The New DMARC Requirements and What They Mean for You
Google and Yahoo now require DMARC for bulk senders. We break down exactly what changed, who is affected, and what you need to do before your next send.
In February 2026, Google and Yahoo updated their bulk sender requirements to mandate DMARC authentication for all senders who send more than 5,000 emails per day to Gmail or Yahoo inboxes. If you're sending transactional or marketing email at any meaningful volume, this affects you — and if you don't comply, your mail will be rejected.
What changed
Previously, DMARC was strongly recommended but not enforced. The new requirements make it mandatory. Specifically: you must have a DMARC record published at your sending domain, your SPF and DKIM must align with your From: domain (not just your sending infrastructure), and your DMARC policy must be at least p=none (though p=quarantine or p=reject is strongly recommended).
Who is affected
Any sender with more than 5,000 daily sends to Gmail or Yahoo is in scope. This includes transactional email (password resets, receipts, notifications) and marketing email. The threshold is lower than most senders expect — 5,000 emails to Gmail per day is roughly 150,000 per month, which many mid-sized SaaS products exceed without realizing it.
What to do
Check your current DMARC setup using Sendbound's deliverability dashboard or a public DMARC lookup tool. If you don't have a DMARC record, publish one immediately — even p=none is better than nothing. Then work toward p=quarantine over the next 30 days as you monitor your DMARC reports and ensure all legitimate sending sources are aligned.