DMARC: understanding the requirements at Gmail, Microsoft, Yahoo and the major ESPs

DMARC is no longer just a security best practice.

At the major mailbox providers, it has become a deliverability requirement.

Gmail, Yahoo and Microsoft have gradually tightened their rules: mandatory authentication, alignment of the visible domain, monitored complaint rates, simplified unsubscribe, clean DNS and SMTP rejections for high-volume senders that do not meet the minimum baseline.

What has changed

For a long time, many senders could get by with partial SPF, DKIM missing on some tools, no published DMARC and a moderately maintained list.

That model is less and less tolerated.

The major providers want to address three problems:

• reduce phishing and domain spoofing;
• make senders accountable for their sending tools;
• limit campaigns that generate too many complaints, bounces or negative signals.

The message is clear: if you send at volume, your domain must be authenticated, aligned, monitored and able to prove that it follows the rules.

The timeline

The shift happened in stages.

In October 2023, Gmail and Yahoo announced new sender requirements.

In February 2024, Gmail started enforcing its rules for senders mailing personal Gmail accounts. Yahoo also began gradual enforcement for senders with significant volume.

In June 2024, Gmail strengthened the impact of the spam rate: senders with a user complaint rate above 0.3% become ineligible for some mitigations until the signal stays below the threshold for several days.

In April 2025, Microsoft announced new requirements for high-volume senders to Outlook.com, Hotmail.com and Live.com.

From 5 May 2025, Microsoft said it would reject messages from high-volume domains that do not meet SPF, DKIM and DMARC, with an error such as:

550 5.7.515 Access denied, sending domain does not meet the required authentication level

In 2026, these rules are no longer distant announcements. They are part of how deliverability normally works. In November 2026, Outlook.com even rejected mail from low-volume domains without DMARC.

The shared requirements

Providers do not always use the same words, but the baseline is similar.

To send properly at volume, you generally need:

• working SPF;
• DKIM enabled on every sending platform;
• published DMARC, at least p=none;
• DMARC alignment with the domain shown in the From;
• valid PTR / reverse DNS for sending IPs;
• TLS in transit;
• messages that follow the RFC 5322 format;
• easy unsubscribe for marketing messages;
• a low spam complaint rate;
• a well-maintained list.

The key point: publishing a DMARC record is not enough.

Real messages must pass DMARC.

Gmail: an explicit 5,000-messages-a-day threshold

Gmail distinguishes regular senders from those sending 5,000 or more messages a day to personal Gmail accounts.

For bulk senders, Gmail requires SPF, DKIM, DMARC, alignment of the visible domain with SPF or DKIM, valid forward and reverse DNS, TLS, a controlled spam rate and one-click unsubscribe for promotional messages.

The minimum DMARC policy can be p=none.

But be careful: p=none does not mean “no requirement”. It means the published policy is in monitoring mode. Messages must still be authenticated and aligned.

Gmail recommends keeping the spam rate below 0.1% and never reaching 0.3%. Our article on the impact of the Gmail spam complaint rate explains why.

From 0.3%, the impact becomes much more serious: less room for mitigation, degraded placement, throttling or rejections depending on other signals.

Yahoo: no fixed public threshold

Yahoo takes a different approach.

Yahoo does not publish a universal threshold equivalent to Gmail’s 5,000 a day. It refers to significant volume and analyses the domain, content, IPs and observed behaviour.

In practice, if you send newsletters, marketing campaigns, sales follow-ups, mass notifications or automated sequences to Yahoo, AOL or domains routed by Yahoo, you should behave like a bulk sender.

Expectations are similar:

• SPF and DKIM authentication;
• published DMARC;
• alignment with the visible domain;
• a low spam complaint rate;
• clear unsubscribe;
• list hygiene;
• clean DNS and infrastructure.

The trap at Yahoo is looking for a magic threshold.

There is not always one. “Bulk” status also depends on what Yahoo actually observes.

Microsoft: Outlook.com, Hotmail and Live tighten up

Microsoft joined the movement in 2025 for its consumer services: Outlook.com, Hotmail.com and Live.com.

The announced threshold covers domains sending more than 5,000 emails a day.

