Gmail & Yahoo Email Sender Requirements (2026)

Gmail and Yahoo began enforcing major sender-authentication requirements in February 2024, and those requirements remain important in 2026. The obligations differ between ordinary senders and bulk senders. A working SPF or DKIM setup, valid DNS and responsible sending practices matter for everyone; larger senders also face additional authentication, alignment and unsubscribe requirements.

A DNS scan cannot certify full Gmail or Yahoo compliance. It can inspect published SPF, DKIM and DMARC configuration where selectors are known, but it cannot determine the spam complaint rate, prove how a specific message authenticated, or confirm that a marketing email provides a working one-click unsubscribe. Those checks need message data or provider reporting tools.

Source policies: Gmail Email sender guidelines and Yahoo Sender Hub sender requirements. These providers may update requirements; review their current policies before changing production sending systems. Yahoo's sender FAQ is also published at senders.yahooinc.com/faqs.

Requirements for regular senders and bulk senders

Important: Google considers senders that send close to 5,000 or more messages to personal Gmail accounts within a 24-hour period to be bulk senders. Messages from the same primary domain, including its subdomains, count together. Once classified as a bulk sender, that status does not expire. Yahoo says "significant volume" and does not publish an equivalent fixed numerical threshold. Neither provider's rules should be portrayed as guarantees of inbox placement.

For Yahoo, the RFC 8058 POST method is strongly recommended, while Yahoo also describes a mailto: List-Unsubscribe method as acceptable. Gmail has its own one-click requirements for bulk marketing or subscribed messages. Ordinary transactional emails are not automatically subject to the same marketing unsubscribe requirement.

Which requirements can MXScan check from DNS?

Can inspect from published DNS:

• Whether SPF and DMARC TXT records are published and whether recognizable syntax/policy values are present.
• DKIM public-key records for selectors the checker knows or probes; missing a guessed selector does not prove DKIM is disabled.
• MX and some other domain-related DNS records.

Cannot confirm using DNS alone:

• Whether a real message passed SPF or DKIM and satisfied DMARC alignment.
• Whether the actual sending IP has correct forward-confirmed reverse DNS, without knowing that IP.
• Whether the connection transmitting a specific message used TLS.
• Whether a marketing message has a functioning List-Unsubscribe header and unsubscribe workflow.
• Gmail Postmaster or Yahoo complaint-rate measurements, inbox placement, or the sender's daily volume.

How to verify the parts DNS cannot test

1. Send a representative message from each sending platform to a mailbox you control. Inspect the receiving system's authentication results for SPF, DKIM and DMARC. Confirm that at least one passing mechanism aligns with the visible From domain.
2. Check the actual sending IP's forward and reverse DNS and test server-to-server TLS with a genuine SMTP connection tool where available.
3. For subscribed or marketing messages, inspect the actual message headers and complete the unsubscribe flow to verify that it works.
4. Review Google Postmaster Tools and Yahoo's sender resources for complaint and reputation information. A published DNS record cannot reveal these values.
5. Repeat these checks after adding a new sender, changing a mail platform or updating DNS authentication.

How DMARC alignment works

DMARC evaluates whether the visible From domain aligns with a domain authenticated by a passing SPF check, a passing DKIM signature, or both. A valid SPF record at the domain does not itself demonstrate that actual messages pass SPF or align. A p=none DMARC policy requests monitoring rather than DMARC-specific quarantine or rejection; it can still meet the providers' minimum published DMARC policy requirement for bulk senders.

Use the DMARC alignment guide to learn the difference between strict and relaxed alignment.

The 3 DNS records every sender should understand

Email authentication mainly depends on three DNS records:

1. SPF

SPF tells receiving mail servers which servers are allowed to send email for your domain.

Example:

v=spf1 include:_spf.google.com include:sendgrid.net -all

SPF helps verify the sending server, but it has limits. If email is forwarded, SPF can break. That is why DKIM is also important.

2. DKIM

DKIM adds a cryptographic signature to your email. It proves that the message was authorized by your domain and was not modified in transit.

Most email providers give you one or more DKIM DNS records to add.

Example selector record:

google._domainkey.example.com

DKIM is one of the most important records for Gmail and Yahoo deliverability because it survives forwarding better than SPF.

3. DMARC

DMARC tells receiving servers what to do when email fails SPF or DKIM authentication.

Example starter DMARC record:

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

Illustrative only: v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com. Replace the example address with a reporting mailbox or provider endpoint that you control and have configured to receive reports. Publishing this example unchanged will not deliver reports to your organization. A p=none DMARC policy requests monitoring rather than DMARC-specific quarantine or rejection.

DMARC policy: p=none vs quarantine vs reject

Your DMARC policy controls how strict your domain protection is.

p=none

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

This is monitoring mode. Failed messages are not blocked by your policy.

