Why Gmail, Yahoo and Microsoft now require DMARC

15 June 2026 · DMARC Engine · 6 min read

Gmail, Yahoo and Microsoft (Outlook.com) all require bulk senders to publish a DMARC record, to pass SPF and DKIM, and to have at least one of them aligned with the domain in the visible From address. A DMARC policy of p=none is enough to meet the rule at all three. Google and Yahoo began enforcing in February 2024, and Microsoft on 5 May 2025. Each provider's own page is linked below; this summary follows them.

The requirements side by side

Gmail

Google's email sender guidelines apply to all senders:

• SPF or DKIM for the sending domain.
• Valid forward and reverse DNS (PTR) for sending IP addresses. The PTR record checker tests this.
• TLS for transmitting email.
• A user-reported spam rate below 0.3% in Postmaster Tools.
• Messages formatted according to RFC 5322.

A bulk sender is one that has sent close to 5,000 or more messages to personal Gmail accounts in a 24-hour period. Mail to Google Workspace accounts does not count, and all mail from the same primary domain counts together. Google's FAQ says the status is permanent: once you cross the threshold, you stay a bulk sender. Bulk senders must also:

• Set up SPF and DKIM.
• Publish a DMARC record. The policy can be p=none.
• Align the From domain with either the SPF domain or the DKIM domain.
• Support one-click unsubscribe on marketing and subscribed mail, show a visible unsubscribe link, and honour unsubscribes within 48 hours.
• Keep the spam rate below 0.1% and never let it reach 0.3%.

Enforcement is gradual. Non-compliant mail can be sent to spam or rejected, and Google's FAQ says that from November 2025 it began ramping up enforcement with temporary and permanent rejections. The Google Postmaster Tools Compliance status dashboard shows whether your domain passes.

Yahoo

Yahoo's sender best practices set two tiers of requirements.

All senders: SPF or DKIM at a minimum, a spam rate below 0.3%, valid forward and reverse DNS for sending IPs, and compliance with RFC 5321 and RFC 5322.

Bulk senders, which Yahoo does not define by volume:

• Both SPF and DKIM.
• A valid DMARC policy of at least p=none, and DMARC must pass. A rua tag is strongly recommended.
• The From domain aligned with the SPF or DKIM domain. Relaxed alignment is fine.
• A working one-click List-Unsubscribe header on marketing and subscribed mail, with the POST method of RFC 8058 recommended, a visible unsubscribe link in the body, and unsubscribes honoured within two days.
• A spam rate below 0.3%, measured on mail delivered to the inbox.

Microsoft Outlook.com

Microsoft's postmaster policies define high-volume senders as domains sending more than 5,000 emails a day to Outlook.com accounts, effective 5 May 2025. They must:

• Pass SPF for the sending domain, with the record listing every authorised IP address or host.
• Pass DKIM.
• Publish DMARC with at least p=none, aligned with SPF or DKIM. Microsoft recommends p=reject and prefers both mechanisms aligned.

Messages that fail go to the Junk folder first. If the problem is not fixed, Microsoft may reject them with 550; 5.7.515 Access denied, stating that the sending domain does not meet the required authentication level.

This rule covers mail sent to consumer Outlook.com mailboxes. How Microsoft 365 business tenants treat inbound mail depends on each organisation's anti-phishing policy, covered in DMARC for Microsoft 365.

Alignment is where most senders fail

All three providers require alignment, and it is the requirement that valid SPF and DKIM records alone do not meet. DMARC only counts SPF if the envelope sender (Return-Path) domain matches the From domain, and only counts DKIM if the d= domain in the signature matches it. Under the default relaxed mode, a subdomain such as bounce.example.com matches example.com.

Mail sent through a marketing platform, CRM or help desk often passes SPF and DKIM for the platform's own domain and therefore fails DMARC. The usual fix is to complete the platform's domain authentication so it signs with d=example.com. Why DMARC fails when SPF and DKIM pass shows how to find the misaligned source.

Compliance checklist

1. List every service that sends as your domain: your mailbox provider, marketing platform, CRM, billing, help desk and any agency sending for you.
2. Publish one SPF record that covers them all, under the ten-DNS-lookup limit. Check it with the SPF checker.
3. Set up DKIM with your own domain on every service. Check each selector with the DKIM checker.
4. Publish DMARC at p=none with a rua address, for example v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com.
5. Read the aggregate reports until every legitimate source passes DMARC with alignment.
6. Add one-click unsubscribe and a visible unsubscribe link to marketing mail, and process opt-outs within two days.
7. Keep complaint rates below 0.1%.

p=none meets the rule, but does not protect you

A p=none record satisfies all three providers, but it tells receivers to take no action on mail that fails DMARC, so anyone can still send mail with your domain in the From address. To stop that, move to p=quarantine and then p=reject once the reports show your own mail passing. The current DMARC standard, RFC 9989, suggests at least a month at p=none and a similar period at p=quarantine, removed the old pct= tag, and offers t=y for trials.

Run your domain through the DMARC checker to see where it stands. If you would rather have the move from p=none to p=reject staged for you, hosted DMARC handles the policy and the reports.