Gmail, Yahoo and Outlook sender requirements checker

What the big mailbox providers now require

Since February 2024, Google and Yahoo require anyone sending 5,000 or more emails a day to their users to have SPF and DKIM set up, a DMARC record (monitoring mode is enough to start), a one-click unsubscribe link on marketing email, and a spam complaint rate under 0.3%. Since late 2025 Gmail rejects non-compliant bulk mail outright rather than filtering it. Microsoft added the same authentication rules for Outlook.com, Hotmail and Live addresses from May 2025; mail that fails them is bounced with the code 550 5.7.15. Smaller senders are not exempt in practice: every provider still expects SPF or DKIM on every message, and the same three settings decide whether a small business's invoices and replies are trusted.

What this check can and cannot tell you

It reads the three settings the rules are built on: your list of approved senders (SPF), your digital seal (DKIM) and your instructions for fake email (DMARC), and it tells you whether each one is present, valid and aligned with the address people see. It cannot see how many emails you send, your spam complaint rate, or whether your marketing emails carry an unsubscribe link, because none of that is published in DNS. For those, use Google Postmaster Tools and your email provider's own reports.

What to do if something fails

Each problem in the result comes with a plain-English explanation and a step-by-step fix for wherever your domain is managed, with the exact values to copy. Fix the items marked "Fix first", run the check again, and you are compliant on the parts you control. If you want to know the day a setting breaks again, a paid plan re-checks your domain and emails you.

Problems this finds

One service on your list of approved senders didn't respond

When we checked, one service on your list gave no answer. It may be a temporary glitch, but if it stays broken, emails sent through that service may not be treated as approved.

Your email's digital seal has been switched off

The seal was deliberately withdrawn, which is normal when replacing it. But if your emails still use it, they fail the check and are more likely to land in spam or be rejected.

Your email's digital seal could be upgraded to a stronger one

It works today and receivers accept it. Stronger seals are now the standard, so switching the next time you're making changes is a small, sensible upgrade.

Your email's digital seal is too weak to trust

It uses an outdated, short code that can be cracked, which would let scammers make fake emails look sealed by you. Some receivers already refuse it. Your email provider can issue a stronger one.

Your email's digital seal is damaged and can't be read

The setting was likely cut short or had spaces added when it was pasted. Every email sealed with it fails the check, and nothing warns you because your provider thinks it's working.

Your email's digital seal is still marked as a test

Receivers are told they may ignore failures of your seal, which weakens the protection it gives. If your seal is working, removing the test marker is a quick change.

Your instructions for fake emails only cover some of them

Receivers apply your instructions to only a share of fake emails. That's normal while testing. Once you're confident, covering all of them finishes the job.

Fake emails pretending to be you are still delivered

Your instructions for fake emails are set to watch only. That's the right first step, but fakes in your name still get through. Once your real emails are confirmed to pass, you can tell receivers to block fakes.

Your instructions for fake emails have a typo

Receivers can't read them, so they may throw them out entirely. Fake emails in your name then aren't blocked, even though your settings look like they should be.

You're not getting reports on who sends email as you

Without reports you can't see which services send in your name, or know when it's safe to start blocking fakes. Adding an address for reports doesn't change how your email is delivered.

Your instructions for fake emails use the standard matching setting

Emails from variations of your address, like news.yourbusiness.com, count as yours. This is the default and suits most businesses. Nothing to do.

Your reports are going somewhere that hasn't agreed to accept them

Your reports are addressed to another domain that hasn't confirmed it accepts them, so receivers quietly don't send them. The fix is made on that other domain; if it's a reporting service, ask them.

An old, unused copy of your approved senders list is still there

Receivers ignore it, so it doesn't affect your email today. Removing it is a small tidy-up that avoids confusion the next time someone edits your domain's settings.

Your instructions for fake emails are being ignored

You have two sets of instructions where only one is allowed, so receivers ignore both. Any protection you set up is effectively switched off, and your reports stop arriving.

You have two lists of approved senders, which cancels both out

Only one list is allowed. With two, receivers ignore both, so every email you send fails this check and is more likely to land in spam or be rejected.

We couldn't find your email's digital seal where we usually look

It may be set up under a name we can't see, which is common. If it truly is missing, forwarded emails are more likely to fail checks. Your email provider can tell you which is the case.

We found no digital seal under the name you gave us

Emails sealed under this name can't be verified, so they fail this check and are more likely to land in spam. The setting may be missing, misspelled, or replaced by your provider.

Nothing tells receivers to block fake emails pretending to be you

Without instructions for fake emails, scammers can email your customers in your name with nothing from you standing in the way, and you get no reports showing who is sending as you.

You have no list of approved senders

Receivers can't check that your emails come from services you actually use, so invoices and replies are more likely to be treated with suspicion. Gmail, Yahoo and Outlook expect businesses to have one.

Your list of approved senders has a typo in it

Part of the list isn't written correctly. Some receivers ignore the whole list when that happens, so the same email can pass at one company and fail at another.

Your list of approved senders points to services that no longer exist

These dead entries use up space on your list. If there are more than two, receivers treat the whole list as broken for every email you send.

Your list of approved senders doesn't turn anyone away

It says who may send as you but takes no position on everyone else, so receivers treat it much like having no list. A one-word change at the end makes it count.

Your settings approve anyone in the world to send email as you

Your list of approved senders ends with a setting that approves every server on the internet. Scammers can send email in your name and it will pass this check. That is worse than having no list at all.

Your list of approved senders is over its limit

Receivers stop reading a list that points to too many services, and then treat the whole list as broken. That affects every email you send, not just the ones from the last services listed.

Some services on your list of approved senders are being ignored

A service was added after the list's closing entry, and receivers stop reading there. Emails sent through that service aren't approved and may land in spam or be rejected.

Your list of approved senders doesn't say what to do with everyone else

It names who may send as you but never says that others may not, which weakens the protection it's meant to give. Adding a short ending to the list fixes it.

Your list of approved senders is close to its limit

Nothing is broken today, but a change made by one of the services you use could push it over and break the list for every email you send. Removing services you no longer use gives you room.

Your list of approved senders uses an outdated method

One entry uses an old, slow method that some receivers skip. Replacing it is a minor clean-up that makes your list more reliable and frees up room under its limit.

Fakes from addresses like billing.yourbusiness.com aren't blocked

Your main address is protected, but variations of it have weaker instructions. Scammers can invent one (it doesn't need to exist) and use it to send fake emails in your name.

Common questions

Do the Gmail and Yahoo rules apply to a small business?

The strict rules (DMARC required, one-click unsubscribe, spam rate limits) apply to senders of 5,000 or more emails a day. But every sender, at any volume, is expected to have SPF or DKIM, and Gmail and Outlook use the same three settings to decide whether a small business's email is trusted. A business sending 40 invoices a week with a broken SPF record still lands in spam.

My emails to Outlook bounce with 550 5.7.15. What does it mean?

Microsoft rejected the message because your domain failed its authentication requirements: SPF, DKIM and a DMARC record with at least a monitoring policy, all aligned with the address in the From line. Run the check above; the result names which of the three is missing or broken and how to fix it.

Is monitoring mode (p=none) really enough for DMARC?

For compliance, yes: Google, Yahoo and Microsoft all accept p=none as a starting point. For protection against fake email in your name, no: p=none tells receivers to deliver fakes and only report them. Start at none so nothing legitimate is blocked, then tighten to quarantine once you know every service that sends for you is authenticated.