Gmail and Yahoo sender requirements for small businesses: what we found in 1,000 domains

Gmail and Yahoo both split their sender rules into two tiers. One set applies to anyone who emails their users. A stricter set applies to bulk senders, which Gmail defines as close to 5,000 messages a day to personal Gmail accounts. Most small businesses only fall under the first set.

We checked the public email records of 1,000 small businesses to see where they actually stand. About half had no DMARC record, which bulk senders need, and some showed no sign of the authentication every sender needs. The rest of this post covers what each provider requires, what the check found, and how to check your own domain.

What Gmail requires from every sender

Google’s email sender guidelines list requirements for all senders, whatever their volume. The authentication rule is one line: “Set up SPF or DKIM email authentication for your sending domains.”

The same list requires valid forward and reverse DNS for your sending domains or IPs, a TLS connection for sending, and messages formatted to the RFC 5322 standard. It also sets a complaint ceiling: “Keep spam rates reported in Postmaster Tools below 0.3%.”

Sending through a platform such as Mailchimp doesn’t take the authentication question off your plate. Google’s guidance for that case: “If you use an email service provider, verify that they authenticate your domain’s email with SPF and DKIM.”

What changes at 5,000 a day

Google’s sender guidelines FAQ defines the bulk tier: “A bulk sender is any email sender that sends close to 5,000 messages or more to personal Gmail accounts within a 24-hour period. Messages sent from the same primary domain count toward the 5,000 limit.”

Two details in that FAQ matter for a small business. The count only covers personal Gmail accounts: “The Email sender guidelines don’t apply to messages sent to Google Workspace accounts.” And crossing the line is permanent: “Senders who meet the above criteria at least once are permanently considered bulk senders.” A business that sends one big announcement to a list with 5,000 Gmail addresses on it is a bulk sender from then on, even if every other send that year is small.

Bulk senders take on these extra requirements from the guidelines:

• “Set up SPF and DKIM email authentication for your domain.” Both, where every sender needs only one.
• “Set up DMARC email authentication for your sending domain. Your DMARC enforcement policy can be set to none.”
• The From: domain has to match the SPF or DKIM domain, which is what DMARC calls alignment.
• “Marketing messages and subscribed messages must support one-click unsubscribe, and include a clearly visible unsubscribe link in the message body.”
• A lower spam target: “Keep spam rates reported in Postmaster Tools below 0.10% and avoid ever reaching a spam rate of 0.30% or higher.”

These rules took effect in February 2024, and enforcement is getting stricter. The FAQ says: “Starting November 2025, Gmail is ramping up its enforcement on non-compliant traffic. Messages that fail to meet the email sender requirements will experience disruptions, including temporary and permanent rejections.”

Yahoo and Outlook

Yahoo’s sender best practices use the same two tiers. For all senders: “Implement SPF or DKIM at a minimum” and a spam rate below 0.3%. For bulk senders, SPF and DKIM together, “Publish a valid DMARC policy with at least p=none - DMARC must pass”, one-click unsubscribe, and “Honor unsubscribes within 2 days”.

The difference is the threshold. Yahoo’s sender FAQ describes a bulk sender as one sending “a significant volume of mail” and then says: “We will not specify a volume threshold.” A small business has no way to know whether Yahoo counts it as bulk. If your list includes Yahoo and AOL addresses, meeting the bulk requirements is the only way to be sure you’re covered.

Microsoft announced its own version for Outlook in 2025. Its announcement says: “For domains sending over 5,000 emails per day, Outlook will soon require compliance with SPF, DKIM, DMARC.” Asked whether smaller senders need to bother, the same post answers: “While enforcement first targets large senders, all senders benefit from these best practices.”

What we found in 1,000 small-business domains

We wanted to know how many small businesses actually meet these rules, so we checked.

How we did it. On September 28, 2026, we drew a random sample of 1,000 website domains from the SBA’s public Small Business Search, 125 from each of eight states (two in each Census region: Pennsylvania, Massachusetts, Ohio, Minnesota, Georgia, Tennessee, Arizona, and Oregon). We kept only businesses that self-certify as small and list a website on a domain they control. Then we looked up each domain’s public DNS records: MX (mail servers), SPF, and DMARC. We sent nothing to any business, and we don’t name any of them. We later checked the same 1,000 businesses’ websites; that study is in small business website mistakes, measured.

Of the 1,000 domains, 61 no longer resolved in DNS, 76 had no mail servers, and 5 returned lookup errors. That left 857 domains with mail servers set up, which is how we counted a business as using its domain for email. The percentages below are out of those 857.

