Email sender requirements 2026: Gmail, Yahoo and Outlook

The email sender requirements in 2026 come down to four things: authenticate your domain with SPF and DKIM, publish a DMARC record that passes with your From: domain aligned, keep your spam complaint rate under 0.3% (ideally under 0.1%), and offer one-click unsubscribe on marketing mail. Gmail, Yahoo and Outlook.com all enforce some version of this, and failures now bounce.

Key points

• Every sender to Gmail and Yahoo needs SPF or DKIM, valid reverse DNS and a spam rate below 0.3%.
• Senders of more than 5,000 messages a day need SPF and DKIM, DMARC (p=none is enough) and alignment. Outlook.com applies the same idea.
• Google says that from November 2025 non-compliant mail faces temporary and permanent rejections, not just the spam folder.
• Aim for a spam complaint rate below 0.1%, and treat 0.3% as a hard limit.
• Google Workspace senders are covered too when they send to personal Gmail accounts.

What are Gmail's sender requirements in 2026?

Gmail's sender requirements ask every sender for SPF or DKIM, valid forward and reverse DNS, TLS, RFC 5322 formatting and a spam rate below 0.3%. Bulk senders, those sending more than 5,000 messages a day to Gmail accounts, must also have SPF and DKIM, DMARC, alignment and one-click unsubscribe.

As of October 2026, Google's email sender guidelines list these rules for all senders:

• Set up SPF or DKIM for your sending domains.
• Have valid forward and reverse DNS (PTR) records for your sending domains or IPs.
• Use a TLS connection to send.
• Keep spam rates reported in Postmaster Tools below 0.3%.
• Format messages to RFC 5322.
• Don't impersonate Gmail From: headers.

The Gmail bulk sender requirements add four more. SPF and DKIM, not one or the other. A DMARC record, where Google says "your DMARC enforcement policy can be set to none". Alignment, meaning the domain in the From: header matches either the SPF domain or the DKIM domain. And one-click unsubscribe on marketing and subscribed messages, plus a clearly visible unsubscribe link in the body.

Three details in Google's sender guidelines FAQ catch people out:

• Subdomains add up. "Messages sent from the same primary domain count toward the 5,000 limit."
• Bulk status is permanent. "Senders who meet the above criteria at least once are permanently considered bulk senders."
• Enforcement is real now. The FAQ says that "starting November 2025, Gmail is ramping up its enforcement on non-compliant traffic", with disruptions including temporary and permanent rejections. Google calls it gradual and progressive, with new domains on an accelerated timetable.

What do Yahoo and Outlook require?

Yahoo's rules almost mirror Gmail's: SPF or DKIM for everyone, and SPF, DKIM, a passing DMARC policy and one-click unsubscribe for bulk senders. Outlook.com requires SPF, DKIM and DMARC of at least p=none from domains sending more than 5,000 emails a day.

Yahoo's sender best practices ask all senders to "implement SPF or DKIM at a minimum", keep the spam rate below 0.3%, have valid forward and reverse DNS for sending IPs and comply with RFCs 5321 and 5322. Bulk senders must implement both SPF and DKIM, "publish a valid DMARC policy with at least p=none", align the From: domain with SPF or DKIM (relaxed alignment is fine), support one-click unsubscribe for marketing and subscribed messages, and "honor unsubscribes within 2 days".

Microsoft announced its Outlook sender requirements in a Microsoft Tech Community post. They apply to Outlook.com, which serves hotmail.com, live.com and outlook.com addresses, for domains sending over 5,000 emails a day. SPF must pass, DKIM must pass, and DMARC must be at least p=none and align with SPF or DKIM, "preferably both". Microsoft also recommends a functional unsubscribe link and regular list cleaning.

Here is how the three compare as of October 2026.

Microsoft's post is the least tidy of the three. It was updated on 29 April 2025 and now says messages that fail will be rejected with "550; 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level", starting 5 May 2025. A later paragraph on the same page still talks about routing non-compliant mail to Junk first. Plan for rejection.

What is a good spam complaint rate?

A good spam complaint rate is below 0.1%. Google tells senders to keep the rate in Postmaster Tools below 0.10% and "avoid ever reaching a spam rate of 0.30% or higher". Yahoo uses the same 0.3% ceiling.

The spam complaint rate is the share of your inboxed emails that recipients mark as spam. Google's Postmaster Tools dashboard help defines it as the percent of your messages delivered to an engaged recipient's inbox and then marked as spam. Two things follow:

• A low number can hide a problem. Google warns that if Gmail sends many of your messages to spam, the rate can look artificially low, because fewer people see them.
• It's slow and patchy. Google says data "is updated within 24 hours but can take longer", and the dashboard might not include all data on low-volume days.

In plain numbers, 0.1% is one complaint per 1,000 inboxed emails, and 0.3% is three. The 0.3% line has a cost: Google's FAQ says bulk senders above it are ineligible for mitigation, and only become eligible again after staying below 0.3% for 7 consecutive days.

Your sending tool can't tell you this number for Gmail. Customer.io's documentation puts it plainly: "Google does not send information about spam complaints back to Customer.io or to any other sending platform." It adds that Postmaster data can lag 24 to 48 hours. To see your real rate, set up Postmaster Tools: add the domain you authenticate with SPF or DKIM, add the TXT or CNAME record Google gives you to DNS, and click Verify.

For cold email deliverability, the habits that keep complaints low are simple:

• Target tightly. If you can't say in one sentence why this person might care, don't send.
• Give an easy way out. Not relevant? Reply "no" and I won't email again. beats the spam button.
• Stop on any reply, keep sequences short and keep volume per mailbox low.

For what a healthy response looks like, see our cold email reply rate benchmarks.

What does error 550 5.7.26 mean?

