into spam.
This is the current state of those requirements and what each one demands of you.
Who counts as a bulk sender
Google defines a bulk sender as anyone sending close to 5,000 messages or more to personal Gmail accounts within a 24-hour period. That is 5,000 to Gmail consumer addresses, not 5,000 total – a list of 30,000 with a typical Gmail share crosses the line on a single campaign. Microsoft applies a comparable 5,000-per-day threshold to outlook.com, hotmail.com and live.com addresses.
Once you cross the threshold, you do not drop back out of scope by sending less next week. Build for the requirements regardless of volume; everything on this list is good practice at any size.
Authentication: SPF, DKIM and DMARC
All three providers require all three records.
- SPF – publishes which servers are allowed to send for your domain.
- DKIM – cryptographically signs your messages so the receiver can verify they were not altered and did come from you.
- DMARC – tells receivers what to do when SPF and DKIM fail. A policy of
p=nonesatisfies the minimum requirement.
Google additionally requires alignment: the organisational domain in your From: header must match the domain used in either your SPF or DKIM authentication. Passing SPF for some third-party sending domain while your From: address says something else does not count.
The setup order that avoids problems is covered in the authentication checklist.
Spam complaint rates
Google is specific: keep spam rates below 0.1%, and prevent them from ever reaching 0.3% or higher. Senders who cross 0.3% become ineligible for mitigation support, and eligibility only returns after seven consecutive days below that line.
Microsoft treats low complaint rates as a strong expectation rather than a hard published threshold, but the practical effect is the same.
Complaint rate is where list hygiene shows up indirectly. Mail that lands in spam collects complaints at a much higher rate than mail in the inbox, so a reputation problem caused by bounces becomes a complaint problem that deepens the reputation problem. Cleaning breaks that loop at the start.
One-click unsubscribe
Marketing and promotional messages must support one-click unsubscribe using List-Unsubscribe headers as specified in RFC 8058. Google requires unsubscribe requests to be honoured within 48 hours; Microsoft specifies two days.
Transactional messages are exempt. A password reset does not need an unsubscribe link.
The header is not a substitute for a visible unsubscribe link in the message body – you need both. And “honoured within 48 hours” means actually suppressed, not queued for the next manual list sync.
Infrastructure requirements
- TLS for SMTP connections.
- Valid forward and reverse DNS records for your sending IPs (FCrDNS).
- RFC 5322 compliant message formatting.
- No impersonation of Gmail From: headers, and no forwarding practices that break authentication without repair.
Most senders on a reputable ESP inherit these automatically. If you run your own mail infrastructure, they are yours to get right.
The one difference that should change your priorities
Google and Yahoo respond to non-compliant mail with temporary deferrals – 4xx errors that give you a window to notice and fix the problem before permanent damage. Microsoft, since 5 May 2025, rejects non-compliant mail outright.
That asymmetry matters. A misconfiguration that Gmail would let you discover through rising deferrals will simply destroy your Outlook delivery with no soft landing. If a meaningful share of your list sits on outlook.com, hotmail.com or live.com, authentication is not a project for next quarter.
A compliance pass you can run this week
- Confirm SPF, DKIM and DMARC exist and pass – send a test to a seed account and inspect the headers.
- Confirm From: domain alignment with SPF or DKIM.
- Confirm List-Unsubscribe and List-Unsubscribe-Post headers are present on marketing sends.
- Confirm unsubscribes are processed within 48 hours end to end, including any downstream CRM sync.
- Pull your complaint rate by provider for the last 90 days and check it against 0.1%.
- Clean the list so bounces are not feeding the complaint problem.
- Check sending IPs for valid reverse DNS.
Requirements at this level are a floor, not a strategy. Meeting them gets your mail considered. What decides whether it reaches the inbox is sender reputation, and reputation is built on sending wanted mail to addresses that exist.
Ready to see what is actually in your list? EmailListClean verifies up to 10,000 addresses a minute at 99.2% accuracy, from $100 for 250,000 emails. Start with 100 free credits or see volume pricing.
Leave a Reply