Google & Yahoo DMARC requirements

Updated 2026-07-08 · DMARC Fundamentals

In February 2024, Google and Yahoo did something the email world had discussed for a decade: they stopped recommending authentication and started requiring it. Senders who ignored the new rules watched their mail get rejected or buried in spam — and the requirements have not gone away. They remain the enforcement baseline every domain owner is measured against today.

If your organisation sends email to Gmail or Yahoo mailboxes — and statistically, most of your recipients are there — these rules apply to you. Here is what they say, what happens if you fall short, and how to get compliant.

Who counts as a bulk sender

The rules come in two tiers, split by volume.

You are a bulk sender if you send 5,000 or more messages per day to Gmail addresses. The count is taken across your entire organisational domain — mail from news.example.com and billing.example.com all counts towards example.com's total — and crossing the line even occasionally puts you in the bulk tier, with Google treating the status as sticky rather than something you drift in and out of daily. Yahoo applies equivalent requirements to senders of significant volume without publishing a hard number.

Below the threshold, a lighter set of rules still applies. There is no tier called "exempt".

What every sender needs — even small ones

Whatever your volume, Gmail and Yahoo expect baseline hygiene before they will inbox your mail:

• SPF or DKIM — at least one must pass for your sending domain. Unauthenticated mail is aggressively filtered or refused regardless of volume.
• Valid forward and reverse DNS — your sending IPs need PTR records that resolve back correctly.
• Low spam complaint rates — keep reported-as-spam rates below 0.3%, and ideally under 0.1%.
• TLS for the sending connection.

If you only ever send a few hundred messages a day, meeting these four points — ideally both SPF and DKIM, not just one — keeps you safe.

What bulk senders must add

Cross 5,000 a day and the requirements step up substantially:

• Both SPF and DKIM set up for your sending domain — no longer either/or.
• A DMARC record on your From domain — p=none is the accepted minimum, so this costs nothing in delivery risk.
• DMARC alignment — messages must pass DMARC, meaning SPF or DKIM must pass for a domain aligned with your visible From domain. A pass for your provider's own domain no longer counts; DMARC alignment explained covers why this catches so many senders out.
• One-click unsubscribe for marketing and other subscribed mail — the RFC 8058 List-Unsubscribe mechanism, with opt-outs honoured within two days. Transactional mail (receipts, password resets) is out of scope.
• Spam rate discipline — the same 0.3% ceiling, but at bulk volume it is actively enforced and worth monitoring in Google Postmaster Tools.

The compliance checklist in one view:

What happens if you don't comply

This is not a paper policy. Enforcement rolled out progressively through 2024 and is now routine:

• Rejection at the door. Non-compliant bulk mail is refused during delivery with SMTP errors that name the missing requirement — unauthenticated traffic and missing one-click unsubscribe are the classic triggers.
• Spam-foldering. Mail that is not rejected outright is far more likely to be filtered to spam, silently. Your open rates fall and nobody tells you why.
• Throttling. Senders near the line may see temporary failures and deferred delivery while the receiver decides what to make of them.

The pattern to fear is the quiet one: nothing bounces, dashboards look normal, and an ever-growing share of your mail simply is not being seen. Aggregate DMARC reports are one of the few places this becomes visible early, because you see authentication failures per source before they become a deliverability crisis.

How to get compliant

The path is the same one every well-run domain follows, and none of it is wasted work even if you never cross the bulk threshold:

1. Audit what you have — check your domain now to see your live SPF, DKIM and DMARC records in one pass, no sign-up needed.
2. Close the authentication gaps. Set up SPF and DKIM for every service that sends as your domain, using your own domain for the DKIM signature so it aligns.
3. Publish a DMARC record with p=none and a rua reporting address. This satisfies the letter of the requirement immediately and switches on the visibility you need for the rest.
4. Verify alignment with real data. Reports will show you, sender by sender, whether mail passes DMARC — the actual test Gmail and Yahoo apply. Monitor your domain with DMARCmetric to watch compliance per sender and catch regressions before receivers do.
5. Sort out one-click unsubscribe with your marketing platform — most major platforms handle RFC 8058 for you once enabled.

Treat the Google and Yahoo rules as a floor, not a finish line: they mandate p=none, but the protection comes from climbing to enforcement once your reports run clean — the journey covered in DMARC policy: none, quarantine, reject.