Are You Ready for Google & Yahoo's Email Sender Rules? (2026)
Published · updated
Figures as of 2026-08-16 · methodology v8. Aggregate census data across 377 million graded domains. See how we grade.
Part of the DMARC pillar — DMARC adoption, maturity and league tables, measured across the whole census.
Google and Yahoo began requiring email authentication from bulk senders in 2024, with Microsoft following — and most domains still don’t meet the bar. The rules are simple: if you send at volume, you must authenticate with SPF, DKIM and DMARC, keep spam complaints low, and make unsubscribing easy. The authentication part is where domains fail: only 38.84% publish SPF, -16.40% show DKIM, and just 20.05% have any DMARC record at all.
What the rules actually require
The shared requirements across Google, Yahoo and Microsoft for bulk senders:
- SPF and DKIM on your sending domain — both, not either.
- A DMARC record (at minimum
p=none, aligned with your sending). - Spam complaint rate kept low (Google’s guidance: stay under ~0.3%).
- One-click unsubscribe and honouring opt-outs promptly.
Miss the authentication requirements and your mail is increasingly throttled, junked, or rejected — not because of content, but because you can’t be verified.
Where domains stand against the bar
| Requirement | Domains that meet it |
|---|---|
| SPF published | 38.84% |
| DKIM detectable | -16.40% |
| DMARC record present | 20.05% |
| DMARC actually enforcing | 9.28% |
Around half of domains have SPF and DKIM, but the drop-off at DMARC is steep — and DMARC is explicitly part of the bulk-sender requirements. A domain with SPF and DKIM but no DMARC record does not fully meet the rules.
How to get compliant (free, in order)
- Publish SPF listing every service that sends as you.
- Turn on DKIM at your mail provider and publish the key.
- Add DMARC — start at
p=noneto confirm alignment, then move toward enforcement. - Set up one-click unsubscribe and watch your complaint rate.
All four are configuration, not cost. The senders who get throttled are almost never the ones who couldn’t afford compliance — they’re the ones who didn’t know the bar moved.
Frequently asked questions
What do Google and Yahoo require from senders? SPF, DKIM and DMARC authentication, a low spam-complaint rate (under ~0.3%), and easy one-click unsubscribe. Bulk senders who don’t comply get throttled or rejected.
Do I need DMARC for Google/Yahoo, or just SPF and DKIM? DMARC too. The requirements call for a DMARC record on your sending domain. Only 20.05% of domains have one.
Does this apply to small senders? The strictest thresholds target bulk senders, but the same authentication is increasingly expected of everyone — and it’s what keeps your normal business mail out of spam regardless of volume.
How do I check if my domain complies? Run a free, private check (below) — it shows your SPF, DKIM and DMARC status against the requirements.
Check whether you meet the sender rules
Don’t find out from a delivery failure. Check your domain’s authentication privately and free, with exactly what to fix.
Check your domain → · Why emails go to spam → · Fix SPF → · Fix DMARC → · Aggregate data only. Data stored and processed in the EU.