Short answer
Google and Yahoo require every sender, transactional or not, to authenticate with SPF or DKIM, keep the spam complaint rate below 0.3%, have valid forward and reverse DNS for the sending IPs and send properly formatted messages; Google also requires TLS. The stricter bulk-sender rules (both SPF and DKIM, a DMARC record, a From domain aligned with SPF or DKIM) apply above 5,000 messages a day to Gmail accounts at Google and from 5,000 messages at Microsoft, while Yahoo publishes no number.
One-click unsubscribe is required for marketing and subscribed messages, not for password resets, sign-in codes or receipts. In practice, a transactional sender should meet the bulk-sender authentication rules anyway: they cost little, and transactional mail counts toward the thresholds.
On this page
Two tiers: rules for everyone, rules for bulk senders
Gmail and Yahoo started enforcing new sender requirements in February 2024, and Microsoft followed for Outlook.com, Hotmail and Live addresses in May 2025. All three split their rules the same way. A baseline applies to anyone sending to their users. A stricter set applies to bulk or high-volume senders.
"Bulk" is about volume, not content. A product that sends nothing but password resets, receipts and alerts is a bulk sender once it crosses the threshold, and has to meet the same authentication rules as a newsletter. What changes for transactional mail is mostly the unsubscribe requirement, which is scoped to marketing and subscribed messages.
Google (Gmail)
Google's email sender guidelines apply to all senders from February 1, 2024: SPF or DKIM, valid forward and reverse DNS (a PTR record that resolves back to the sending IP), a TLS connection, a spam rate in Postmaster Tools below 0.3%, messages formatted to RFC 5322, and no impersonation of Gmail in the From header.
Senders of more than 5,000 messages a day to Gmail accounts also need SPF and DKIM, a DMARC record (a policy of p=none is enough), a From domain aligned with the SPF or DKIM domain, and one-click unsubscribe plus a visible unsubscribe link in marketing and subscribed messages. The threshold is about messages sent to Gmail accounts, so password resets and receipts count toward it alongside anything else your domain sends.
Google's best-practice advice goes further: keep the spam rate below 0.10% and never let it reach 0.30%, and use DKIM keys of at least 1024 bits, with 2048 recommended.
Yahoo
Yahoo's sender best practices ask all senders for SPF or DKIM, a spam rate below 0.3%, valid forward and reverse DNS, and messages that follow RFC 5321 and RFC 5322. Bulk senders need SPF and DKIM, DMARC at p=none or stricter and passing, a From domain aligned with SPF or DKIM (relaxed alignment is fine), RFC 8058 one-click unsubscribe for marketing and subscribed messages, and unsubscribes honored within 2 days.
Yahoo doesn't publish a numeric bulk threshold. Treat its bulk rules as applying to you if you send meaningful daily volume to Yahoo addresses.
Microsoft (Outlook.com, Hotmail, Live)
Microsoft's requirements cover its consumer mailboxes: outlook.com, hotmail.com and live.com. Its announcement on the Defender for Office 365 blog applies to domains sending more than 5,000 emails per day. The support article for the rejection code defines a high-volume sender as one sending 5,000 or more messages to Microsoft consumer email services from the same From (RFC 5322) domain, and doesn't say per day.
The required set is the same in both: SPF must pass, DKIM must pass, and DMARC must be published at p=none or stricter, aligned with SPF or DKIM (the blog says preferably both). The blog also recommends valid From and Reply-To addresses, a working unsubscribe link and list hygiene.
On enforcement, Microsoft's post says, in its April 2025 update, that non-compliant mail is rejected from May 5, 2025 with 550; 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level. An earlier paragraph in the same post still says such mail would first be routed to the Junk folder. The support article says Microsoft now enforces the requirements. Plan for rejection, not junk-foldering.
