Is DMARC Mandatory? Google, Yahoo and Microsoft Rules in 2026
No law requires DMARC. But the companies that own the inboxes you are trying to reach do, and at this point the distinction stopped mattering. Here is what is actually enforced, who it applies to, and what changed in 2026.
The short answer
If you send meaningful volume to Gmail, Yahoo or Outlook consumer addresses, DMARC is a requirement. If you send below the published thresholds, it is not technically mandated — but a domain with no DMARC record now reads as unmaintained, which is a signal you do not want attached to a sending fleet. There is no version of this where skipping it helps you.
What Google and Yahoo enforce
Google and Yahoo introduced matching requirements for bulk senders in February 2024, and they have been actively enforced since. The primary sources are Google's email sender guidelines with its detailed FAQ, and Yahoo's sender best practices. For senders above the threshold:
- SPF and DKIM both configured, with at least one of them aligned to the From domain.
- A published DMARC record at a minimum policy of
p=none. The record has to exist; it does not have to enforce. - One-click unsubscribe via the
List-UnsubscribeandList-Unsubscribe-Postheaders (RFC 8058), with requests processed within two days. - Spam complaint rate kept below 0.10%, never reaching 0.30%.
Note the minimum is p=none — a monitoring policy that instructs receivers to do nothing. Meeting the mandate and being protected are not the same thing. The requirement is a floor, and it is a low one.
What Microsoft enforces
Microsoft brought in equivalent rules for Outlook, Hotmail and Live addresses from May 2025, announced on the Microsoft Defender for Office 365 blog: SPF, DKIM and a DMARC record at p=none or stricter, aligned to at least one mechanism, for domains sending above the same threshold. Microsoft also weighs IP reputation more heavily than Google does, which matters if you send from shared infrastructure.
Since most B2B campaigns hit Gmail and Outlook simultaneously, being compliant with one and not the other produces a deliverability gap that is easy to mistake for a targeting problem.
Who actually counts as a bulk sender
The published threshold is roughly 5,000 messages a day, and the details matter more than the number:
- It counts mail to consumer mailboxes — gmail.com, personal Yahoo, outlook.com and the like — not business inboxes hosted on Workspace or Microsoft 365.
- It is counted per sending domain, and it aggregates across subdomains.
- Cross it once and the classification is generally treated as permanent, even if volume later drops.
Two practical consequences for cold email. First, a fleet of separate sending domains each sending modest daily volume can genuinely sit below the per-domain threshold — the rules do not aggregate across your whole operation. Second, that is not the protection it sounds like: the filters built to catch non-compliant bulk mail apply broadly, and an unauthenticated low-volume domain sending outbound prospecting patterns is treated with the same suspicion. Sizing your fleet properly is covered in cold email sending limits.
The standard itself changed in May 2026
The IETF published RFC 9989, 9990 and 9991, replacing RFC 7489 which had defined DMARC since 2015, and moving the protocol onto the standards track. This creates no new obligations by itself, but it does change what a well-formed record looks like:
pct,rfandriare deprecated. Remove them at your next DNS pass. A record still carryingpct=10is a rollout somebody abandoned.npis new — a policy for subdomains that do not exist, closing the gap used to spoof plausible-sounding addresses that were never registered.treplacespctas a binary testing flag rather than a percentage.- Existing records stay valid. The version tag is still
v=DMARC1; nothing you have published breaks.
Receiver adoption of the new tags is gradual, so treat np and t as additions rather than substitutes for a correct p and sp. Check what your domains currently publish with the DMARC checker.
What compliant actually looks like
My working default across the domains I manage: p=quarantine on sending domains, because it signals a maintained domain without risking hard bounces on your own outbound, and p=reject on the primary brand domain, because that is the one people actually spoof. Every sending domain needs its own record — DMARC is published per domain and inherited from nowhere.
Mandates from outside the mailbox providers
Two others are worth knowing about, because they turn DMARC into an audit item rather than a deliverability tactic. PCI DSS 4.0 requires DMARC for organisations handling cardholder data, and the EU's NIS2 directive pushes it for in-scope entities. If either applies to your business, the decision has already been made elsewhere.
Where to start
Publish p=none with a working rua, read the reports for two weeks to find legitimate senders you had forgotten about, then move to quarantine. Full setup across a fleet: SPF, DKIM and DMARC for cold email. If DMARC is failing while SPF and DKIM pass, the cause is alignment — see why DMARC fails when SPF and DKIM pass.
Sources
- Google — Email sender guidelines
- Google — Email sender guidelines FAQ, including the DMARC alignment requirement
- Yahoo — Sender best practices
- Microsoft — Outlook's requirements for high-volume senders
- Microsoft Learn — Set up DMARC for Microsoft 365
- Google Postmaster Tools — spam rate and compliance monitoring
- RFC 8058 — one-click unsubscribe
- RFC 9989 — the current DMARC specification
Tools for this
DMARC checkerSee whether your policy enforces anything.Frequently asked questions
Is DMARC mandatory?
Not by law, but Google, Yahoo and Microsoft all require it for domains sending above roughly 5,000 messages a day to their consumer mailboxes, and have enforced this since February 2024 for Google and Yahoo and May 2025 for Microsoft. Below those thresholds it is not mandated, but an absent DMARC record is increasingly read as a sign of an unmaintained domain.
What DMARC policy do the bulk sender rules require?
A published record at a minimum of p=none, with SPF and DKIM both configured and at least one of them aligned to the From domain. p=none is a monitoring policy that does nothing to failing mail, so meeting the requirement and being protected from spoofing are different things — the mandate is a floor, not a target.
Does the 5,000 a day rule apply to cold email?
It applies per sending domain, counted against consumer mailboxes rather than business inboxes on Workspace or Microsoft 365, so a fleet of separate domains sending modest volume each can sit below it. That is a technicality rather than an exemption: the filtering built for non-compliant bulk mail is applied broadly, and an unauthenticated domain sending outbound patterns draws the same scrutiny at any volume.
What changed in the DMARC standard in 2026?
RFC 9989, 9990 and 9991 were published in May 2026, replacing RFC 7489 and moving DMARC onto the IETF standards track. The pct, rf and ri tags were deprecated, and np, t and psd were added. Existing records remain valid and still begin with v=DMARC1, so nothing breaks — but records carrying pct should be cleaned up.
Will p=none stop being enough?
Quite possibly. The requirement today is a published record at p=none, but the direction of travel across every provider has been toward enforcement, and industry guidance already treats p=quarantine or p=reject as the practical target. Getting to quarantine now costs little and removes the question.
Do I need DMARC on every sending domain?
Yes. DMARC is published per domain and is not inherited from a parent or from your primary brand domain. Every sending domain in a fleet needs its own record, which is straightforward to bulk-generate — the DMARC generator produces copy-ready records.