Error 550 5.7.26 means Gmail permanently rejected your message because it failed authentication. Google's sender guidelines say messages that aren't authenticated "might be marked as spam or rejected with a 5.7.26 error". The fix is almost always in your SPF, DKIM or DMARC records.

Google's SMTP error reference lists three versions of 550 5.7.26: the sender is unauthenticated; the domain has an SPF hard fail (-all) and failed SPF; or "unauthenticated email from domain-name is not accepted due to domain's DMARC policy". Codes starting with 4 are temporary and the sending server will retry; codes starting with 5 are permanent.

These are the rejection codes most relevant to cold email, as listed on official pages as of October 2026.

Two hedges. Google's error page lists the 5.7.32 alignment block with a 421 reply code, so the exact pairing you see may differ. And the 5.7.515 code comes from Microsoft's announcement post, which also describes a Junk-first approach, so treat it as a guide. If you send from Microsoft 365 and see 550 5.7.233, that's your own tenant's sending cap, not the recipient; see our guide to Microsoft 365 sending limits.

Do the rules apply to cold email from Google Workspace?

Yes, when you send to personal Gmail accounts. Google's FAQ says "all senders, including Google Workspace users, must meet the requirements", and that sender requirements and enforcement "apply only when sending email to personal Gmail accounts".

So a cold email from your Workspace mailbox to someone's @gmail.com address is covered. Mail to a company that runs on Google Workspace isn't, but its filters still judge you. In practice, set everything up as if every rule applies.

One-click unsubscribe is the grey area. Google's FAQ says it is "required only for marketing and promotional messages" and excludes transactional mail such as password resets. A cold sales email isn't transactional. If you send at volume, support one-click unsubscribe. If you send small numbers of individually written emails, a plain opt-out line still protects you. Google recommends fulfilling unsubscribe requests within 48 hours.

How do I set up SPF, DKIM and DMARC?

You set up SPF, DKIM and DMARC by adding DNS records at your domain registrar: one SPF TXT record, the DKIM record your mail provider generates, and a DMARC TXT record at _dmarc. Start DMARC at p=none, read the reports, then tighten.

SPF is a DNS record that lists the servers allowed to send mail for your domain. DKIM is a cryptographic signature that proves a message wasn't altered and came from your domain. DMARC is a policy that tells receivers what to do when SPF or DKIM fail, and where to send reports.

1. Publish one SPF record. Google gives v=spf1 include:_spf.google.com ~all for Workspace-only domains, and Microsoft gives v=spf1 include:spf.protection.outlook.com -all for Microsoft 365. Microsoft's SPF guide warns that multiple SPF records on one domain cause a permerror, and that more than 10 DNS lookups fail SPF. Merge every sending service into one record.
2. Turn on DKIM. In Google Workspace, generate the key in the Admin console, choose 2048-bit if your DNS provider supports it, and publish it at google._domainkey. In Microsoft 365, you create two CNAME records, selector1._domainkey and selector2._domainkey, then enable signing.
3. Add DMARC. Create a TXT record at _dmarc.example.com. Google's DMARC guide recommends starting with p=none. A simple version is v=DMARC1; p=none; rua=mailto:dmarc@example.com.
4. Check alignment. If you send as you@example.com but a tool signs DKIM as d=sendingtool.example, DKIM passes but doesn't align. Set up custom DKIM for your own domain in that tool. Google recommends aligning both SPF and DKIM.
5. Tighten DMARC. Once reports show every legitimate sender passing, Google advises moving to quarantine (or reject).
6. Watch the results. Set up Postmaster Tools, check your spam rate weekly and scan bounces for 5.7.26-style errors after any DNS change.

Where Outbind fits

Authentication gets you through the door. Staying in the inbox depends on sending mail people don't mind getting. Outbind sends from your own Gmail or Outlook mailboxes, up to 50 emails a day per mailbox, with new mailboxes starting slowly and sending rotated across the mailboxes you connect. Emails go out 8am to 8pm in the recipient's time zone, every draft passes 35+ pre-send checks, and a Flow stops the moment someone replies or books. You still need the DNS records above in place, and you still need to watch Postmaster Tools yourself.

FAQ

Is DMARC p=none enough?

Yes, for the minimum. Google, Yahoo and Microsoft all accept a DMARC policy of p=none. Moving to quarantine or reject protects your domain from spoofing, but only do it once every legitimate sender is aligned.

What spam complaint rate should I aim for?

Below 0.1%. Google says to keep the rate below 0.10% and avoid ever reaching 0.30%, and Yahoo uses the same 0.3% ceiling.

How do I fix error 550 5.7.26?

Check that SPF passes for the sending server, that DKIM is signing with your own domain, and that your DMARC record exists and aligns with the From: domain. Then send a test to a Gmail address and read the Authentication-Results header.

Do I need one-click unsubscribe for cold email?

Google requires it only for marketing and promotional messages from bulk senders. If you send cold email at volume, support it. At low volume, a plain "reply no and I won't email again" line is still worth adding.

Why does my sending tool show zero spam complaints?

Because Gmail doesn't share complaint data with sending platforms. Only Google Postmaster Tools, set up by the domain owner, shows your Gmail spam rate.

Sources

• Google: Email sender guidelines
• Google: Email sender guidelines FAQ
• Google: Gmail SMTP errors and codes
• Google: Postmaster Tools dashboards
• Google: Set up Postmaster Tools
• Google: Set up SPF
• Google: Set up DKIM
• Google: Set up DMARC
• Yahoo: Sender best practices
• Microsoft Tech Community: Outlook's new requirements for high-volume senders
• Microsoft Learn: Set up SPF for your Microsoft 365 domain
• Microsoft Learn: How to use DKIM for email in your custom domain
• Customer.io: Google Postmaster Tools