The requirements side by side
| Requirement | Google (Gmail) | Yahoo | Microsoft (Outlook.com) |
|---|---|---|---|
| Bulk threshold | More than 5,000 messages a day to Gmail accounts | No number published | 5,000+ messages (blog: per day; support article: no time period) |
| SPF / DKIM | All: SPF or DKIM. Bulk: both | All: SPF or DKIM. Bulk: both | High-volume: SPF and DKIM must pass |
| DMARC | Bulk: required, p=none or stricter | Bulk: p=none or stricter, passing | High-volume: p=none, quarantine or reject |
| From alignment | Bulk: aligned with SPF or DKIM domain | Bulk: aligned with SPF or DKIM; relaxed OK | High-volume: aligned with SPF or DKIM, preferably both |
| Forward and reverse DNS | All senders | All senders | Not stated |
| TLS | All senders | Not stated | Not stated |
| Spam rate | All: below 0.3%. Best practice: below 0.1% | All: below 0.3% | Not stated |
| Message format | RFC 5322 | RFC 5321 and 5322 | Valid From and Reply-To recommended |
| One-click unsubscribe | Bulk: marketing and subscribed messages | Bulk: RFC 8058, marketing and subscribed messages; honor within 2 days | Functional unsubscribe recommended |
| Enforcement | From February 1, 2024 | From February 2024 | Rejection with 550 5.7.515 from May 5, 2025 |
"All" = applies to every sender. "Bulk" or "high-volume" = applies above the provider's threshold. "Not stated" = not in the pages we checked.
Last checked on each vendor's public page.
What applies to transactional email, and what doesn't
- Authentication applies in full. SPF, DKIM, DMARC and alignment don't depend on what the message says. Once you're over a threshold, your sign-in codes have to pass the same checks as anyone's newsletter.
- Transactional mail counts toward the thresholds. Google's 5,000 a day is messages sent to Gmail accounts, and Microsoft's 5,000 counts messages from the same From domain. A growing product can cross the line from password resets alone.
- One-click unsubscribe doesn't apply to pure transactional messages. Google and Yahoo scope it to marketing and subscribed messages. A password reset, a sign-in code, a receipt or a security alert isn't something a user subscribes to, so it doesn't need a
List-Unsubscribeheader. - Subscribed messages do need it. Weekly digests, product update emails and activity notifications a user can switch off look subscribed to us. If you send those, give them one-click unsubscribe and honor it within 2 days.
- The spam rate covers everything from your domain. Complaints about a marketing email and complaints about a transactional one land in the same Postmaster Tools number. Keeping marketing on a separate subdomain or provider protects your transactional mail.
Checklist for transactional senders
- 1
Send from your own domain
Use a domain or subdomain you control in the From address, not your provider's shared domain. Alignment is checked against the From domain, so it has to be yours.
- 2
Publish SPF and sign with DKIM
Meet the bulk rule even if you're below the threshold: one SPF record that includes your provider, and DKIM signing with your own domain using a 2048-bit key where your provider supports it.
- 3
Publish DMARC and read the reports
Start with
v=DMARC1; p=none; rua=mailto:dmarc@example.comon_dmarc.example.com, confirm every source of mail passes, then move toquarantineorreject. See SPF, DKIM and DMARC for transactional email. - 4
Check your provider covers DNS and TLS
Forward and reverse DNS for the sending IPs and TLS on the connection are set by whoever runs the mail servers. Ask your provider, or check a received message's headers.
- 5
Keep complaints well under 0.1%
Send only mail users expect, keep marketing on a separate subdomain, and suppress addresses that bounce or complain.
- 6
Add one-click unsubscribe where it belongs
On digests, product updates and other subscribed mail, not on password resets or receipts. Process unsubscribes within 2 days.
How Groundmail handles these rules
Groundmail sends from our own mail servers on our own IP space, and our shared pool carries transactional mail only: marketing and cold email aren't allowed on our IPs (AUP). For senders who want their own reputation or fixed IPs to allowlist, we offer dedicated IPs and dedicated servers.
When you add a domain, the dashboard gives you the records to publish: a TXT record at _groundmail.example.com for ownership, a DKIM TXT record at <selector>._domainkey.example.com, a CNAME from rp.example.com to rp.groundmail.dev for the return path, include:spf.groundmail.dev in your root SPF record, and a DMARC TXT record at _dmarc.example.com. Ownership, SPF, DKIM and the return path must check out before the domain verifies, and on Cloudflare, GoDaddy and Vercel you can apply the records in one click. Messages are signed with your domain's DKIM key, so DKIM aligns with your From address. Details are in the domain docs.
