Exactly what Gmail, Outlook and Yahoo require

All three ask for essentially the same thing: SPF, DKIM, DMARC (p=none is enough) and a From domain aligned with either the SPF domain or the DKIM domain. The threshold at which that stops being a recommendation and becomes a condition of delivery is 5,000 messages a day to consumer accounts, and here is the small print that breaks architectures: subdomains count towards it.

The other figure worth memorising is the 0.30 per cent complaint rate. It is not a warning, it is a door: cross it and Google declares you ineligible for delivery mitigation, and you only regain eligibility after seven consecutive days below the line.

The threshold: 5,000 a day, and subdomains count

Three qualifications that change the design of any sending infrastructure. First: messages sent from subdomains count towards the main domain's threshold, so slicing your sending into news1, news2 and news3 to stay under 5,000 does not work and never has. Second: the count is against personal accounts at that provider, not against the total size of your list. And third, the one that surprises people most: once you cross the threshold, you are a bulk sender permanently. Microsoft says so explicitly for Outlook.com: past 5,000 messages with the same domain in the From, every subsequent message must comply.

The three of them side by side

The arithmetic of 0.30 per cent

Google publishes three tiers, and it is worth translating them into people, because as percentages the margin is invisible:

That is the figure that changes the conversation: the margin between "this is going well" and "you are out" is ten annoyed people. And there are two definitional details almost nobody takes into account. The first: the rate measures manual marking only, literally the percentage of your messages that recipients mark as spam by hand in Gmail, so automatic filtering never appears in it. You can have an immaculate rate and still be landing in the junk folder. The second: the denominator is mail delivered to the inbox, not mail sent, something Yahoo states explicitly, and it is why the number never matches what your sending tool reports.

What changed, and when

What Google requires that is not authentication

Half the published requirements are not about cryptography but about format and honesty, and those are the ones most often broken by accident:

• Format compliant with RFC 5322, with a valid Message-ID on every message.
• The From header must carry a single email address.
• No subject line or content stuffed into the sender display name, and no emoji or non-standard characters in it.
• No hiding content with HTML and CSS. Links in the body have to be visible and understandable.
• Valid and consistent reverse DNS (PTR) for the sending domains or IPs.
• TLS on the connection, since December 2023.

What you will not find in any of the three official guides is a list of forbidden words. There is none. At Gmail, Outlook and Yahoo the decision is made by the aggregate behaviour of thousands of recipients, not by a dictionary. Where words do score points is in the rule-based filters sitting behind a great deal of Spanish hosting, and that is solved by the structure of the message, not by synonyms.

One-click unsubscribe, in two sentences

List-Unsubscribe: <https://empresa.es/u/8f3a1c9e-4b2d-4f77-9c1a-2b8e5d0f7a63>, <mailto:baja@empresa.es?subject=unsubscribe>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

Google and Yahoo allow a maximum of two days to process an unsubscribe. In Spain there is a separate and older obligation on top: the LSSI (Ley 34/2002, Spain's information society services and e-commerce act) requires a valid electronic address at which the recipient can object, and expressly prohibits sending commercial communications that do not include one. They are two different duties and you have to meet both. The exact implementation, including the GET trap set by security scanners, is covered in the one-click unsubscribe guide.

How to check whether you comply

1. Register the root domain and each sending subdomain separately in Google Postmaster Tools, and do it before your first send so you have a baseline. The compliance status panel is binary and does not argue.
2. Watch the delivery errors panel: it moves before the spam rate does and is the early warning of a block.
3. If you have your own IP, request SNDS access and sign up for JMRP, both of which are per IP. At Yahoo the complaint feedback loop is per DKIM domain.
4. Check alignment in a real message from each flow, by reading the Authentication-Results header. Green records do not prove alignment.
5. Keep the Postmaster Tools volume floor in mind: with little traffic to Gmail you will see no data, because Google hides it to protect user privacy.

Meeting this list comes down, in practice, to two jobs. The first is publishing the three records and getting them to align, which is what the guide to SPF, DKIM and DMARC explains. The second is raising your DMARC policy without losing deliveries along the way, and that has its own runbook in the guide to raising DMARC without breaking anything, rewritten after the May 2026 revision.