Best for:

• First DMARC setup
• Auditing all email sources
• Finding forgotten senders
• Avoiding accidental email disruption

p=quarantine

v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com

This tells receivers to treat failed messages as suspicious. They may go to spam or quarantine.

Best for:

• Domains that already know their legitimate senders
• Gradual enforcement
• Reducing spoofing risk

p=reject

v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com

This tells receivers to reject messages that fail DMARC.

Best for:

• Mature domains with clean SPF/DKIM alignment
• Brands at risk of phishing
• Domains that have completed DMARC monitoring

Example DNS setup by platform

Google Workspace

Typical SPF:

v=spf1 include:_spf.google.com ~all

DKIM: Enable DKIM inside Google Workspace Admin, then publish the DKIM TXT record Google provides.

DMARC starter:

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

Microsoft 365

Typical SPF:

v=spf1 include:spf.protection.outlook.com ~all

DKIM: Enable DKIM in Microsoft 365 Defender or Exchange admin center, then add the CNAME records Microsoft provides.

DMARC starter:

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

Mailchimp

Mailchimp usually requires domain authentication using DKIM CNAME records and sometimes SPF-related configuration.

Example DMARC:

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

Common mistakes that cause Gmail or Yahoo delivery problems

Multiple SPF records

A domain should have only one SPF record. This is wrong:

v=spf1 include:_spf.google.com ~all
v=spf1 include:sendgrid.net ~all

Correct version:

v=spf1 include:_spf.google.com include:sendgrid.net ~all

Missing DKIM for marketing tools

You may have DKIM enabled for Google Workspace but not for Mailchimp, Klaviyo, HubSpot, SendGrid, or another sender. Each sender needs to be authenticated.

DMARC exists but does not pass

Having a DMARC record is not enough. Your messages must also pass SPF or DKIM with alignment.

Using a strict DMARC policy too early

Moving directly to p=reject can break legitimate email if all sending services are not aligned.

Forgotten senders

Old CRMs, invoice systems, support desks, and newsletter tools often send from your domain but are not included in SPF or DKIM.

One-click domain check

Before changing DNS, scan your domain first.

Recommended rollout plan

Step 1: Audit your current records

Check:

• SPF
• DKIM
• DMARC
• DMARC alignment settings
• MX records

MTA-STS, TLS-RPT and BIMI are not universally required by Gmail's and Yahoo's basic sender requirements. p=reject is not mandatory for all bulk senders; both providers allow p=none as the minimum published DMARC policy.

Step 2: List all sending services

Create a list of every platform that sends email from your domain. Examples:

• Google Workspace
• Microsoft 365
• Mailchimp
• Klaviyo
• SendGrid
• Postmark
• Mandrill
• HubSpot
• Zendesk
• Stripe
• Shopify
• CRM or custom SMTP server

Step 3: Fix SPF and DKIM

Make sure every sender is authenticated.

Step 4: Add DMARC in monitoring mode

Start with:

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

Step 5: Review DMARC reports

Find unknown or failing senders.

Step 6: Move toward enforcement

After everything is aligned, move to:

v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com

A later enforcement policy is optional and is not required by the providers' minimum bulk-sender rule:

v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com

Final checklist

Before sending high-volume email, confirm:

• Your SPF record is valid
• DKIM is enabled for all senders
• DMARC exists
• You have checked SPF or DKIM alignment on a real message, not only in DNS
• You are not using duplicate SPF records
• Marketing emails have unsubscribe links
• One-click unsubscribe is supported where needed
• Complaint rates are low
• Your mail servers support TLS
• Your domain is not blacklisted

FAQ

Did Google and Yahoo introduce new sender rules in 2026?

The major requirements began taking effect in February 2024. This page summarizes the requirements relevant in 2026, based on the providers' published policies; always check the official Gmail and Yahoo pages for updates.

How does Gmail define a bulk sender?

Google considers senders that send close to 5,000 or more messages to personal Gmail accounts within a 24-hour period to be bulk senders. Messages from the same primary domain, including its subdomains, count together. Once classified as a bulk sender, that status does not expire. Yahoo does not publish an equivalent fixed numerical threshold.

Is p=none DMARC enough for Gmail and Yahoo bulk-sender policies?

Both providers allow a published DMARC policy at p=none as the minimum policy setting for bulk senders. However, messages still need the required authentication and alignment, and monitoring alone does not enforce quarantine or rejection of failed mail.

Can a domain scan prove that we meet all sender requirements?

No. DNS inspection can find some published configuration issues, but message-level authentication, unsubscribe behavior, sending IP and connection details, spam rates and actual mail delivery require other tests or reporting sources.

Is one-click unsubscribe required for password-reset emails?

The specialized one-click unsubscribe obligations discussed here target marketing and subscribed messages, not automatically every transactional message such as a password reset. Follow applicable provider guidance and relevant law for each message category.