What Gmail, Yahoo, Outlook and Apple require of senders

Gmail, Yahoo, Outlook.com and iCloud Mail each publish rules for mail sent to their users. Google and Yahoo require SPF or DKIM of every sender. All four require DMARC of bulk senders, and p=none meets it. This page quotes each rule from the provider's own page, with its date. We read every source on 14 November 2026.

The rules side by side

Every sender, bulk or not, needs SPF or DKIM at Google and Yahoo, plus reverse DNS for the sending IP address and a spam-complaint rate below 0.3%.

Google

1. p=none meets the rule: "Your DMARC enforcement policy can be set to none."
2. Bulk status never ends: "Senders who meet the above criteria at least once are permanently considered bulk senders." Mail from subdomains counts toward the domain's 5,000.
3. Google Workspace mailboxes are not covered: "The Email sender guidelines don’t apply to messages sent to Google Workspace accounts."
4. Bulk senders need both SPF and DKIM, but only one of them has to align with the From domain.
5. DKIM keys must be at least 1024 bits; Google recommends 2048.

Google's pages give two codes for a missing DMARC record: 4.7.31 in the FAQ, and 4.7.40 or 5.7.40 in its list of Gmail errors. With the text "doesn't have a DMARC record, or the DMARC record doesn't specify a DMARC policy", both mean the same thing: publish a DMARC record with a policy.

Yahoo

1. Yahoo gives no threshold. It calls a bulk sender one "sending a significant volume of mail". Mail that spoofs your domain counts toward that volume.
2. DMARC must pass, not only exist: "Publish a valid DMARC policy with at least p=none - DMARC must pass".
3. Unsubscribe requests must be honoured within 2 days. Since June 2025 Yahoo also receives the mail for AT&T addresses such as att.net and sbcglobal.net.

Microsoft (Outlook.com)

1. Only consumer mailboxes are covered: "This applies to Outlook.com - our consumer service, which is supporting hotmail.com live.com and outlook.com consumer domain addresses." Mail to Microsoft 365 business mailboxes is not covered.
2. Rejected, or sent to Junk? The blog says Microsoft will "reject messages that don't pass", with 550; 5.7.515 Access denied, from 5 May 2025. The Outlook.com postmaster page says failing mail "will be sent to the junk folder" and "may be rejected" later. Microsoft hasn't said which is current, so plan for rejection.
3. 5.7.515 is not in the Microsoft 365 error list, so a Microsoft 365 administrator won't find it there.

Apple (iCloud Mail)

Apple names no volume and no start date. Its page lists 13 rules, from sending only to people who subscribed, to authenticating with SPF, DKIM and DMARC, and says "All requirements must be met in order to send a bulk email. If not, the email will be rejected." iCloud Mail follows the sending domain's DMARC policy.

Outlook.com rejections, 5 to 9 November 2026

From 5 to 9 November 2026, Outlook.com, Hotmail and Live refused part of the mail from domains with no DMARC record, small senders included. The bounce read:

550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records (AS9031519)

Microsoft listed it as incident EX1545193. It put the cause down to "a recent update to the spam enforcement rules" that it "fully rolled back", and the end at 11:02 UTC on 9 November (Microsoft's notice, as published by the University of Pennsylvania). It was a fault, not a new rule: small senders still have no DMARC requirement at Outlook.com. MailRoute logged the first refusals on 5 November, a day before Microsoft's stated start (MailRoute, 10 November 2026).

Outlook.com doesn't retry a refused message. Resend anything important that bounced with this text in those days.

What the rules don't say

1. No provider requires p=reject. All four accept p=none.
2. 5,000 a day is not universal. Yahoo and Apple give no number.
3. Gmail doesn't reject mail for missing one-click unsubscribe. Google: "We don’t automatically reject messages or mark messages as spam when they don’t meet the one-click unsubscribe requirements". You lose Google's delivery support instead.

Check your domain

Check a domain shows whether SPF and DMARC are in place and what each record says. DKIM needs the selector your email service gave you in its setup; the DKIM guide explains what a selector is. To publish DMARC, start with p=none and a report address; DMARC explains the policies, and what changed in RFC 9989 covers the current standard.