Gmail, Yahoo and Outlook Sender Requirements: What Cold Emailers Actually Need to Do

In 2024 Google and Yahoo changed the rules for anyone sending email at volume. Microsoft followed in 2025 for Outlook.com, Hotmail and Live addresses. A lot of outreach teams heard about it, panicked a little, and then never quite checked whether they were compliant.

Here is what the rules say and how they apply to cold email.

Who counts as a "bulk sender"

Google uses roughly 5,000 messages a day to Gmail addresses from your domain as the line. Microsoft uses the same 5,000-a-day mark for its consumer mailboxes. Yahoo's guidance is similar.

Two things catch people out:

1. The count is per domain, not per mailbox. Ten mailboxes on one domain add up.
2. Once you cross the line, Google treats you as a bulk sender going forward, even on quieter days.

Most cold email setups stay under this on purpose by spreading sending across several domains. But the basic rules below apply to everyone, bulk or not.

Rules for every sender

• SPF or DKIM must pass for your domain. In practice, set up both.
• Valid forward and reverse DNS for your sending IP. The PTR record should resolve to a hostname that points back to the same IP.
• TLS for the connection. Any modern mail server does this by default.
• Keep the spam complaint rate low. Google asks you to stay below 0.1% and never reach 0.3%.
• Don't impersonate Gmail. Sending with a gmail.com From address through your own server will fail.

Extra rules for bulk senders

• SPF and DKIM both, not one or the other.
• DMARC published for your domain. A policy of p=none is enough to meet the requirement.
• Alignment: the domain in your visible From address must match the domain that passes SPF or DKIM.
• One-click unsubscribe for marketing and subscribed messages, using the List-Unsubscribe and List-Unsubscribe-Post headers, and honouring requests within two days.

Microsoft's version

From May 2025, Microsoft started enforcing SPF, DKIM and DMARC (at least p=none, aligned with SPF or DKIM) for domains sending over 5,000 messages a day to its consumer addresses. Non-compliant mail is rejected with a 550 5.7.515 error rather than quietly sent to junk. If you see that code in your bounce logs, this is why.

What this means for cold email

Cold outreach is not "subscribed" mail, so the one-click unsubscribe rule is written with newsletters in mind. We still recommend two things for every cold campaign:

1. A plain line at the bottom such as "Not relevant? Reply 'no' and I won't email again."
2. A List-Unsubscribe header, because it costs nothing and gives Gmail a polite way out instead of the spam button.

The spam rate rule matters more than anything else here. Cold email gets more complaints than newsletters by nature. The way to stay under 0.1% is tight targeting, low daily volume per mailbox and an easy opt-out.

A quick self-check

1. Send an email to a Gmail account and open Show original. SPF, DKIM and DMARC should all say PASS.
2. Check that the domain after @ in your From address matches the DKIM d= domain.
3. Look up your sending IP's PTR record.
4. Add your domains to Google Postmaster Tools and watch the spam rate.

If any of these fail, our SPF, DKIM, DMARC and BIMI guide covers the fixes. Every infrastructure we set up at Nestmarketing passes these checks before the first campaign goes out.