Sends default to the transactional category, which doesn't turn on managed unsubscribe. For subscribed mail, set category to product or set unsubscribe: true. Either turns on managed unsubscribe: Groundmail adds RFC 8058 List-Unsubscribe headers and fills {{unsubscribe_url}} in your subject, HTML and text. The product category also supports a category-scoped opt-out, so an unsubscribe from product updates applies to that category rather than to everything you send. Unsubscribes, bounces and complaints go on your suppression list, and Groundmail adds bounce and complaint suppressions automatically.
Node: a product update with one-click unsubscribe
import { Groundmail } from "groundmail";
const gm = new Groundmail(process.env.GROUNDMAIL_API_KEY);
await gm.emails.send({
from: "updates@acme.com",
to: "ada@example.com",
subject: "What's new in Acme this month",
html: '<p>...</p><p><a href="{{unsubscribe_url}}">Unsubscribe</a></p>',
category: "product", // turns on managed unsubscribe (RFC 8058 headers)
});How to check you comply
Read the Authentication-Results header. Send a message to a Gmail and an Outlook.com address you control, open it, and view the original message (in Gmail, "Show original"). The receiving server records what it checked. You want spf=pass, dkim=pass with header.d set to your domain, and dmarc=pass with header.from set to your domain.
What a passing message looks like (illustrative)
Authentication-Results: mx.google.com;
dkim=pass header.i=@example.com header.s=selector1;
spf=pass smtp.mailfrom=bounces@rp.example.com;
dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=example.comCheck the DNS records yourself. dig shows what receivers see, which isn't always what your DNS dashboard says.
Look up the records
# SPF on the root domain (exactly one v=spf1 record)
dig +short TXT example.com
# DKIM key for your selector
dig +short TXT selector1._domainkey.example.com
# DMARC policy
dig +short TXT _dmarc.example.com
# Return path CNAME (Groundmail)
dig +short CNAME rp.example.com
# Reverse DNS for a sending IP from the Received header
dig +short -x 203.0.113.10Watch the spam rate in Google Postmaster Tools. Verify your domain at postmaster.google.com and check the user-reported spam rate. Google's line is 0.3%; aim to stay under 0.1%.
Watch for 5.7.515 bounces. If Outlook.com addresses start bouncing with 550 5.7.515, the sending domain failed Microsoft's authentication check. On Groundmail, bounces arrive as email.bounced webhook events, so you can alert on a sudden rise from Outlook.com addresses.
Frequently asked questions
Do the Gmail bulk sender rules apply to transactional email?
The authentication rules do, once you send more than 5,000 messages a day to Gmail accounts, because the threshold counts all messages, not only marketing. The one-click unsubscribe rule applies only to marketing and subscribed messages, so password resets, sign-in codes and receipts don't need it.
Do password reset emails need a List-Unsubscribe header?
No. Google and Yahoo require one-click unsubscribe for marketing and subscribed messages. A password reset is something the user asked for, not a subscription. Add unsubscribe to digests and product updates instead.
What does 550 5.7.515 mean?
It's Outlook.com rejecting mail because the sending domain doesn't meet Microsoft's authentication requirements for high-volume senders: SPF and DKIM must pass and DMARC must be published at p=none or stricter, aligned with SPF or DKIM. Fix the records for the From domain and resend.
What counts as a bulk sender at Yahoo?
Yahoo doesn't publish a number. Its bulk-sender rules (SPF and DKIM, DMARC, alignment, one-click unsubscribe for marketing, unsubscribes honored within 2 days) are worth meeting at any meaningful volume.
Is DMARC p=none enough?
For the requirements, yes: Google, Yahoo and Microsoft all accept p=none, as long as the record exists and SPF or DKIM aligns with the From domain. Moving to quarantine or reject once reports show all your mail passing protects your domain from spoofing, but isn't required.
What spam complaint rate should transactional email stay under?
Google and Yahoo set the limit at 0.3%. Google's guidance is to stay below 0.1% and never reach 0.3%. Transactional mail usually sits far below that, unless marketing from the same domain pulls the rate up.
Sources
Facts on this page about other companies' products, prices and policies come from these public pages. They change, so check them before you decide.