Google, Yahoo and Microsoft Email Rules: What Small Businesses Need to Know

Gmail, Yahoo and Outlook between them handle a huge share of your customers’ email, and they now reject messages that don’t follow their rules. Setups that worked fine for years can suddenly start bouncing or landing in spam.

The rules are aimed mainly at big senders, but some apply to every business, and small businesses are often caught out by the parts nobody told them about. This guide explains what the rules are, who they apply to, and what you should check.

In 2024, Google and Yahoo introduced new requirements for anyone sending email to Gmail and Yahoo addresses. Microsoft followed in 2025 for Outlook.com, Hotmail and Live addresses.

The aim is to cut spam and scams by making it harder to send email pretending to be someone else. Enforcement has tightened over time: messages that break the rules are now increasingly rejected outright rather than just filtered, and Google stepped up rejections from late 2025.

Whatever your size, if you email Gmail users, Google expects you to:

• authenticate your email with SPF or DKIM (ideally both)
• send through a properly configured mail server, with a secure (encrypted) connection
• keep your spam complaint rate low — Google says below 0.3%, and ideally under 0.1%
• not pretend to be sending from a Gmail address when you’re not

If you use Google Workspace or Microsoft 365, the server side is handled for you. Authentication is not always: DKIM in particular often has to be switched on by hand. My guide on how to check your email is set up correctly shows you how to see whether yours is working.

If you send 5,000 or more emails a day to Gmail, Yahoo or Outlook.com addresses, stricter rules apply:

• SPF and DKIM must both be set up and pass
• you must have a DMARC record (a monitoring-only policy is enough to start with)
• the address in your “From” line must match the domain that passes those checks
• marketing emails must offer one-click unsubscribe, and unsubscribes must be honoured within two days

Google counts everything sent from your domain, not just one campaign, and once you’ve been treated as a bulk sender you stay one.

Most small businesses aren’t bulk senders, but that doesn’t mean the rules don’t affect you:

• The “everyone” rules still apply, and missing DKIM or a broken SPF record is enough to send you to spam or get you rejected.
• Newsletters count. A single newsletter to a big mailing list can push your domain over the bulk threshold for that day.
• Other systems count too. Your website, invoicing software and booking system all send as your domain. If any of them isn’t authenticated, those emails are the ones that fail. My guide on contact forms that stop sending is a common example.
• Providers are steadily raising the bar. What’s only recommended for small senders today is often required tomorrow.

Emails that break the rules may be:

• delayed while the receiving server decides what to do
• sent to spam
• rejected, often with a bounce message mentioning authentication, SPF, DKIM or DMARC

The last one is easy to miss if nobody reads the bounce messages. As I explain in why “it sent” doesn’t mean “it arrived”, problems like this can go unnoticed for months.

• SPF — one record, including every service that sends email for you
• DKIM — switched on at your email provider and at every other sending service
• DMARC — a record in place, at least in monitoring mode, with reports going somewhere you’ll see them
• Newsletters — sent through a proper email marketing service, with one-click unsubscribe, only to people who’ve agreed to hear from you
• Spam complaints — keep your lists clean, and if you send in volume, sign up to Google Postmaster Tools to keep an eye on your complaint rate

My plain-English guide to SPF, DKIM and DMARC explains the first three.

The quickest way to see where you stand is to send an email to a Gmail address, choose “Show original”, and check that SPF, DKIM and DMARC all say PASS. If they do, you’re in good shape for the “everyone” rules. If your emails are already going missing, start with my spam diagnostic checklist.

If you’re not sure, or you send newsletters and want to be certain you’re compliant, I can check your setup across the big providers and fix anything that falls short.

To move your DMARC policy beyond p=none safely, see what DMARC reports tell you.

Need help fixing this?

I provide:

• Free initial assessment
• Clear explanation of the issue
• Fixed-price solutions
• UK-based support

If you’re not sure whether your email meets the new rules, I can check it and fix whatever needs fixing.