email

Email Authentication Requirements in 2026: SPF, DKIM, DMARC, BIMI and the Enforcement Timeline

By Art Kukharenko · Published · Updated

Browse email resources

In 2026 every sender needs SPF or DKIM, and bulk senders (about 5,000 or more messages a day) need both, a published DMARC policy with an aligned From domain, and RFC 8058 one-click unsubscribe on marketing mail. Gmail and Yahoo began enforcing in February 2024, Outlook.com in May 2025, and Gmail stepped up enforcement in November 2025. The DMARC specification itself was replaced by RFC 9989 in May 2026.

Who this is for: deliverability owners, security engineers and platform architects who need the requirements, the fix order and the usual causes of rejection. Part of the email and activation infrastructure hub; for context, see MailOps in 2026.

The enforcement timeline

Scroll horizontally to compare all columns ↔

Comparison — source references are listed below
DateProviderWhat changedSource
1 Feb 2024GoogleRequirements take effect for all senders; stricter rules for senders of about 5,000+ messages a day to personal Gmail accounts12
Feb 2024YahooEnforcement begins, rolled out gradually3
Jun 2024Google, YahooOne-click unsubscribe deadline for senders that already had an unsubscribe link (Google: 1 June 2024); Yahoo list-unsubscribe enforcement; Gmail bulk senders above 0.3% user-reported spam become ineligible for mitigation23
5 May 2025MicrosoftOutlook.com enforces SPF, DKIM and DMARC for domains sending over 5,000 emails a day; non-compliant mail goes to junk, with rejection to follow5
Nov 2025GoogleGmail "ramping up" enforcement on non-compliant traffic, with temporary and permanent rejections; new domains on an accelerated timetable2
May 2026IETFDMARCbis published as RFC 9989, obsoleting RFC 748910
PendingGooglePostmaster Tools v1 reputation dashboards being retired in favour of v2; no date published18

Requirements by provider

Scroll horizontally to compare all columns ↔

Comparison — source references are listed below
RequirementGmailYahooOutlook.comiCloud Mail
Bulk definitionAbout 5,000+ messages in 24 hours to personal Gmail; subdomains count toward the primary domain; status is permanent 2"Significant volume", no threshold published; assessed per domain 35,000+ messages to Outlook.com, Hotmail, Live or MSN with the same 5322.From domain 4No number on the page opened 6
SPF and DKIMSPF or DKIM for all; both for bulk 1SPF or DKIM for all; both for bulk 3SPF and DKIM must pass 4Authenticate with SPF and DKIM 6
DMARCBulk: required, p=none allowed 1Bulk: at least p=none 3Record at _dmarc, e.g. p=none; must pass 4Sending domain must publish a policy 6
AlignmentOrganisational From domain aligned with SPF or DKIM domain 2From domain aligned; relaxed accepted 3SPF or DKIM aligned with 5322.From 4Not stated
One-click unsubscribeMarketing and subscribed mail, not transactional; RFC 8058; one HTTPS URL; 48-hour honouring recommended 2Marketing mail; RFC 8058 "highly recommended"; honour within 2 days 3Not stated on pages openedUnsubscribe link, honoured "immediately" 6
Spam rateBelow 0.10%; never 0.30% 2Below 0.3% 3Not statedNot stated
DNS and transportForward and reverse DNS; TLS 1Forward and reverse DNS 3Not statedReverse DNS; consistent IPs and domains 6
Failure mode4.7.x temporary, 5.7.x permanent errors 2Gradual enforcement 3Junk, then 550 5.7.515 rejection 45Rejection if requirements are not met 6

SPF: configuration and the lookup limit

SPF lists the servers allowed to send for the envelope (MAIL FROM) domain. Subdomains do not inherit the parent's record, so each sending subdomain needs its own 20.

Configuration checklist

  • Publish exactly one v=spf1 record per sending domain; two valid records produce a permerror (RFC 7208 §4.5) 8.
  • Stay within ten DNS-querying terms (include, a, mx, ptr, exists, redirect) and two void lookups, or evaluation returns permerror (§4.6.4) 8.
  • Do not publish ptr (§5.5) 8.
  • Start with ~all while you inventory senders, then move to -all, as Microsoft's documentation suggests 20.

SPF is the weaker leg of DMARC. It breaks on forwarding, because the forwarder is not authorised, and many email service providers send with their own bounce domain 2011.

DKIM: key length, selectors and rotation

DKIM signs selected headers and the body with a private key, and receivers verify with a public key published under a selector.

DMARC: policies, alignment and what RFC 9989 changed

DMARC tells receivers what to do when mail claiming your From domain fails both aligned SPF and aligned DKIM, and where to send reports. Google's guidance is to start with p=none, read the reports, and tighten over time 12.