What we checked	Share of 857 email domains
Has an SPF record	89.6%
Has a DMARC record	49.5%
Has both SPF and DMARC	47.4%
Has neither	8.3%
DMARC set to quarantine or reject	18.7%
Publishes more than one SPF record	2.7%

Half have no DMARC record at all. 433 of the 857 domains had none. Under Gmail’s rules that’s fine for a business sending fewer than about 5,000 messages a day to personal Gmail accounts, and a problem for any business that has ever crossed that line. With Yahoo, nobody outside Yahoo knows where the line is.

Most DMARC records are monitor-only. Of the 424 domains with a DMARC record, 62.0% used a policy of p=none, 24.5% used quarantine, and 13.2% used reject. The DMARC standard, RFC 7489, defines none this way: “The Domain Owner requests no specific action be taken regarding delivery of messages.” That meets Gmail’s bulk rule, but it asks receivers to take no action on mail that fails, including mail someone else sends using your domain. Yahoo’s FAQ is direct about that case: “If you have a spoofing problem, you should be implementing a DMARC enforcement policy (p=quarantine or p=reject) regardless.”

Google Workspace domains had the biggest gaps. We sorted domains by who runs their mail, based on the MX records. Microsoft 365 handled 296 of them and Google Workspace 270. Of the 89 domains with no SPF record at all, 62 ran their mail through Google Workspace.

Mail provider	SPF record	DMARC record
Microsoft 365 (296 domains)	98.6%	54.7%
Google Workspace (270 domains)	77.0%	41.1%

We also checked Google Workspace domains for a DKIM key at Google’s default selector. Google’s DKIM setup guide says: “The default prefix selector is google.” Of the 270 Workspace domains, 61 (22.6%) had no SPF record and no DKIM key at that selector. A business can choose a custom selector, which our check can’t see, so 22.6% is a ceiling. Any business in that group without a custom key is missing the one authentication rule Gmail applies to every sender.

Some SPF records break themselves. 23 domains (2.7%) published two or more SPF records. The SPF standard, RFC 7208, is clear about the result:

If the resultant record set includes more than one record, check_host() produces the “permerror” result.

The same standard defines permerror as meaning “the domain’s published records could not be correctly interpreted.” Those 23 businesses have SPF records, but the records don’t work.

What this sample can’t tell you. Businesses in the SBA’s database registered there to pursue federal contracts, so they may differ from small businesses in general. We checked eight states, not all fifty. We counted DKIM only where the provider has a known default location for the key. And DNS records show setup, not how any email actually performed.

What this means if you send fewer than 5,000 a day

If your business sends a few hundred emails a day and your list is mostly Gmail, the rule you have to meet today is SPF or DKIM on your domain and a low spam rate. In our sample, 10.4% of small-business email domains had no SPF record.

DMARC is optional at your volume under Gmail’s rules. Google still recommends it for everyone: “To improve email delivery, we recommend that you always set up SPF, DKIM, and DMARC for your domains.” Two practical reasons back that up. Yahoo’s threshold is unpublished, so you can’t be sure you’re under it. And a single large send to a Gmail-heavy list makes you a bulk sender for good, at which point DMARC, alignment, and one-click unsubscribe all become requirements at once.

A DMARC record at p=none asks receivers to take no specific action on mail that fails. What it adds is reporting, if the record includes a report address. Of the 424 domains in our sample with DMARC, 59.0% had one.

Check your own domain in ten minutes

1. Look up your records. Google’s free Dig tool shows any domain’s public DNS records. Choose TXT and enter your domain. You should see exactly one record starting with v=spf1. If you see two, merge them into one.
2. Look up DMARC. In the same tool, choose TXT and enter _dmarc followed by your domain, such as _dmarc.example.com. You’re looking for a record starting with v=DMARC1. Note the p= value: none, quarantine, or reject.
3. Check a real message. Send an email from your business address to a personal Gmail account. Open it there and use Show original. Google’s DKIM guide says to “look for Authentication-Results” in the header, and that “the DKIM results should say something like DKIM=pass or DKIM=OK.”
4. Ask your email platform. If a platform sends your newsletters, find its domain authentication setting and confirm it signs mail with your own domain.
5. Count your Gmail volume. If a single send could reach close to 5,000 personal Gmail addresses, plan for the bulk requirements now, before that send goes out.

When it’s worth getting help

For a business with one mail provider and nothing else sending as its domain, this is a short DNS job. It gets harder when several tools send as your domain, such as a CRM, a booking system, a newsletter platform, and a website form, and each one has to fit into a single SPF record and sign with DKIM. Microsoft’s FAQ on the Outlook rules flags one limit that catches people here: “If you exceed 10 DNS lookups, your SPF check might fail.” The usual practice before moving from p=none to quarantine is to read the DMARC reports first, so real mail from one of those tools doesn’t land in spam.

If you’d rather have someone else sort it out, authentication is the first thing we check in our email marketing work.