Back to the blog Marketing

Email deliverability: what Gmail, Yahoo and Outlook require

Since 2024, Gmail and Yahoo have required authentication, one-click unsubscribe and low spam complaints from high-volume senders, and Outlook.com joined in 2025. What each one asks for, how to measure your reputation and what Chilean law says.

David López · CEO - Fundador November 4, 2026 10 min read

Getting a newsletter into the inbox is not just a design question. Since 2024, Gmail and Yahoo have required specific technical standards from high-volume senders, and Outlook.com joined in 2025.

Today, a message that doesn't comply can land in spam or be rejected. This guide sums up what each provider requires, how to measure your reputation and what Chilean law says. We covered setting up SPF, DKIM and DMARC from a security angle in AI-powered phishing; here we look at them from a delivery angle.

What has changed since 2024

February 2024. Gmail and Yahoo start enforcing their requirements, gradually.
June 2024. Google's deadline for one-click unsubscribe in promotional messages that already had an unsubscribe link expires, and bulk senders with a spam rate above 0.3% can no longer request mitigation (Google FAQ).
May 5, 2025. Outlook.com starts requiring SPF, DKIM and DMARC from domains that send more than 5,000 emails a day.
November 2025. Gmail ramps up enforcement, with temporary and permanent rejections.

Who counts as a bulk sender

Provider	Threshold	Scope
Gmail	Close to 5,000 messages or more in 24 hours, adding up subdomains of the same primary domain. Crossing it once is enough: the status is permanent.	Personal @gmail.com and @googlemail.com accounts, not Google Workspace accounts.
Yahoo	Publishes no threshold: it refers to "a significant volume".	Assesses the sender by the authenticated domain or the From domain.
Outlook.com	More than 5,000 emails a day, according to Microsoft's blog; its support page says 5,000 or more, without a time period, and counts them by From domain.	Consumer service: outlook.com, hotmail.com and live.com.

Technical requirements

Requirement	Gmail (bulk)	Yahoo (bulk)	Outlook.com (bulk)
SPF and DKIM	Both	Both	Both must pass
DMARC	At least `p=none`	At least `p=none`; DMARC must pass	At least `p=none`
Alignment with From	SPF or DKIM	SPF or DKIM; relaxed alignment accepted	SPF or DKIM (preferably both)
One-click unsubscribe	Required for marketing (RFC 8058)	Required for marketing	Recommends a functional unsubscribe link
Time to process unsubscribes	48 hours	2 days	Not specified
User-reported spam	Below 0.1%; never 0.3% or higher	Below 0.3%	No figure published
Forward and reverse DNS (PTR)	Yes	Yes	Not among its requirements
TLS	Yes	Not among its requirements	Not among its requirements

For non-bulk senders, Gmail requires SPF or DKIM, valid PTR, TLS, RFC 5322 formatting and spam below 0.3%. Yahoo asks for the same, except TLS, plus RFC 5321 compliance.

Microsoft is not consistent about what happens if you don't comply: its Postmaster site talks about sending to Junk and rejecting later, but its blog's April 29, 2025 update and its support page describe rejection with error 550 5.7.515. Plan for rejection.

Authentication and alignment

DMARC passes when SPF or DKIM passes and the authenticated domain is aligned with the From domain. RFC 9989, which replaced RFC 7489 in May 2026, defines two modes: relaxed, when they share the organizational domain, and strict, when they are identical. If you send from newsletter.yourcompany.com and sign DKIM with yourcompany.com, alignment is relaxed; according to the RFC, nearly all domain owners find that mode sufficient.

Check your sending platform: if it signs DKIM and sets the Return-Path with its own domain, SPF and DKIM can pass without either being aligned with your From. Microsoft asks that the service use your domain for both.

Gmail requires DKIM keys of at least 1,024 bits and recommends 2,048. It also recommends aligning both SPF and DKIM, and expects that dual alignment will likely become a requirement.

One-click unsubscribe

RFC 8058 defines two headers:

List-Unsubscribe: <https://yourcompany.com/unsub/a8f3k2q9>, <mailto:unsub@yourcompany.com>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

When a person unsubscribes from their mail client, the provider sends a POST to that URL and your server processes it with no further steps. The RFC calls for:

An HTTPS URL that identifies the recipient and the list; it recommends an opaque, hard-to-forge identifier.
A DKIM signature covering both headers. Without it, the provider should not offer one-click unsubscribe.
A POST with no cookies or authentication, and a server that does not respond with a redirect.

For Google, a mailto or a preferences page is not enough on its own; Yahoo accepts mailto, though it recommends POST. Transactional messages, such as a password reset, don't need one-click unsubscribe.

User-reported spam rate

Google calculates the rate daily. A rate of 0.1% equals one complaint per 1,000 messages. Above 0.3% you can't request mitigation, and you become eligible again after 7 consecutive days below that level. Yahoo calculates the rate on mail delivered to the inbox.