For those senders, Microsoft requires SPF, DKIM and DMARC. DMARC must be published at least at p=none and align with SPF or DKIM, ideally both.

Microsoft also stressed hygiene: valid From and Reply-To addresses, a working unsubscribe, list cleaning and transparent practices.

The most sensitive point is enforcement: Microsoft said it rejects messages that do not meet the required authentication level, with error 550 5.7.515.

That turns a bad configuration into an immediately visible problem: the message does not just go to spam, it can bounce.

The blocking thresholds to know

There are three thresholds to remember.

The first is volume.

Gmail and Microsoft clearly use 5,000 messages a day to trigger bulk sender obligations. Yahoo gives no fixed public figure, but applies its rules to significant volumes.

The second is the spam complaint rate.

At Gmail, the goal is to stay below 0.1% and never reach 0.3%. At 0.3%, the sender enters a very risky zone.

The third is authentication failure.

A message that fails SPF/DKIM/DMARC or does not align the visible domain can be sent to spam, temporarily refused or rejected depending on the provider, volume and reputation history.

DMARC alignment: the real issue

Many companies think they are compliant because SPF and DKIM are published.

But DMARC does not only check whether SPF or DKIM pass.

It also checks whether the authenticated domain matches the domain shown in the From field.

Problem example:

From: newsletter@example.com
SPF pass: esp-mail.net
DKIM pass: esp-mail.net
DMARC fail

SPF and DKIM pass, but they pass for the sending tool’s domain, not for example.com.

Correct example:

From: newsletter@example.com
SPF pass: bounce.example.com
DKIM pass: example.com
DMARC pass

Here, at least one mechanism aligns with the visible domain.

Why ESPs are involved

A company domain rarely sends from a single place.

You often find:

• Google Workspace or Microsoft 365;
• a newsletter tool;
• a CRM;
• an invoicing tool;
• a transactional platform;
• a support tool;
• a CMS or web form;
• an old business application.

Each ESP or sending tool must be integrated properly.

That means SPF where needed, DKIM with an aligned domain, a dedicated subdomain if the flow is marketing or transactional, and visibility in DMARC reports. Our guide to creating a sending subdomain shows how.

The real DMARC project is therefore not only about DNS.

It is about mapping email flows.

How to become compliant

The safest method is gradual.

1. publish DMARC at p=none with rua reports;
2. collect reports for several days or weeks;
3. identify every tool that sends with the domain;
4. enable DKIM on each platform;
5. check SPF or DKIM alignment on real messages;
6. separate marketing, transactional and corporate flows if needed;
7. fix PTR, TLS, overlong SPF and bounces;
8. set up one-click unsubscribe for campaigns;
9. monitor complaints, especially at Gmail;
10. move gradually to p=quarantine, then p=reject once flows are under control.

Moving to p=reject must not be improvised.

It should come after observation, fixes and validation of legitimate sources.

What blocks most often

The most frequent blockers are very concrete:

• a tool sending without aligned DKIM;
• an SPF record that is too long or in error;
• an undocumented marketing subdomain;
• a visible domain different from the authenticated domain;
• an IP without a valid PTR;
• a list that generates too many complaints;
• a missing or broken unsubscribe link;
• forwarding that breaks SPF without ARC or SRS;
• a provider that signs with its own domain instead of yours.

These errors can go unnoticed at low volume.

At high volume, they become blocking thresholds.

Conclusion

DMARC has become a central piece of deliverability.

Gmail, Yahoo and Microsoft no longer just ask “is your content good?”. They also ask: “can you prove this domain really controls what it sends?”

Today’s minimum is clear: SPF, DKIM, DMARC, alignment, clean DNS, a low complaint rate, working unsubscribe and basic hygiene.

For companies, the right answer is not to rush out a TXT record.

The right answer is to manage the sending ecosystem: map, align, monitor, fix, then gradually tighten the DMARC policy.

For support with this, see Dharmail’s DMARC, SPF and DKIM configuration service (page in French).

Useful sources: Google Email sender guidelines, Google Email sender guidelines FAQ, Microsoft Outlook requirements for high-volume senders and Yahoo Sender Hub FAQ.