One-click unsubscribe and the bulk-sender rules: what Gmail, Yahoo and Microsoft check in 2026

In February 2024 Google and Yahoo started enforcing a shared set of requirements for anyone sending bulk email to their users. Microsoft followed in May 2025 with matching rules for Outlook.com, Hotmail and Live addresses. The rules are not long, but they are checked by machines, and mail that fails them is junked or rejected without anyone telling you.

This post lists what the three providers actually require, shows you how to look at the headers of your own email to see whether you meet them, and then says exactly what SendBeam sets for you and what it does not. The last part matters: a platform that says “deliverability handled” without saying which headers it emits is asking you to take it on trust.

Who the rules apply to

Google’s requirements have two tiers. Every sender to Gmail must authenticate with SPF or DKIM, keep spam rates low and not impersonate Gmail in the From header. Senders of 5,000 or more messages a day to Gmail addresses must meet the full list below. Google’s own page is the reference: Email sender guidelines.

Yahoo published the same requirements for bulk senders at the same time; its Sender Best Practices page is the source. Microsoft announced in April 2025 that domains sending more than 5,000 messages a day to consumer Outlook addresses must have SPF, DKIM and DMARC in place, with non-compliant mail routed to junk from 5 May 2025 and rejected later; the announcement is on the Microsoft Tech Community.

Two practical points about the threshold. It is measured per sending domain, and Google counts across all your mail streams, so a site that sends 4,000 newsletter emails and 1,500 transactional emails on a busy day is a bulk sender for that day. And there is no benefit in staying under it: the requirements are also simply what a well-configured domain looks like, and the cheapest time to meet them is before you have a reputation problem.

The requirements, one by one

1. SPF and DKIM, both

SPF (RFC 7208) is a DNS record on the domain in the message’s return path that lists the servers allowed to send for it. DKIM (RFC 6376) is a cryptographic signature added to each message, verified against a public key in DNS under <selector>._domainkey.<domain>. Bulk senders need both to pass. When you send through any platform, the platform’s servers do the signing and the sending; what you control is whether the keys and the return path are set up on your domain rather than the platform’s.

2. A DMARC record, and alignment

DMARC (RFC 7489) is a TXT record at _dmarc.<your domain>. The minimum the providers ask for is v=DMARC1; p=none, which changes nothing about delivery but declares a policy and lets you receive reports. The part people miss is alignment: the domain in the visible From header must match the domain that SPF or DKIM authenticated. If your From address is news@example.com but the DKIM signature is for the platform’s own domain and the return path is the platform’s too, DMARC fails even though SPF and DKIM individually passed. For email sent through a platform, DKIM alignment (a signature whose d= is your domain) is the one to get right; an aligned return path gives you SPF alignment as well.

3. One-click unsubscribe, RFC 8058

For marketing and subscribed mail, bulk senders must include two headers:

List-Unsubscribe: <https://example.com/unsubscribe?token=...>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

RFC 8058 defines how this works: the mailbox provider shows an unsubscribe button next to the sender’s name, and when the reader clicks it the provider sends an HTTP POST to that URL with the body List-Unsubscribe=One-Click. No page is shown to the reader, so the URL has to do the job on that POST alone, and it has to be safe against link scanners and prefetchers that follow every URL in a message with a GET. That is why the URL should carry a signed token and change state only on POST. There must also be a clearly visible unsubscribe link in the message body, and requests must be honoured within two days. A mailto: form of the header is allowed as well, but it is the HTTPS form together with List-Unsubscribe-Post that satisfies the one-click requirement.

4. Spam rate below 0.10%, never at or above 0.30%

Google measures the rate of user-reported spam per domain in Postmaster Tools and asks senders to stay below 0.10%, and never to reach 0.30%. Yahoo’s guidance is to keep complaints under 0.3%. These are low numbers. Three complaints in a thousand messages is enough to put you over the line, and the usual cause is not malice but an old list, a purchased list, or a signup form with no confirmation step that has been collecting other people’s addresses.

5. The rest

The remaining items are infrastructure: valid forward and reverse DNS (PTR records) for sending IPs, TLS for the connection, a From header that does not imitate gmail.com or yahoo.com, ARC headers if you forward mail on behalf of others, and standard formatting under RFC 5322. On a platform these are the platform’s responsibility. On your own server they are yours, and PTR records in particular are where self-hosted senders on cheap VMs fall down.

