What Gmail, Yahoo and the email RFCs require in 2026: SPF, DKIM, DMARC, the 10-lookup SPF limit, spam-rate thresholds and one-click unsubscribe.
Table of Contents
Editor's note: An earlier version of this page was a "benchmark report" with figures we could not support with data, along with platform comparisons. We removed them. This version sticks to rules published by Google, Yahoo and the IETF, with a link to each source.
Who do the Gmail and Yahoo rules apply to?
Gmail's rules apply to mail sent to personal Gmail accounts. Google defines a bulk sender as "any email sender that sends close to 5,000 messages or more to personal Gmail accounts within a 24-hour period," counting all mail from the same primary domain, and says senders who meet that bar once "are permanently considered bulk senders." The guidelines "don't apply to messages sent to Google Workspace accounts." (Google sender guidelines FAQ)
Yahoo does not set a number. It calls a bulk sender one "sending a significant volume of mail" and says, "We will not specify a volume threshold." (Yahoo sender FAQs)
The checklist
| Requirement | Gmail: all senders | Gmail: 5,000+ a day | Yahoo: all senders | Yahoo: bulk senders |
|---|---|---|---|---|
| SPF and DKIM | SPF or DKIM | SPF and DKIM | SPF or DKIM | SPF and DKIM |
| DMARC | Not required | Required; policy can be p=none | Strongly urged | Required, at least p=none, and DMARC must pass |
| From: domain aligned with SPF or DKIM domain | – | Required | – | Required (relaxed alignment is acceptable) |
| Valid forward and reverse DNS (PTR) | Required | Required | Required | Required |
| TLS for sending | Required | Required | Not stated | Not stated |
| Spam rate | Below 0.3% (guideline: below 0.10%) | Below 0.3% | Below 0.3% | Below 0.3% |
| One-click unsubscribe | – | Marketing and subscribed mail; visible body link; honor within 48 hours | – | Required; visible body link; honor within 2 days |
Sources: Google email sender guidelines, Google FAQ, Yahoo sender requirements. Yahoo says its "requirements are subject to change," so check both pages before you rely on a cell.
SPF: stay within 10 DNS lookups
SPF (RFC 7208) lists the servers allowed to send for your domain. Every include: you add for a sending tool can trigger more DNS queries, and the standard caps them. Section 4.6.4, "DNS Lookup Limits," says:
"The following terms cause DNS queries: the "include", "a", "mx", "ptr", and "exists" mechanisms, and the "redirect" modifier. SPF implementations MUST limit the total number of those terms to 10 during SPF evaluation, to avoid unreasonable load on the DNS. If this limit is exceeded, the implementation MUST return "permerror"."
The same section adds that implementations "SHOULD limit "void lookups" to two" (lookups that return no answer). ip4, ip6 and all don't count toward the 10.
To stay under the limit:
- Publish exactly one SPF record per domain.
- Remove
include:entries for tools you no longer send from. - Count nested includes: a provider's include can contain its own includes, and they all count.
- End the record with
-allonce every real sender is listed;~allonly soft-fails.
DKIM: sign every message
DKIM (RFC 6376) "permits a person, role, or organization that owns the signing domain to claim some responsibility for a message." Gmail says, "Sending to personal Gmail accounts requires a DKIM key of 1024 bits or longer," and recommends a 2048-bit key if your DNS provider supports it. Yahoo recommends a "minimum 1024-bit key length."
DMARC: publish a policy, then tighten it
DMARC ties SPF and DKIM to the domain in your From: header. The current standard is RFC 9989 (Standards Track, published May 2026); in its own words, "This document obsoletes RFCs 7489 and 9091." If an older guide cites RFC 7489, that RFC now shows "Obsoleted by" RFC 9989 on the RFC Editor.
Both Gmail and Yahoo accept p=none for bulk senders. Yahoo says including a rua tag for reports "is strongly recommended." A common path is to start at p=none, read the reports, then move to p=quarantine or p=reject when only your own services are sending. Google's Set up DMARC guide covers the steps.