Scroll horizontally to compare all columns ↔

Comparison — source references are listed below
PolicyWhat receivers doWhen it fitsConstraints
p=noneDeliver and reportInventory phase; satisfies the Gmail, Yahoo and Outlook.com bulk minimum 134No spoofing protection; BIMI does not accept it 1314
p=quarantineTreat failures as suspicious, typically spamAfter reports show legitimate sources alignRequired for BIMI 13; Gmail plans quarantine for mail impersonating Gmail From headers 1
p=rejectRefuse failures 12Stable domains with every sender inventoriedA forgotten sender stops delivering; forwarders and lists need care

Practical rules:

  1. Alignment is the point. A message passes if aligned SPF or aligned DKIM passes. Relaxed alignment (the default) allows subdomain matches; strict needs exact matches 12. Align DKIM for every sender.
  2. Third-party senders need setup. Mailjet notes that by default SPF authenticates against its bounce domain, so it does not align and DMARC passes through DKIM unless you request a custom return path 11. Expect the same elsewhere.
  3. Always publish rua. Google recommends it and says Gmail does not support ruf 12; under RFC 9989, without rua receivers must not generate aggregate reports 10.
  4. Set sp and np deliberately. Subdomains inherit p unless sp is set 12; RFC 9989 adds np for non-existent subdomains 10.

BIMI, VMC and CMC

Brand Indicators for Message Identification shows a verified logo beside authenticated mail. Requirements as of 2026-10-17:

  • DMARC at enforcement. The BIMI Group says the policy must be at enforcement on the organisational domain and subdomains, quarantine or reject; "none" policies or pct below 100 are not accepted 13. Google gives the same rule 14. Yahoo requires quarantine or reject as well 16.
  • Logo. An SVG in the Tiny PS profile 13. Gmail adds absolute pixel sizing, at least 96 by 96 pixels, 32 KB or less recommended, HTTPS hosting and PEM-based records 14.
  • Certificate. Gmail requires a Verified Mark Certificate (VMC, recommended, tied to a trademarked logo) or a Common Mark Certificate (CMC); an SVG-only record is not supported in Gmail 14. The BIMI Group describes CMCs as used in place of trademarked logos, with some limitations 13. Gmail shows a checkmark for VMC senders; its page does not say whether CMC also earns it 14. Yahoo does not require a VMC 16.
  • DNS record. A TXT record at default._bimi.example.com; logos can take up to 48 hours to appear in Gmail 1315. Yahoo shows logos only for bulk senders with enough reputation and engagement 16.

One-click unsubscribe (RFC 8058)

Marketing and subscribed messages need one-click unsubscribe at Gmail and Yahoo; transactional mail is excluded 23. RFC 8058 defines it 7:

List-Unsubscribe: <https://mail.example.com/u/OPAQUE-ID>, <mailto:unsubscribe@example.com>
List-Unsubscribe-Post: List-Unsubscribe=One-Click
  • The List-Unsubscribe header must contain one HTTPS URI and may add others such as mailto; the URI should carry an opaque, hard-to-forge identifier 7.
  • Both headers must be covered by the DKIM signature 7.
  • The endpoint must accept a POST with body List-Unsubscribe=One-Click, must not redirect, and must not need cookies or authorisation 7.
  • Gmail says a mailto or landing-page link alone does not satisfy the rule 2.

Unsubscribes must reach every sending system; see Consent Withdrawal Across Channels.

Common misconfigurations

Scroll horizontally to compare all columns ↔

Comparison — source references are listed below
MistakeSymptomFix
More than ten SPF lookups, or two SPF recordsSPF permerror; Gmail 5.7.27 28One record; consolidate includes; split streams across subdomains
SPF passes, DMARC failsGmail 4.7.32 or DMARC fail in reports 2Align DKIM d= with the From domain; use a custom return path where offered
Weak or old DKIM (sha1, under 1,024 bits)DKIM fail; Gmail 5.7.30 29Re-key at 2,048 bits with rsa-sha256
No PTR record or mismatched forward DNSGmail 5.7.25 2Set forward-confirmed reverse DNS on every sending IP
DMARC left at p=none for yearsNo protection; BIMI ineligible 13Move to quarantine after reports are clean

Monitoring

  • DMARC aggregate reports show every source claiming your domain, with pass and fail by alignment 1012.
  • Google Postmaster Tools offers Compliance status, Spam rate, Authentication, Encryption, Delivery errors, IP and Domain reputation and Feedback Loop; data is typically updated within 24 hours and low-volume days may be missing 17. Google says Domain and IP reputation dashboards are being retired in favour of a new reputation dashboard 18.
  • Microsoft SNDS is free and offers IP-level data and the Junk Email Reporting Program; access expires 10 months after approval unless re-attested 19.

