Skip to content
Email Delivery Platform
Talk to engineering

/ Free Tools — Bulk Sender Compliance

Watch where the inbox shuts the door.

Run your domain through the Gmail, Yahoo, and Microsoft 2026 bulk-sender gates in the order a receiver checks them — and see the exact gate that would bounce you with a 550, plus a verdict from each provider. Live over DNS, nothing sent.

Request infrastructure review See the gates

Runs SPF, DKIM, DMARC, alignment, reverse DNS and TLS live over DNS-over-HTTPS; flags the unsubscribe and spam-rate gates a browser can't see. Nothing is sent or stored.

/ What this does

Since 2024, Gmail and Yahoo — and Microsoft since 2025 — reject bulk mail that fails their sender rules with a hard 550, not a trip to spam. A receiver checks the gates in order and stops at the first failure. This tool walks your domain through those gates the same way: SPF, DKIM, DMARC and alignment, reverse DNS, TLS, one-click unsubscribe, and the 0.3% spam-complaint limit — verifying live everything that lives in DNS and marking honestly the few gates only you can confirm. Then it shows you the exact gate where the door would close, and a separate verdict from Gmail, Yahoo, and Microsoft, because the same setup can pass one and fail another.

The pipeline animates the signal descending gate by gate and halts it at the block point, because the one gate that stops you is the one worth fixing first. Fix it, re-run, and the signal travels further. Every DNS gate links to the dedicated checker that resolves it.

  • 8 gates, in order

    Evaluated the way a receiver does, stopping at the first hard failure — the gate that returns the 550.

  • 3 verdicts

    Gmail, Yahoo, and Microsoft judged by their own rules — Yahoo's DKIM strictness, Microsoft's softer unsubscribe gate, and more.

  • Live over DNS

    SPF, DKIM, DMARC, and reverse DNS resolved in your browser — no email sent, nothing stored.

  • Honest gaps

    Unsubscribe headers and spam rate don't live in DNS, so they're marked confirm-yourself, not faked green.

/ The eight gates

What does a receiver actually check, and in what order?

The rules split cleanly into what your DNS proves and what your sending behavior proves. The first group is the authentication core, and it comes first because it's how a receiver decides you are who you claim to be. SPF lists the servers allowed to send for you; DKIM signs each message — and Yahoo will reject a key shorter than 1024 bits even when everything else passes; DMARC ties them together with a policy. All three are required for bulk senders, and the visible From domain has to align with either the SPF domain or the DKIM signing domain — authenticating with a vendor's domain but showing yours is the single most common alignment failure.

The second group is the infrastructure gates. Your sending IP needs a valid reverse DNS record that forward-confirms, and the connection has to use TLS. These rarely make headlines but a missing PTR quietly drags placement down. Everything to this point lives in DNS, which is why the tool can resolve it live and grade it with confidence.

The last two gates don't live in DNS at all. One-click unsubscribe — the List-Unsubscribe and List-Unsubscribe-Post headers of RFC 8058 — is required on marketing mail and must be honored within two days, but it's a per-message header, not a record. And the spam-complaint rate under 0.3%, ideally under 0.1%, lives in Google Postmaster Tools, not your zone. A browser can't see either, so rather than invent a verdict, the tool marks them as gates you confirm yourself and points you to where. The one honest answer beats a fabricated green tick.

/ Three doors

Why can I pass Gmail but fail Yahoo?

The three providers share a core and diverge at the edges, and the edges are where senders get caught. Yahoo is the strictest on DKIM: a 512-bit key that Gmail still tolerates is an outright rejection at Yahoo, and Yahoo calculates your spam rate against inbox-delivered mail only — a smaller denominator that makes the same number of complaints look worse. So a domain that's comfortably compliant at Gmail can be failing at Yahoo with identical behavior.

Microsoft, enforcing since May 2025 with its own 550 5.7.515 rejection, treats one-click unsubscribe as recommended rather than a hard gate, while Gmail and Yahoo require it for marketing mail. Gmail leans hardest on the 0.3% spam ceiling and its Postmaster Tools signal. This is why a single pass-or-fail badge is misleading: the tool runs each provider's own rulebook and gives you three verdicts, so you know which doors are actually open. Getting through all three, and staying through as your sending grows, is the ongoing work — which is what we operate.

/ Compliance FAQ

What are the 2026 bulk-sender requirements?
If you send about 5,000 or more messages a day to a provider's consumer inboxes (gmail.com, yahoo.com, outlook.com and their siblings), Gmail, Yahoo, and Microsoft all require the same core: SPF, DKIM, and DMARC, with the visible From domain aligned to either the SPF domain or the DKIM signing domain; a valid reverse DNS (PTR) record on your sending IP; TLS on the connection; one-click unsubscribe via the List-Unsubscribe headers on marketing mail, honored within two days; and a spam-complaint rate kept below 0.3% — ideally under 0.1%. Since 2024–2025 these aren't best practices, they're enforced: non-compliant mail is rejected with a 550, not filed to spam. Cross the 5,000/day line once and you're classified a bulk sender permanently.
What can this tool check automatically, and what can't it?
It checks everything that lives in DNS, live, in your browser: SPF, DKIM (including whether the key is long enough for Yahoo), DMARC and its policy, and the reverse DNS of your mail hosts. It reads MTA-STS as a TLS-posture signal. It cannot see three things that don't live in DNS: whether your marketing messages carry the one-click unsubscribe headers, your actual spam-complaint rate, and true per-message alignment — those live in the message and in Google Postmaster Tools. Rather than fake a verdict on them, the tool marks them as confirm-yourself gates and links you to where to check. Honesty about what a browser can and can't see is the whole point.
Why does the tool show where I'd be blocked?
Because a receiver doesn't score you on a curve — it evaluates gates in order and stops at the first hard failure, returning a rejection. Google returns a 550; Microsoft returns 550 5.7.515. Seeing the pipeline halt at the exact gate that fails is more useful than a checklist of green and red ticks, because it tells you the one thing to fix first to get through the door. Fix that, re-run, and the signal travels one gate further.
Do these rules apply if I send fewer than 5,000 a day?
The hard enforcement targets bulk senders, but the filtering doesn't. The same authentication signals decide placement for everyone — a low-volume domain without SPF, DKIM, and DMARC is viewed with suspicion and lands in spam far more often. And the 5,000/day threshold is per domain and effectively permanent: send one large campaign and you're a bulk sender from then on. Treat the requirements as the floor regardless of volume; the tool grades you against them either way.
Why do Gmail, Yahoo, and Microsoft get separate verdicts?
Because the same setup can pass one and fail another. Yahoo is the strictest on DKIM key length — a 512-bit key that Gmail tolerates gets you rejected at Yahoo. Yahoo also calculates spam rate against inbox-delivered mail only, a stricter denominator. Microsoft treats one-click unsubscribe as recommended rather than a hard gate, while Gmail and Yahoo require it for marketing mail. The tool applies each provider's own rules so you see the real picture: compliant at one door isn't compliant at all three.
Does anything leave my browser?
Only the DNS-over-HTTPS lookups, which are public records anyone can query. No email is sent, nothing about your domain is stored or logged, and the manual gates you confirm never leave the page. You can watch the network tab and see nothing but the DNS queries.

You can see the gate that stops you. We keep all three doors open.

Passing the bulk-sender gates once is a project; staying compliant across Gmail, Yahoo, and Microsoft as you add senders and volume is continuous — and it's exactly what we operate. Run the gates, then bring us the ones still red.

Book infrastructure review

Related capabilities