The short version
All three providers want every sender to authenticate with SPF or DKIM,
and want bulk senders to publish DMARC, at p=none or stronger, aligned
with SPF or DKIM. Gmail and Microsoft put the bulk line at 5,000 messages
a day to their users; Yahoo doesn’t publish a number. Since November 2026,
Outlook.com has also refused some mail from domains with no DMARC record
at any volume. If you send email as your domain, publish DMARC.
The rules side by side
| Gmail | Yahoo | Outlook.com (Microsoft) | |
|---|---|---|---|
| In force since | 1 February 2024 | February 2024, rolled out gradually | 5 May 2025 |
| Bulk threshold | More than 5,000 messages a day to Gmail accounts | Not published | More than 5,000 messages a day to Outlook.com, Hotmail and Live |
| Every sender | SPF or DKIM; forward and reverse DNS for sending IPs; TLS; spam rate under 0.3% | SPF or DKIM; forward and reverse DNS; spam rate under 0.3% | No published rule for low volume, but see November 2026 below |
| Bulk senders: SPF and DKIM | Both | Both | Both must pass |
| Bulk senders: DMARC | Published, p=none or stronger, From aligned with SPF or DKIM |
Published, p=none or stronger, and passing, aligned with SPF or DKIM |
Published, p=none or stronger, aligned with SPF or DKIM |
| Bulk senders: unsubscribe | One-click (List-Unsubscribe-Post) plus a visible link |
One-click plus a visible link; honour within 2 days | Not part of the published requirement |
| Spam rate | Under 0.3%, and aim for under 0.1% | Under 0.3% | Not part of the published requirement |
| What happens if you don’t | Rate-limited (4xx) or blocked (5xx) |
Enforced gradually; Yahoo doesn’t say how | Junk folder first; rejection with 5.7.515 announced to follow |
Sources: Google’s email sender guidelines, Yahoo’s sender best practices and Microsoft’s requirements for high-volume senders, read on 9 November 2026.
November 2026: Outlook.com and domains with no DMARC record
Since 5 November 2026, mail to Outlook.com, Hotmail, Live and MSN addresses from some domains that publish no DMARC record at all has been refused, whatever the volume, with:
550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records
Microsoft hasn’t announced it. We cover what’s known in why Outlook.com is rejecting mail without DMARC.
The bounces, by provider
| Provider | Bounce | What it means |
|---|---|---|
| Gmail | 550 5.7.26 “Unauthenticated email from [domain] is not accepted due to domain’s DMARC policy” |
The message failed DMARC and the domain’s policy says reject |
| Gmail | 550 5.7.26 “This email has been blocked because the sender is unauthenticated” |
Neither SPF nor DKIM passed |
| Gmail | 421 4.7.40 / 550 5.7.40 |
The sending domain has no DMARC record, or it isn’t valid |
| Gmail | 4.7.32 / 5.7.32 |
The From domain isn’t aligned with the SPF or DKIM domain |
| Gmail | 550 5.7.27 / 550 5.7.30 |
SPF didn’t pass / DKIM didn’t pass |
| Outlook.com | 550 5.7.515 “Access denied, sending domain [domain] does not meet the required authentication level” |
A high-volume sender that misses the requirements above |
| Outlook.com | 550 5.7.1 “Message lacks SPF/DKIM/DMARC Auth Records” |
A domain with no DMARC record (November 2026) |
A 4xx code is temporary: the receiver is slowing you down and the
message will be retried. A 5xx is a refusal. Each code, with its fix, is
in reading a DMARC bounce.
What to do
- Publish DMARC at
p=nonewith a report address, even below any threshold. It costs nothing, and it is the one record all three providers now look for. - Make every sender aligned. Each service that sends as your domain (your mailbox provider, your CRM, your invoicing and helpdesk tools) needs SPF or DKIM that passes for your domain, not its own. The reports list them; see auditing third-party senders.
- Then tighten.
p=nonemeets the rules but doesn’t stop anyone sending as you. Quarantine by day 30 and reject from day 60 is the path.
The domain scan checks SPF, DKIM, DMARC, MX, MTA-STS and TLS-RPT in one go and grades the result.