Spam rate: Gmail's exact thresholds
Google's guidelines say: "Keep spam rates reported in Postmaster Tools below 0.10% and avoid ever reaching a spam rate of 0.30% or higher." Its all-senders requirement is "Keep spam rates reported in Postmaster Tools below 0.3%." Bulk senders over that line lose access to Google's delivery mitigation and "will be eligible for mitigation when their spam rates remain below 0.3% for 7 consecutive days." Yahoo's rule is "Keep your spam rate below 0.3%."
Unsubscribe
For marketing and subscribed messages, Gmail requires one-click unsubscribe using the List-Unsubscribe-Post: List-Unsubscribe=One-Click and List-Unsubscribe headers (RFC 8058), plus a visible link in the body; unsubscribe requests not honored within 48 hours lose delivery support. Yahoo requires bulk senders to "Honor unsubscribes within 2 days." Neither page says whether a one-to-one cold email counts as "marketing," so check with your own counsel.
Enforcement is tightening
Google: "Starting November 2025, Gmail is ramping up its enforcement on non-compliant traffic." Messages that fail the requirements can get temporary or permanent failure codes or go to spam, and new domains are on "an accelerated timetable." Google also advises starting "with a low sending volume to engaged users," then increasing slowly while you watch spam rate and reputation.
Check your domain for free
OutreachBox's free SPF, DKIM and DMARC checker reads your domain's public DNS records and gives SPF, DKIM and DMARC each a pass, warn or fail with a plain-English fix. No login. For SPF, it follows include: and redirect chains and counts the terms that cause DNS lookups (include, a, mx, ptr, exists, redirect); a record that needs more than 10 gets a fail that names the count. It also flags duplicate SPF records, +all and ~all, and DMARC p=none. It's a DNS check, not an inbox-placement test.
For the full Gmail and Yahoo rule set, read SPF, DKIM and DMARC for cold email; for setup steps, see the cold email deliverability guide.
OutreachBox: once your domain passes, OutreachBox agents can warm inboxes, verify addresses and send with approval gates. Free plan; paid from $99/month. Start freeFAQ
What is the SPF 10-lookup limit?RFC 7208, section 4.6.4, says SPF implementations "MUST limit the total number of those terms to 10 during SPF evaluation." The terms are the include, a, mx, ptr and exists mechanisms and the redirect modifier. Past 10, the result is "permerror," so receivers may treat the SPF check as failed.
Do I need DMARC for cold email?If you send close to 5,000 or more messages a day to personal Gmail accounts, yes: Gmail requires DMARC, and a policy of p=none is allowed. Yahoo requires bulk senders to publish a DMARC policy of at least p=none that passes. Smaller senders need SPF or DKIM at minimum.
What spam rate is too high for Gmail?Google says to keep spam rates reported in Postmaster Tools below 0.10% and avoid ever reaching 0.30% or higher. Its requirement for all senders is below 0.3%. Yahoo also requires below 0.3%.
Which RFC defines DMARC now?RFC 9989, published in May 2026 on the Standards Track. It states, "This document obsoletes RFCs 7489 and 9091." Older guides that cite RFC 7489 point to the superseded version.
Do Gmail's sender rules apply to Google Workspace recipients?No. Google says its sender guidelines "don't apply to messages sent to Google Workspace accounts." The requirements and enforcement apply only to mail sent to personal Gmail accounts. Authenticating every domain is still recommended.
How do I check my SPF, DKIM and DMARC records?Use OutreachBox's free checker at outreachbox.com/tools/email-deliverability-checker. It reads your public DNS records, grades each one pass, warn or fail, and fails an SPF record that needs more than 10 DNS lookups. No login is required.
Sources
Related Articles
B2B Prospecting Software: 7 Best Platforms to Grow Your Sales Pipeline
What Is B2B Prospecting Software?Getting the right contacts and company information so you can talk to real people is tough. Prospecting software can save you time and ensure your sales efforts are...
10 Marketing Automation Platforms Worth Using
Things are so much harder in the world of marketing than they were a few short years ago. Businesses now have email marketing to coordinate, social media outreach to conduct, customer journeys to map...