How to measure your reputation

Gmail. Postmaster Tools shows user-reported spam, authentication, encryption, delivery errors and a compliance dashboard by requirement. Data is usually updated within 24 hours and only covers personal Gmail accounts. Google will replace the domain and IP reputation dashboards: it says reputation is only one of many factors.
Yahoo. The Complaint Feedback Loop sends you a report when someone marks your email as spam; it works with DKIM. Its Placement Feed reports how much reaches the inbox and how much goes to spam, with access on request.
Outlook.com. SNDS provides data per IP address and includes the junk email reporting program. It is useful if you control your IPs.
DMARC. Publish an rua address to receive aggregate reports. Microsoft confirms it sends them and Yahoo recommends setting one up.

Watch out for a very low spam rate: according to Google, it can mean Gmail is already sending your messages to spam.

Gmail's rejection codes indicate which requirement is failing:

Code	Problem
4.7.23 / 5.7.25	PTR missing or not matching the IP
4.7.27 / 5.7.27	SPF does not pass
4.7.29 / 5.7.29	No TLS
4.7.30 / 5.7.30	DKIM does not pass
4.7.31	No DMARC record
4.7.32	From not aligned with SPF or DKIM

List hygiene and double opt-in

Google's guidelines ask you to send only to people who want your messages:

Confirm each address before subscribing it (double opt-in). Yahoo also recommends it to keep out fake addresses and bots.
Don't buy lists or use subscription checkboxes that are checked by default.
Automatically unsubscribe recipients with repeated bounces.
Periodically ask subscribers to confirm they want to stay, and consider unsubscribing those who don't open or read.
Separate message types: Google suggests one From address per category and not mixing promotions into receipts; Yahoo, separating marketing and transactional mail by IP or DKIM domain.
Remove invalid or inactive addresses monthly or quarterly, as Microsoft suggests.

Warm-up: there is no official schedule

None of the three providers publishes a warm-up plan with figures. Google offers criteria: start with low volume to your most engaged contacts, send at a steady rate and don't suddenly double volume. If you get error 4.7.28 for exceeding a quota, wait at least 10 minutes and resume with a single connection. Yahoo warns that a sudden spike can make you look like a compromised sender. And on a shared IP, what other senders do affects your reputation.

Content and frequency without myths

None of the guidelines reviewed includes a list of banned words. What they do ask:

Subject lines, display names and headers that don't mislead: no fake "Re:" or "Fwd:", and no emojis that suggest verification.
No content hidden with HTML or CSS, and links that are visible and understandable.
A From address that identifies the sender; Microsoft asks that it can receive replies.
Stick to the promised frequency: Yahoo asks you not to switch a weekly or monthly list to daily sends.

On opens: Google doesn't track them and warns that a low rate is not necessarily a sign of a delivery problem. In addition, if the recipient turns on Apple's Mail Privacy Protection, the sender cannot see whether they opened the message. Measure clicks, conversions, bounces, unsubscribes and complaints.

Chile: what the law says

This is not legal advice; it is a summary of the texts published on LeyChile.

Law 19.496, article 28 B (consolidated text). Every promotional or advertising communication sent by email must state its subject, the sender's identity and a valid address where the recipient can ask for the mailings to stop. Once requested, they are prohibited. The article sets no deadline: Google's 48 hours and Yahoo's 2 days are those providers' rules.
Fines. Under article 24, violations of that law with no specific penalty carry fines of up to 300 UTM (a Chilean monthly tax unit).
Law 21.719 (LeyChile). It amends Law 19.628; the articles cited are those of that law in its new wording. Consent must be free, informed, specific, prior and unequivocal; it can be withdrawn at any time through free, always-available means, and the controller must prove it obtained it (article 12). Data subjects can object to processing carried out solely for direct marketing, including profiling (article 8), and request erasure of their data if they exercised that objection and there is no other legal basis (article 7).
Effective date. Law 21.719 takes effect on December 1, 2026. On October 28, 2026, the Senate approved a bill (bulletin 18.623-07) that postpones it to October 15, 2027; the bill is in its second reading in the Chamber of Deputies. Until it is published, the effective date remains December 1, 2026.

How both laws apply to your contact base is a question for your legal counsel. For recording consent in forms, see first-party measurement.

Checklist

Technical

SPF and DKIM on every platform that sends on your behalf, with 2,048-bit DKIM where possible.
DMARC published with at least p=none and an rua address that someone reviews.
From aligned with DKIM (and preferably SPF), including on your email marketing platform.
Valid PTR, with matching forward and reverse DNS, and sending over TLS.
List-Unsubscribe and List-Unsubscribe-Post headers signed with DKIM, with an HTTPS URL that answers the POST without redirecting.
Postmaster Tools verified, Yahoo's Feedback Loop active and SNDS if you control your IPs.

Content and list

Double opt-in and a record of when and how each contact subscribed.
Unsubscribes processed in under 48 hours, without requiring a login.
Subject, sender name and unsubscribe address visible in every send, as article 28 B requires.
User-reported spam below 0.1% and someone responsible for reviewing it.
Bounces and inactive contacts cleaned periodically; no purchased lists.
Promotions separated from transactional mail and frequency matching what was promised.

Sources

If you'd like to review how you send your campaigns, let's talk.