For reading these signals together, see Inbox Placement vs Delivery Rate; for stream separation, Transactional vs Marketing Mail Separation; for running your own sending layer, Self-Hosted Email Marketing Platforms Compared.

Checklist: authentication in the right order

  • Inventory every system that sends as your domain, including CRM, support desk and billing.
  • Set forward-confirmed reverse DNS and TLS on every sending IP.
  • Publish one SPF record per sending domain; stay under ten lookups.
  • Sign with DKIM at 2,048 bits using your own domain as d=.
  • Publish _dmarc with p=none and a working rua; review reports for several weeks.
  • Fix misalignment, then move to p=quarantine, then p=reject where mail flows allow.
  • Add RFC 8058 headers to marketing mail and include them in the DKIM h= list.
  • Keep user-reported spam under 0.10 percent in Postmaster Tools; register in Microsoft SNDS; add BIMI only after DMARC enforcement and a certificate.

If you need the sending layer, consent state and audit trail under your own control, begin with the deployment qualification. Back to the email hub.

Frequently asked questions

What are the email authentication requirements for 2026?

All senders need SPF or DKIM, valid DNS and TLS. Bulk senders, roughly 5,000 or more messages a day, need SPF and DKIM, DMARC with an aligned From domain, and one-click unsubscribe on marketing mail. Gmail and Yahoo started in February 2024, Outlook.com in May 2025, and Gmail increased enforcement in November 2025.

Do I need DMARC p=quarantine or p=reject for Gmail and Yahoo?

No. Gmail and Yahoo accept p=none for bulk senders as long as DMARC passes through alignment. Enforcement policies add spoofing protection and are required for BIMI, so do not leave a domain at p=none indefinitely.

What are Microsoft's Outlook sender requirements and what is 550 5.7.515?

Domains sending 5,000 or more messages a day to Outlook.com, Hotmail, Live or MSN must pass SPF and DKIM and publish a passing DMARC record, with enforcement from 5 May 2025. Error 550 5.7.515 means the sending domain did not meet the required authentication level.

What counts as a bulk sender at 5,000 messages?

For Gmail it is close to 5,000 messages in 24 hours to personal Gmail accounts, counted across subdomains of one primary domain, and permanent once reached. Microsoft counts messages to its consumer domains from one From domain. Yahoo publishes no number and judges per domain.

What is BIMI and do I need a VMC?

BIMI displays your verified logo in supporting mailboxes. It needs DMARC at quarantine or reject with pct 100, an SVG Tiny PS logo and a TXT record. Gmail also requires a VMC or CMC certificate; Yahoo does not require one. BIMI is optional and does not fix deliverability.

How do I set up one-click unsubscribe under RFC 8058?

Add List-Unsubscribe with an HTTPS URL and List-Unsubscribe-Post: List-Unsubscribe=One-Click, and include both in the DKIM signature. The endpoint must accept a POST, not redirect, and work without cookies. Process requests within 48 hours at Gmail and two days at Yahoo.

Did DMARC change in 2026?

Yes. The IETF published DMARCbis as RFC 9989 in May 2026, obsoleting RFC 7489. It removes pct, rf and ri, adds t, np and psd, and replaces the Public Suffix List with a DNS Tree Walk. Mailjet notes the aligned SPF or DKIM model is unchanged.

Sources

  1. Google, Email sender guidelines Open source
  2. Google, Email sender guidelines FAQ Open source
  3. Yahoo, Sender best practices and FAQs Open source · Additional source
  4. Microsoft, Fix NDR error 550 5.7.515 in Outlook.com Open source
  5. Microsoft, Outlook.com sender support (postmaster) Open source
  6. Apple, iCloud Mail bulk sender requirements Open source
  7. IETF, RFC 8058, Signaling One-Click Functionality for List Email Headers Open source
  8. IETF, RFC 7208, Sender Policy Framework Open source
  9. IETF, RFC 8301, Cryptographic Algorithm and Key Usage Update to DKIM Open source
  10. IETF, RFC 9989, DMARC (May 2026) — ; status page Open source · Additional source
  11. Sinch Mailjet, DMARCbis analysis (1 June 2026) Open source
  12. Google, Set up DMARC Open source
  13. BIMI Group, Implementation guide Open source
  14. Google, Set up BIMI Open source
  15. Google, Add a BIMI TXT record Open source
  16. Yahoo, BIMI Open source
  17. Google, Postmaster Tools dashboards Open source
  18. Google, Deprecation of the old Postmaster Tools interface Open source
  19. Microsoft, Smart Network Data Services Open source
  20. Microsoft Learn, How email authentication works in Microsoft 365 (updated July 2026) Open source

Put this evaluation into practice.

Assess your deployment requirements

Further reading

Published: · Updated:

Publication date recorded for the approved release. Editorial updates do not establish legal approval or a customer result.

Need help?

Ask the PrivyCDP Assistant