Gmail and Yahoo DMARC Requirements: What Bulk Senders Need to Know

Gmail and Yahoo DMARC Requirements: What Bulk Senders Need to Know

Starting February 1, 2024, Google and Yahoo require bulk email senders — anyone sending 5,000 or more messages per day to Gmail or Yahoo accounts — to authenticate their email with SPF, DKIM, and DMARC. Microsoft followed with its own enforcement on May 5, 2025. If you send email at that volume and haven't set up DMARC yet, your messages risk being blocked, sent to spam, or rejected outright.

This article covers exactly what the requirements are, who they affect, and how to check if your domain qualifies.

Who Is a Bulk Sender Under the New Rules

Google and Yahoo both define a bulk sender as any domain that sends 5,000 or more messages per day to their respective users. This volume is calculated per sending domain, with subdomain volume rolling up to the parent domain.

If you regularly send newsletters, transactional emails, marketing campaigns, or automated notifications above that threshold, the requirements apply to you. If you send fewer than 5,000 per day, you only need SPF or DKIM — but DMARC is still recommended.

The Three Requirements for Bulk Senders

1. SPF and DKIM — Both Required

All senders must have SPF or DKIM. But bulk senders specifically need both. Your SPF record must list every server authorized to send mail for your domain, and your DKIM key must be published and active in your DNS.

Google also requires DKIM keys of at least 1024 bits; 2048-bit keys are recommended.

2. DMARC — At Least p=none

Bulk senders must publish a DMARC record in their DNS. The policy can be set to p=none — Google does not require a specific enforcement level. What matters is that your email passes DMARC authentication, meaning the domain in your From: header must align with either your SPF domain or your DKIM domain.

A record like this meets the requirement:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

You should also add an rua address to receive DMARC aggregate reports, which tell you who is sending mail from your domain and whether each source passes authentication.

3. DMARC Alignment

This is the piece that trips people up. Your email only passes DMARC if the domain in the From: header matches (or is a subdomain of) either:

• The domain used in the return-path for SPF (relaxed alignment), or
• The d= domain in the DKIM signature (relaxed alignment)

If you send through an email service provider, your From: address must be your own domain — not the provider's domain — for alignment to work.

What About Microsoft and Yahoo?

Yahoo enacted the same requirements on the same timeline as Google (February 2024): SPF, DKIM, and DMARC for bulk senders.

Microsoft began enforcing DMARC requirements for senders to Outlook.com and Hotmail on May 5, 2025, with similar requirements: SPF, DKIM, and DMARC with at least p=none and alignment.

What Happens If You Don't Comply

Non-compliant domains risk:

• Temporary failures — Gmail may reject messages with a 5.7.26 error explaining that the domain lacks proper authentication.
• Spam folder placement — Messages that can't be verified are more likely to land in spam, reducing deliverability.
• Rate limiting — Google may throttle mail from domains it can't authenticate.
• Brand damage — Without DMARC, anyone can spoof your domain in phishing emails, and receiving servers have no policy telling them what to do about it.

How to Check Your Domain Right Now

The fastest way to check compliance is to scan your domain with a free email security checker. Scan your domain to see your current DMARC, SPF, and DKIM configuration in seconds — no signup needed.

If your domain doesn't have DMARC at all, the setup takes about five minutes: choose a policy (start with p=none), add the TXT record at your DNS provider, and add an rua email address. From there, monitor your aggregate reports, verify that all your legitimate sending sources pass authentication, and work toward enforcing a stricter policy when you're ready.