How to check your own headers

You do not need a tool to see most of this. Send yourself a campaign and look at the raw message.

Gmail: open the message, click the three-dot menu, then Show original. The summary at the top shows SPF, DKIM and DMARC as PASS or FAIL, with the domain each was checked against. Below, search the headers for List-Unsubscribe and List-Unsubscribe-Post. If the DKIM domain is not yours, alignment is your problem.
Outlook.com: open the message, click the three dots, then View > View message source. Look for Authentication-Results: near the top; it lists spf=, dkim= and dmarc= with the domains.
Apple Mail: View > Message > All Headers.

Then check DNS directly. From a terminal, dig TXT _dmarc.example.com shows your DMARC record, or its absence, and dig CNAME <selector>._domainkey.example.com shows whether the DKIM key is published. If you would rather not use a terminal, we are building a sender check that runs these lookups from a browser and reports alignment against a test message.

Finally, if you send to Gmail in any volume, register your domain in Postmaster Tools. It is free and it is the only place you can see the spam-rate figure Google is actually using.

What SendBeam sets automatically, and what it does not

Here is what a campaign or automation email sent from SendBeam carries, based on the code that sends it rather than on a feature list.

DKIM and an aligned return path for your domain. When you add a domain, SendBeam shows CNAME records: DKIM signing records and a return-path record on your domain. Once they resolve, mail is signed with d= your domain and the return path is on your domain, so both DKIM and SPF align with your From address. If your DNS is on Cloudflare, SendBeam writes the records for you from a one-time API token. See Sending domain.

Both RFC 8058 headers on every campaign and automation email. List-Unsubscribe points at a URL carrying a signed token bound to the contact and the campaign, and List-Unsubscribe-Post: List-Unsubscribe=One-Click is set alongside it. The unsubscribe URL changes state only on POST; a GET shows a confirmation page with a button, so link scanners cannot unsubscribe your readers by prefetching. The one-click POST is processed immediately, not queued, which is comfortably inside the two-day requirement.

A visible unsubscribe link. If a template does not include one, SendBeam adds one to the message body before sending. The same signed URL is used for the visible link and the header.

Bounces and complaints suppressed automatically. A hard bounce or a spam complaint adds the address to the workspace’s suppression list and it is not sent to again, including after a re-import. Only a hash of the address is kept once the contact is deleted.

Guardrails on your complaint and bounce rates. Over a rolling 30 days, SendBeam warns workspace admins when the complaint rate reaches 0.3% or the bounce rate reaches 5%, and pauses sending when complaints exceed 0.5% (once there is a meaningful sample) or bounces exceed 10%. The warning line is set at Google’s “never exceed” figure on purpose: by the time Gmail is unhappy, you should already have heard from us.

Double opt-in available on every list, and compulsory on Free. Confirmation is the single most effective thing you can do for your spam rate, because it stops other people’s addresses ever reaching your list.

Now the things SendBeam does not do, so you are not surprised.

It does not publish your DMARC record. DMARC belongs to your domain as a whole, covering your ordinary mail as well as SendBeam, so you add the _dmarc TXT record yourself. We recommend starting at p=none with a reporting address, moving to p=quarantine once you have confirmed everything aligns, and going to p=reject when you are confident. The docs page above has the record format.
On the Free plan, and before a domain is verified, mail goes from a shared SendBeam address. It is fully authenticated, so it meets the rules, but the reputation it builds is ours rather than yours, and the From address is not your domain. Verify your own domain before you send to a real audience.
Owner-notification emails from contact forms (the message a visitor writes to you) carry no unsubscribe headers, because they are not bulk mail and there is nothing to unsubscribe from.

A short checklist

Own domain verified, DKIM and return path resolving, From address on that domain.
_dmarc TXT record published, at least p=none with rua= so you receive reports.
Send yourself a campaign and confirm SPF, DKIM and DMARC all show PASS against your domain in Show original.
Confirm both List-Unsubscribe headers are present and that the visible link works.
Register in Google Postmaster Tools and look at the spam-rate graph once a month.
Switch on double opt-in for any list that collects addresses from a public form.

None of this is difficult, but all of it is invisible until something goes wrong. Ten minutes with Show original now is worth a great deal more than a week of wondering why open rates fell.