Gmail and Yahoo have required SPF, DKIM and DMARC from bulk senders since February 2024, and Outlook.com has since May 2025. This page sums up what each mailbox provider asks for, which parts you can confirm from public DNS, and how to check hundreds of domains in one run.
For senders of roughly 5,000 or more messages a day to that provider’s personal mailboxes (Yahoo sets no number):
| Requirement | Gmail | Yahoo | Microsoft | Checkable from DNS? |
| SPF | Required | Required | Required, must pass | Yes: record published and valid |
|---|---|---|---|---|
| DKIM | Required | Required | Required, must pass | Partly: only at selectors you know or guess |
| DMARC record | Required, p=none is enough | Required, at least p=none | Required, at least p=none | Yes |
| From: alignment with SPF or DKIM | Required | Required (relaxed is fine) | Required | No: needs a real message |
| One-click unsubscribe | Required for marketing mail | Required, honoured within 2 days | Unsubscribe link recommended | No: it’s a message header |
| Spam rate | Below 0.3% | Below 0.3% | Not a stated threshold | No |
| Reverse DNS (PTR) / TLS | Both required | Valid reverse DNS | Not in the requirements | Only if you know the sending IPs |
Sources: Google’s Email sender guidelines and sender guidelines FAQ (checked September 2026); Yahoo’s Sender Best Practices and FAQ (checked September 2026); Microsoft’s Outlook high-volume sender announcement (April 2025, updated May 2025) and 550 5.7.515 help page.
Enforcement is real. Google says that from November 2025 non-compliant messages face “temporary and permanent rejections”. Its FAQ lists rejection or spam-foldering for failed SPF/DKIM authentication, alignment, reverse DNS or TLS, and loss of delivery support for a missing DMARC record, a spam rate over 0.3% or missing one-click unsubscribe. A domain that crosses the 5,000 threshold once is treated as a bulk sender permanently. Microsoft rejects mail to Outlook.com, Hotmail.com and Live.com from high-volume domains that fail its authentication requirements with 550 5.7.515.
Email Security Signals reads each domain’s public SPF, DMARC and DKIM records and returns a bulkSenderCompliant field alongside an A–F grade.
Siftjane@stripe.com and https://www.stripe.com/pricing both become stripe.com.google, selector1, selector2, k1, s1 and others) are always checked.bulkSenderCompliant. The issues column says exactly what’s missing, such as dmarc_missing or spf_multiple_records.You can also run it on a schedule or from Clay, Make or Zapier through the Apify integrations.
bulkSenderCompliant meanstrue | Valid SPF (one record, within the 10-lookup limit, not +all), a valid DMARC record (p=none counts), and a DKIM key published at one of the checked selectors. |
|---|---|
false | SPF is missing, published twice, over the 10-lookup limit or ends in +all; or DMARC is missing, published twice or malformed. |
null | SPF and DMARC records are valid, but no DKIM key was found at the selectors checked, or a DKIM lookup failed. DKIM selectors can’t be listed from DNS, so the domain may sign with a custom one. Add its selector (the s= tag in the DKIM-Signature header of one of its emails) and run again. |
Zones that answer every name with a wildcard TXT record are handled: a wildcard answer is never counted as a real DKIM key or policy, and MTA-STS, TLS-RPT and BIMI show as none (wildcard).
A DNS check confirms the records are published. It can’t confirm that mail actually passes. In particular:
List-Unsubscribe and List-Unsubscribe-Post headers live in each message, not in DNS.So treat bulkSenderCompliant: true as “the DNS prerequisites are in place”, and false as a real gap to fix: without a valid DMARC record, mail From: this domain can’t meet the rules, and a missing or broken SPF record fails SPF for any mail that uses the domain itself as its envelope sender. (Mail sent through a service that uses its own or a subdomain return-path is checked against that domain’s SPF instead.)
$0.02 per graded domain ($20 per 1,000), with no subscription. Domains that don’t exist, IP addresses, unparseable inputs, DNS lookup failures and duplicates come back as free rows. Set a max charge per run and the run never costs more than that.
p=none really satisfy the rules?Yes, for now. Google, Yahoo and Microsoft all accept a DMARC policy of p=none. The grade still scores quarantine and reject higher and flags p=none as not enforcing.
Yes. SPF, DKIM and DMARC are public DNS records that every receiving mail server reads. No email is sent and no login is used.
null?It most likely signs with a DKIM selector outside the common fifteen. Add that selector in Extra DKIM selectors and run again; with the key found, the result becomes true.