What do Gmail, Yahoo and the new DMARC standard require in 2026?

Two separate things happened, and they often get blended into one story.

Gmail and Yahoo's bulk sender rules have been in force since February 2024, and Gmail has been enforcing them more strictly since November 2025. Separately, in May 2026 the IETF published a new version of the DMARC standard. Mixing them up leads start-ups to chase deadlines that do not exist while missing the problem that actually breaks delivery.

Key takeaways

• The rules are the same, enforcement is tougher. Gmail and Yahoo still require authentication, a DMARC record, one-click unsubscribe and a low spam rate. Since November 2025, Gmail rejects more non-compliant mail.

• DMARC was updated in May 2026 (RFC 9989), replacing RFC 7489. The pct, rf and ri tags are gone, and np, psd and t are new.

• Your existing record still works. v=DMARC1 is unchanged, and neither Gmail nor Yahoo requires the new tags.

• p=none meets the requirement. Moving to quarantine or reject is good security practice, not a compliance rule.

• Alignment is where most setups fail. SPF and DKIM can pass without matching the domain your subscribers see.

Why do mailbox providers care so much about authentication?

Because it works. Google says that after it started requiring some form of authentication on mail sent to Gmail addresses, the number of unauthenticated messages its users received dropped sharply:

That 75% drop is why the 2024 bulk sender rules exist, and why enforcement keeps tightening.

What do Gmail and Yahoo actually require?

Gmail defines a bulk sender as anyone sending close to 5,000 or more messages a day to personal Gmail accounts. Yahoo applies similar rules to bulk senders. Here is what each asks for:

Gmail's own guidance reads: "Keep spam rates reported in Postmaster Tools below 0.10% and avoid ever reaching a spam rate of 0.30% or higher." Those numbers are Gmail's. Other providers set their own thresholds.

These rules only apply to personal Gmail accounts, not Google Workspace accounts.

What changed in November 2025?

Not the rules, but the consequences. Gmail's sender guidelines FAQ says: "Starting November 2025, Gmail is ramping up its enforcement on non-compliant traffic." Mail that fails the requirements can now see temporary and permanent rejections, not just spam folder placement.

Gmail also added a Compliance status dashboard to Postmaster Tools, which is the quickest way to see where you stand.

What does one-click unsubscribe look like?

It is two email headers, defined in RFC 8058. Your email platform usually adds them for you, but it is worth checking a sent message's headers:

List-Unsubscribe: <https://example.com/unsubscribe/7f3a9c2e>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

The first header gives the unsubscribe link. The second tells the mailbox provider it can unsubscribe the person with a single POST request, without opening a web page.

What did the May 2026 DMARC update change?

The IETF published three new standards in May 2026, often called DMARCbis:

• RFC 9989: the DMARC protocol itself, replacing RFC 7489 and RFC 9091

• RFC 9990: aggregate reporting

• RFC 9991: failure reporting

The record tags changed like this:

The v=DMARC1 version tag is unchanged, so existing records keep working.

Is the new t tag a replacement for pct?

Only partly. The RFC explains why pct was dropped: "Operational experience showed that the 'pct' tag was usually not accurately applied, unless the value specified was either 0 or 100." So t keeps just those two useful states.

With t=y, receivers apply your policy one level below what you published. A reject policy is treated as quarantine, and quarantine is treated as none. There is no percentage step anymore, so a gradual move to enforcement now looks like this:

v=DMARC1; p=none; rua=mailto:dmarc@example.com            # 1. Monitor
v=DMARC1; p=quarantine; t=y; rua=mailto:dmarc@example.com # 2. Test (acts like none)
v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com      # 3. Enforce quarantine
v=DMARC1; p=reject; t=y; rua=mailto:dmarc@example.com     # 4. Test (acts like quarantine)
v=DMARC1; p=reject; rua=mailto:dmarc@example.com          # 5. Full enforcement

Stay at each step long enough to read your aggregate reports before moving on.

Why does alignment matter more than having the records?

DMARC does not just check that SPF or DKIM pass. It checks that at least one of them passes and matches the domain in the visible From address. With relaxed alignment, a subdomain of your domain counts as a match.

The third row is a pattern we come across when reviewing start-up setups. The email platform's default configuration signs and routes mail through its own domain. SPF and DKIM both pass, the records look fine, and DMARC still fails.

How can you check your records yourself?

Look up the TXT records for your domain from a terminal:

# DMARC policy
dig +short TXT _dmarc.yourdomain.com

# SPF record
dig +short TXT yourdomain.com | grep spf

# DKIM key (replace "selector" with the one your email platform gives you)
dig +short TXT selector._domainkey.yourdomain.com

On Windows, use nslookup -type=TXT _dmarc.yourdomain.com instead.

Then send a test email to a Gmail address, open it, choose "Show original", and look for dmarc=pass. That confirms alignment, not just the presence of records.

Does good authentication guarantee the inbox?

No. It tells mailbox providers who is sending, which is a precondition for good delivery. Gmail and Yahoo still weigh engagement, complaint history and list quality. No single fix moves inbox placement on its own.

What do we recommend beyond the minimum?

These are our recommendations, not Gmail or Yahoo requirements:

• Check alignment against your visible From domain, especially if you send through a third-party platform.

• Move toward enforcement in stages using the t tag, reading aggregate reports at every step.

• Clean up quiet subscribers. There is no provider-mandated cutoff. Somewhere between 90 and 180 days without engagement is a reasonable starting point for a re-permission campaign.

• Review your setup every quarter. Authentication is easy to configure once and forget.

• Ask your email platform whether it supports the new DMARC tags, particularly if you run a custom sending system.

For campaign ideas that respect these rules, see email marketing campaigns for start-ups that actually help. If you want a second pair of eyes, ask us for a deliverability review. We check authentication and alignment against your real sending setup and tell you clearly which findings are provider requirements and which are our advice.

Frequently asked questions

Do I need to update my DMARC record because of the May 2026 changes?

Not immediately. Existing records stay valid. The new tags are optional. Adopt them when you want the extra control, such as a policy for subdomains that do not exist.

Is p=none enough to comply with Gmail and Yahoo?

Yes, for the requirement to have a DMARC record. Stricter policies are a security recommendation, not a compliance rule.

Do these rules apply if I send fewer than 5,000 emails a day?

The bulk sender rules do not, but Gmail still asks all senders to use SPF or DKIM, keep spam rates below 0.3% and follow basic formatting standards. Meeting the bulk rules anyway is a sensible habit as your list grows.

Will fixing alignment guarantee inbox placement?

No. It removes one barrier. Placement also depends on engagement, complaint rate and list quality.

Sources

• Gmail Help: Email sender guidelines

• Gmail Help: Email sender guidelines FAQ

• Yahoo Sender Hub: Sender best practices

• Google: Gmail introduces new requirements to fight spam (3 October 2023)

• RFC 9989: Domain-based Message Authentication, Reporting, and Conformance (DMARC) (May 2026)

• RFC 9990: DMARC Aggregate Reporting (May 2026)

• RFC 9991: DMARC Failure Reporting (May 2026)

• RFC 8058: Signaling one-click functionality for list email headers