Skip to content
Hookgap
Get started

Google, Yahoo and Microsoft sender rules, explained for small business owners

· 6 min read

In February 2024 Google and Yahoo started enforcing new rules for anyone sending email to their users. Microsoft followed for Outlook.com, Hotmail and Live addresses in May 2025. The rules are not new technology. They are old standards (SPF, DKIM, DMARC) that providers now insist on.

This is a plain-English summary as of October 2026. The providers update their guidance, so check their sender pages for the current details.

Rules for every sender

Even if you only send a handful of emails a day, Gmail expects you to:

  • Authenticate with SPF or DKIM. Mail that is not authenticated is far more likely to be rejected or sent to spam.
  • Send from servers with valid DNS (forward and reverse records), over an encrypted (TLS) connection.
  • Keep spam complaints low. Google asks senders to stay below a 0.3% spam rate, and ideally under 0.1%.
  • Not pretend to be Gmail. Don't put an @gmail.com address in the From line of mail you send through other services.

Extra rules for bulk senders

Google defines a bulk sender as one that sends close to 5,000 or more messages a day to personal Gmail accounts. Microsoft uses a similar threshold. Bulk senders must also:

  • Use both SPF and DKIM.
  • Publish a DMARC record, at least p=none, with the From domain aligned to the SPF or DKIM domain.
  • Offer one-click unsubscribe in marketing email (the List-Unsubscribe header), and process unsubscribes within two days.

"We're small, so this doesn't apply to us"

Two reasons it usually does:

  1. The threshold counts all mail from your domain, including newsletters, invoices, appointment reminders and CRM sequences sent by tools you use.
  2. The basics affect everyone. Missing SPF or DKIM, a broken SPF record (see the 10-lookup limit) or no DMARC all make delivery less reliable at every volume. They also make it easier for someone to impersonate you.

A five-minute checklist

  1. Is there exactly one SPF record, under 10 lookups, ending in ~all or -all?
  2. Does your email platform (Microsoft 365, Google Workspace) sign outgoing mail with DKIM on your own domain?
  3. Is there a DMARC record? Start with p=none and a reporting address, then move towards quarantine and reject.
  4. Do the tools that send for you (newsletters, CRM, billing) authenticate with your domain, not theirs?
  5. Does marketing email include a working one-click unsubscribe?

You can check the first three for any domain in under a minute with a free Hookgap check.

For MSPs

These rules turned email authentication from a nice-to-have into something that affects whether a client's invoices arrive. That makes it one of the easiest security projects to explain, and a natural opener with prospects. See how MSPs use DMARC gaps to book first meetings.

Keep reading