The 2024 rules of Google and Microsoft
In February 2024 Google and Yahoo began enforcing a shared set of sender requirements, with Microsoft following for Outlook. What had been best practice became an admission requirement: fail it and messages are filtered or refused at the gateway, whatever their content.
What applies to every sender
Regardless of volume, all three now expect the same baseline.
- An authenticating SPF or DKIM pass, aligned with the From domain.
- A DMARC record on the From domain —
p=nonesatisfies the letter of the requirement, though not its intent. - Forward-confirmed reverse DNS on the sending IP: a PTR that resolves back to the same address.
- TLS on the connection, and a
Message-IDon every message.
What applies above roughly 5,000 messages a day
Bulk senders carry two further obligations. List-Unsubscribe plus List-Unsubscribe-Post (RFC 8058), so a recipient can unsubscribe in one click without visiting a page, and the request has to be honoured within two days. And a spam complaint rate below 0.3%, measured by the receiver, with 0.1% as the level to stay under in practice.
The threshold is per sending domain, not per company, and it is evaluated over a rolling window — so a single campaign can put you over it.
Why a small sender is affected too
The baseline requirements have no volume threshold. A business sending twenty quotes a week is measured on the same authentication as a bulk sender, and an unauthenticated message from an unknown domain has no reputation to fall back on. Low volume is a disadvantage here, not a shield.
The scan at the bottom of this page checks the DNS side of every one of these: SPF, DKIM, DMARC and the alignment they produce.
Frequently asked questions
I send a handful of messages a day. Does this apply?
The authentication requirements do; the bulk requirements (one-click unsubscribe, the complaint rate) do not. In practice that means SPF or DKIM aligned, plus a DMARC record.
Is p=none enough?
It satisfies the requirement as written — the receivers ask for a DMARC record, not for enforcement. It offers no protection against forgery, so treat it as the first step rather than the destination.