Yahoo Sender Requirements & Best Practices

If you send to Yahoo Mail addresses, your mail must meet Yahoo's published sender requirements to reach the inbox. Yahoo began enforcing them in February 2024, with a gradual rollout, and began enforcing the List-Unsubscribe policy in June 2024.

The requirements apply to all domains and consumer brands hosted by Yahoo Mail, including AOL and the other domains Yahoo hosts. Yahoo Japan operates independently and is not covered.

Mail that fails the requirements may be delivered to spam, or rejected outright with an error code (see Yahoo SMTP Error Codes).

Requirements for all senders

Additional requirements for bulk senders

Yahoo does not publish a volume threshold that defines a "bulk sender": a bulk sender is one that sends a significant volume of mail. For enforcement, a "sender" is evaluated at the level of the authenticated domain or the From header domain, and Yahoo uses all the information available (content, IP and so on) to review compliance.

Scope of one-click unsubscribe

• It applies only to promotional or marketing messages, not to transactional messages (order confirmations, password resets).
• If a class of message that does not require it generates many complaints, Yahoo suggests adding unsubscribe options anyway.
• When the List-Unsubscribe header is set up correctly according to RFC 8058 and the sender has enough reputation and engagement, Yahoo webmail shows a blue "Unsubscribe" option next to the From address. Test it at https://mail.yahoo.com/.

Spoofing counts against you

Spoofed mail that uses your domain counts toward Yahoo's enforcement thresholds. If your domain is being spoofed, move DMARC to an enforcement policy (p=quarantine or p=reject). See DMARC for how to reach Enforcement safely.

Authentication details

• DKIM key length: at least 1024 bits, with 2048 bits recommended.
• Multiple DKIM signatures: Yahoo evaluates all signatures for DMARC alignment, for reputation calculation and for the Complaint Feedback Loop. Several signatures that do not pass do not add up to a DMARC pass.
• SPF: publish the specific set of IP addresses authorized to send.
• ARC (Authenticated Received Chain): recommended for mail that is forwarded.
• Yahoo publishes p=reject for its own domains, so mail that spoofs From addresses such as @yahoo.com is rejected.

Recommendations beyond the requirements

List acquisition and hygiene

• Send only to users who specifically requested the mail: no purchased lists, and no pre-checked opt-in boxes.
• Use double opt-in (a confirmation click) to improve list quality.
• Set expectations at signup (what mail to expect, how often, and what it looks like), and keep to the frequency the list was set up for, without raising it unexpectedly.
• Monitor hard and soft bounces and inactive recipients, and remove invalid recipients promptly.
• Periodically send a reconfirmation email to inactive subscribers.

Infrastructure

• Publish valid, meaningful, non-generic reverse DNS (PTR) records that reflect your domain name, and avoid names that look like dynamically assigned IP addresses.
• Separate mail streams: do not send bulk or marketing mail from the IP addresses (or DKIM domains) you use for transactional mail, alerts or user mail. See Advanced IP Segmentation.
• Keep servers patched, and make sure they are not open relays or open proxies (Yahoo rejects mail from these).
• Add Border Gateway Protocol (BGP) routes for IP space you own.
• Connection management: limit the number of messages per SMTP connection, reconnect if the connection ends without an error code, and open concurrent connections with restraint. Yahoo publishes no specific limits per connection or on concurrency.

Monitoring and reputation

• Enroll all DKIM domains in the Complaint Feedback Loop, and suppress complainers.
• Yahoo's reputation inputs include IP reputation, URL reputation, domain reputation, sender reputation, autonomous system number (ASN) reputation, DKIM signatures, DMARC authentication, and user spam votes.
• A good domain reputation alone does not guarantee the inbox. A combination of factors (high complaints, obfuscated URLs, missing rDNS, non-compliance with RFCs) can still send mail to spam. Rules set by individual users override the system's decisions.
• Control spikes in traffic, and warm up new IP addresses gradually. See IP Warm-Up.
• Yahoo evaluates complaint rates for enforcement continuously, and domains with high complaint rates may be deferred.

Compliance

• Follow the CAN-SPAM Act: no false or misleading headers, and no deceptive subject lines.

Operational FAQ points

Related articles

• Yahoo Complaint Feedback Loop, to monitor the complaints that count toward the 0.3% threshold
• Yahoo SMTP Error Codes
• Yahoo Deliverability Performance Feeds
• DMARC
• Foundations of Email Deliverability