The sender rules now in force in 2026

Gmail & Yahoo (since Feb 2024)

• Everyone who emails personal Gmail or Yahoo addresses needs SPF or DKIM, valid forward and reverse DNS, and a spam rate under 0.3%. Gmail also requires TLS (Yahoo's list doesn't).
• Bulk senders (about 5,000+ messages a day to Gmail addresses, counted per primary domain; Yahoo publishes no number) need SPF and DKIM and a DMARC record (at least p=none) that passes, with your visible From domain aligned to SPF or DKIM.
• DKIM keys must be at least 1024-bit (Gmail and Yahoo); 2048-bit is recommended.
• Bulk senders' marketing and subscribed mail needs one-click unsubscribe (List-Unsubscribe + List-Unsubscribe-Post headers, RFC 8058) and a visible unsubscribe link, honoured within 2 days. Transactional mail is exempt. Gmail does not accept mailto as one-click; Yahoo does accept it, though it prefers the HTTPS Post method.
• Spam rate, Gmail: keep it under 0.10% and never reach 0.30%. Yahoo: keep it below 0.3%.
• Enforcement has tightened: since November 2025 Gmail has been ramping up enforcement, so non-compliant mail can now get temporary and permanent rejections, not just spam-foldering.

Outlook.com / Hotmail / Live (since May 5, 2025)

• Domains sending 5,000+ messages a day to Microsoft consumer mailboxes must pass SPF and DKIM and publish DMARC (minimum p=none) that passes through an aligned SPF or DKIM.
• Non-compliant mail is rejected (550 5.7.515). Microsoft's docs also describe a Junk-first approach, so plan for either outcome.
• This applies to consumer Outlook.com, Hotmail, Live and MSN addresses, not to work or school Microsoft 365 mailboxes.

"But I only send a few hundred emails…"

The formal bulk thresholds are high, but in practice small senders without SPF/DKIM/DMARC get filtered more, and a missing DMARC record lets anyone spoof your domain. The "everyone" rules (SPF or DKIM) already apply to you. These three records are cheap insurance and the baseline every mailbox provider expects. Google also says aligning to both SPF and DKIM will likely become a requirement eventually.