{"id":45681,"date":"2025-04-07T11:55:01","date_gmt":"2025-04-07T11:55:01","guid":{"rendered":"https:\/\/easydmarc.com\/blog\/?p=45681"},"modified":"2025-07-30T13:42:50","modified_gmt":"2025-07-30T13:42:50","slug":"google-yahoo-microsoft-icloud","status":"publish","type":"post","link":"https:\/\/easydmarc.com\/blog\/google-yahoo-microsoft-icloud\/","title":{"rendered":"The Ultimate Guide to Email Sender Requirements for Google, Yahoo, Microsoft, and Apple iCloud Mail"},"content":{"rendered":"\n

Between 2024 and 2025, all major email providers have tightened requirements for bulk and large-volume email senders to protect their users from spam, spoofing, and phishing. Google’s Gmail, Yahoo, Apple’s iCloud Email, and now Microsoft (Outlook, Hotmail, and Live) are all following these new regulations.<\/p>\n\n\n\n

Providers define \u201clarge email sender\u201d<\/strong> (or high-volume sender<\/strong>) based on the number of emails sent per day to their users<\/strong> – even if you exceed the volume one day in a year.  <\/p>\n\n\n

<\/div><\/div><\/figure>\n\n\n
\n
\n
\n
Definition of Large Email Sender<\/strong><\/h5>\n\n\n\n
Provider<\/strong><\/td>Threshold<\/strong><\/td>Key Requirements<\/strong><\/td><\/tr>
Google(Gmail)<\/td>5,000+ emails\/day to Gmail recipients<\/td>DMARC, SPF, DKIM, one-click unsubscribe, low spam rate<\/td><\/tr>
Yahoo<\/td>5,000+ emails\/day to Yahoo Mail users<\/td>Same standards as Google (DMARC, DKIM, SPF, unsubscribe)<\/td><\/tr>
Microsoft (Outlook\/Hotmail)<\/td>5,000+ emails\/day to Microsoft domains (outlook.com, hotmail.com, etc.)<\/td>SPF, DKIM, DMARC, feedback loop registration, security alignment<\/td><\/tr>
Apple iCloud Mail<\/td>Not explicitly specified<\/td>DMARC, SPF, DKIM, one-click unsubscribe, valid PTR (reverse DNS) records, compliance with RFC 5321 and RFC 5322<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

\"\" Important:<\/span> These thresholds refer to emails sent per day per domain, not just per IP address.<\/span><\/p>\n<\/div><\/div>\n<\/div>\n<\/div>\n\n\n\n

It\u2019s important to note, however, that even if you’re under the 5,000 emails per day limit, best practices still apply, <\/strong>especially if your business is growing. Requirements like DMARC with a “p=none” policy<\/strong> are accepted, but this doesn’t protect you from impersonation attacks (BEC, phishing, etc.).<\/p>\n\n\n\n

