Gmail, Yahoo and Outlook sender requirements: the 2026 checklist

Who do these rules apply to?

Each provider draws the line at roughly 5,000 emails a day to its own users.

• Gmail calls you a bulk sender if you send "close to 5,000 messages or more to personal Gmail accounts within a 24-hour period." Once you've hit that, Google treats you as a bulk sender for good.
• Yahoo applies its bulk sender rules on top of rules for everyone.
• Outlook says "domains sending more than 5,000 emails per day to Outlook.com accounts must fully be compliant with SPF, DKIM, and DMARC." That covers Hotmail, Live.com and MSN addresses too.

Here's my take for a growing Shopify brand: don't do the math. One Black Friday send to a 40,000-person list, with a big chunk of it on Gmail, puts you over the line in a single morning. And Google's FAQ says the basic requirements apply to all senders, bulk or not. Set it up once and stop worrying about the threshold.

What's on the checklist?

Here's what each provider asks for, from their own pages.

Gmail

• Both SPF and DKIM for bulk senders.
• A DMARC record. Google's FAQ lists "DMARC record is missing (minimum policy of none, p=none)" as a failure.
• Your From domain "must be aligned with either the SPF organizational domain or the DKIM organizational domain."
• TLS for sending connections and a PTR record on sending IPs. Klaviyo handles these two for you.
• One-click unsubscribe (the List-Unsubscribe header) on marketing and promotional mail. Transactional mail is exempt. Unsubscribes should be honored "within 48 hours."
• A spam rate below 0.1%, and never 0.3% or higher. If you cross 0.3%, Google won't help you until you've stayed under it for 7 days in a row.

Yahoo

• SPF or DKIM at a minimum for everyone, and both for bulk senders.
• "Publish a valid DMARC policy with at least p=none - DMARC must pass."
• From domain aligned with SPF or DKIM.
• One-click unsubscribe on marketing and subscribed messages, honored "within 2 days."
• Spam rate below 0.3%.

Outlook

• SPF and DKIM must pass, and at least one has to align with your From domain.
• DMARC at least p=none. Microsoft recommends p=reject.
• An unsubscribe method that's "clearly documented and easy for recipients to find and use."
• Non-compliant mail can land in junk or get rejected with the error "550; 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level."

Put side by side, it's one checklist with slightly different wording. If you pass Gmail, you're very close to passing the other two.

How do I check this in Klaviyo?

You can check most of it in about ten minutes.

1. Are you on a branded sending domain?

Go to Settings, then Domains. If you're still sending from Klaviyo's shared default domain, that's your first fix. Klaviyo's own DMARC guidance says its shared domain doesn't pass DMARC for your domain. A branded sending domain like send.yourbrand.com does, because it aligns with the address in your From line.

Setting one up is a DNS job. I walk through every step in Klaviyo DMARC and branded sending domain setup.

2. Do you have a DMARC record?

When you add a branded domain, Klaviyo offers to generate a monitoring-only DMARC record (p=none) if your domain doesn't have one. It doesn't publish it for you. Someone still has to add it in your DNS. If you already have a DMARC record, don't add a second one.

3. Is one-click unsubscribe working?

Klaviyo adds the unsubscribe header to marketing email. Your job is to make sure every campaign and flow email still has a visible unsubscribe link in the footer, and that nobody removed it from a custom template.

4. What's your spam rate, by inbox provider?

This is the one I'd look at weekly. In Klaviyo, go to Analytics, then Deliverability. The Reports tab breaks performance down by inbox provider. I like this view because it shows where people actually interact with your emails. If Gmail opens and clicks are falling off a cliff compared to Yahoo or Outlook, you know where to look.

Klaviyo's deliverability score runs from 0 to 100 and needs at least 1,000 emails sent in the last 30 days. Under 50 is poor. For Gmail specifically, Google wants bulk senders on Postmaster Tools, which has a compliance dashboard that tells you if you're passing.

What actually keeps the spam rate low?

Authentication gets you in the door. Who you send to keeps you there.

The rules above are mostly a one-time setup. The spam rate is different: it moves every time you send. And the biggest lever is sending to people who still want to hear from you.

A flavored diffuser brand I work with tightened its audiences and its open rate went from 22% to 44%. A sports training tech brand sent to an engaged segment of 7,145 people and earned $0.19 per person. The same brand's blast to 49,475 people earned $0.04. Smaller, warmer sends make more money per person and keep complaints down.

So before BFCM: - Send campaigns to engaged segments, not your whole list. - Run a sunset flow for people who've gone quiet. - Remove obviously bad profiles, then put your energy into capturing better ones. Founders over-focus on cleaning. - Don't double your volume overnight. If your list hasn't heard from you in a while, ramp up.

Does landing in the Promotions tab mean I'm failing these rules?

No. The Promotions tab is still the inbox. It's where Gmail puts marketing email on purpose, and it's a reflection of how you've performed with your list, not a penalty. If Gmail subscribers click and buy close to the rest of your list, you're fine. I wrote more on that in the Gmail Promotions tab isn't spam.

The thing to worry about is spam folder placement and rejections. If you think that's happening, my Klaviyo emails going to spam post has the full triage.

What should I fix before Black Friday?

Black Friday is Nov 27 and Cyber Monday is Nov 30. You'll send more email that week than any other, so do this now:

1. Confirm you're on a branded sending domain.
2. Confirm a DMARC record exists, at p=none or stricter.
3. Check Klaviyo's deliverability report by inbox provider for any provider falling behind.
4. Build engaged segments for BFCM sends instead of blasting the full list.
5. Click every link in your BFCM emails before they go out.

Then build the plan. My BFCM email strategy covers who gets which sends and when.

FAQ

WRITTEN BY Jack White

Founder of Bardown Digital, a Chicago-based Klaviyo email and retention agency for Shopify brands. He's worked with brands doing $500K to $100M a year, with $100M+ in email-attributed revenue across them.

Instagram @jackintheinbox LinkedIn