Requirements for Sending Emails to Gmail, Yahoo, Microsoft<\/strong>, and Apple iCloud Mail<\/h3>\n\n\n\n
    \n
  1. SPF, DKIM Authentication<\/li>\n\n\n\n
  2. DMARC Implementation (p=none)<\/li>\n\n\n\n
  3. DMARC Alignment<\/li>\n\n\n\n
  4. Valid rDNS (PTR)<\/li>\n\n\n\n
  5. TLS Encryption<\/li>\n\n\n\n
  6. Spam Complaint Threshold<\/li>\n\n\n\n
  7. One-Click Unsubscribe<\/li>\n\n\n\n
  8. List-Unsubscribe Header & Unsubscribe Processing Timeline<\/li>\n\n\n\n
  9. Valid \u201cFrom\u201d & \u201cReply-To\u201d address<\/li>\n\n\n\n
  10. Bounce Handling & List Hygiene<\/li>\n<\/ol>\n\n\n\n
    Below is a breakdown of the key requirements and technical expectations every sender should comply with:<\/h5>\n\n\n\n
    Requirement<\/strong><\/td>Google<\/strong><\/td>Yahoo<\/strong><\/td>Microsoft (Outlook)<\/strong><\/td>Apple (iCloud Mail)<\/strong><\/td><\/tr>
    SPF Authentication<\/strong><\/td>Required (All Senders)<\/td>Required (All Senders)<\/td>Required (Bulk Senders only)<\/td>Required (Bulk Senders)<\/td><\/tr>
    DKIM Authentication<\/strong><\/td>Required (All Senders)<\/td>Required (All Senders)<\/td>Required (Bulk Senders only)<\/td>Required (Bulk Senders)<\/td><\/tr>
    DMARC Implementation<\/strong><\/td>Required for Bulk (p=none OK)<\/td>Required for Bulk (p=none OK)<\/td>Required for Bulk (p=none OK)<\/td>Required for Bulk Senders<\/td><\/tr>
    DMARC Alignment<\/strong><\/td>Required for Bulk<\/td>Required for Bulk (Relaxed OK)<\/td>Required for Bulk (prefer SPF & DKIM aligned)<\/td>Not specified<\/em><\/td><\/tr>
    Valid Forward and Reverse DNS (PTR)<\/strong><\/td>Required (All Senders)<\/td>Required (All Senders)<\/td>Not mentioned<\/em><\/td>Required (Bulk Senders)<\/td><\/tr>
    TLS Encryption<\/strong><\/td>Required (All Senders)<\/td>Not mentioned<\/em><\/td>Not mentioned<\/em><\/td>Not specified<\/em><\/td><\/tr>
    Spam Complaint Rate<\/strong><\/td>Must be < 0.3% (Postmaster Tools)<\/td>Must be < 0.3%<\/td>Not specified<\/em><\/td>Not specified<\/em><\/td><\/tr>
    One-Click Unsubscribe<\/strong><\/td>Required for Bulk<\/td>Required for Bulk<\/td>Recommended<\/td>Required for Bulk Senders<\/td><\/tr>
    List-Unsubscribe Header<\/strong><\/td>Implied by one-click requirement<\/td>Required (mailto: or POST)<\/td>Recommended<\/td>Not specified<\/em><\/td><\/tr>
    Unsubscribe Processing Timeline<\/strong><\/td>Not specified<\/td>Must honor within 2 days<\/td>Not specified<\/em><\/td>Immediate<\/td><\/tr>
    Valid \u201cFrom\u201d \/ \u201cReply-To\u201d Addresses<\/strong><\/td>Required<\/td>Required<\/td>Required for Bulk<\/td>Required for Bulk Senders<\/td><\/tr>
    Bounce Handling \/ List Hygiene<\/strong><\/td>Required<\/td>Expected for deliverability<\/td>Recommended for Bulk<\/td>Required for Bulk Senders<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

    SPF and DKIM Authentication<\/strong><\/h2>\n\n\n\n

    SPF and DKIM<\/a> are no longer optional\u2014they are mandatory.<\/p>\n\n\n\n

    SPF (Sender Policy Framework)<\/strong> is a DNS TXT record that declares which IP addresses or hostnames are authorized to send emails on behalf of a domain. This is tied to the RFC5321.MailFrom (also known as the envelope sender). SPF validation is done by checking the return-path domain against the connecting IP.<\/p>\n\n\n\n

    To set up SPF, it is highly advised for you to examine your DMARC aggregate reports, investigate the sending sources used, and adjust your SPF record by adding the necessary include using EasyDMARC\u2019s SPF Generator tool.<\/p>\n\n\n\n

    DKIM (DomainKeys Identified Mail)<\/strong> is a mechanism to digitally sign emails using asymmetric cryptography. The sender signs the message with a private key, and the recipient verifies the message with the public key published in DNS. DKIM signs headers and parts of the body to ensure the content wasn\u2019t tampered with.<\/p>\n\n\n\n

    In most third-party sending platforms, like SendGrid, Mailchimp, or SES, the SPF include: mechanism and DKIM public keys are provided during setup. These services handle the private keys on their infrastructure. If you\u2019re using a “dedicated” or “on-prem” server, you can use EasyDMARC\u2019s DKIM generator tool.<\/p>\n\n\n\n

    SPF and DKIM alone ensure the message is authenticated<\/strong>, but this does not mean the domain used in the From: address is protected<\/strong>. That\u2019s where DMARC and alignment comes in.<\/p>\n\n\n\n

    DMARC Implementation (p=none)<\/strong><\/h2>\n\n\n\n

    DMARC (Domain-based Message Authentication, Reporting, and Conformance) is a protocol that builds on SPF and DKIM to give domain owners control over what happens when authentication or alignment fails. It also provides visibility into your domain\u2019s email traffic through reporting.<\/p>\n\n\n\n

    Google, Yahoo, Microsoft, and Apple (iCloud)<\/strong> now require senders to publish a DMARC record<\/strong> with at least a p=none policy. This is the monitoring mode of DMARC and represents the first step in a domain’s DMARC journey.<\/p>\n\n\n\n

    While these providers do not currently require<\/strong> the inclusion of a rua= (Reporting URI for Aggregate reports)<\/strong> tag in the DMARC record, we strongly recommend it,<\/strong> and here\u2019s why:<\/p>\n\n\n\n

    Why rua= Should Be Mandatory in Practice:<\/strong><\/p>\n\n\n\n