Google and Yahoo created authentication requirements for anyone sending large volumes of email from their personal accounts, and Microsoft added equivalent rules for Outlook.com, Hotmail.com, and Live.com addresses on May 5, 2025. Microsoft's announcement applies to domains sending more than 5,000 messages a day to its consumer accounts, and Yahoo's sender guidelines set out similar expectations for its mailboxes.

Each set of rules requires three authentication standards that let a receiving mail server check whether a message really came from the domain it claims. Automated healthcare email, such as appointment reminders and result notices, falls under the same checks whenever patients have registered with a personal Gmail, Yahoo, or Outlook.com address.

Read more: Why healthcare businesses choose Paubox Email API | The 5-minute guide to Paubox Email API | The software developer's guide to HIPAA email APIs

 

Who counts as a bulk sender

Google counts messages sent to personal Gmail accounts by primary domain. Its sender guidelines FAQ gives the example of an organization sending from several subdomains, where every message adds up under the one primary domain, and it states that senders who meet the threshold even once are permanently considered bulk senders.

Under Google's approach, a health system sending reminders, billing notices, and newsletters from several subdomains of one main domain is measured on the combined total. Microsoft's threshold covers domains sending more than 5,000 messages a day to Outlook.com, Hotmail.com, and Live.com addresses.

 

What the rules require

Sender Policy Framework, or SPF, verifies that a provider's servers have been approved to send email for a domain. DomainKeys Identified Mail, or DKIM, authenticates messages through a pair of public and private cryptographic keys. Domain-based Message Authentication, Reporting and Conformance, or DMARC, builds on both by publishing a policy that tells receiving servers how to handle messages that claim to come from a domain but fail those checks.

Google's FAQ lists the responses bulk senders receive when something is missing. Gmail rate limits messages that fail DKIM authentication, and it does the same when the sending domain has no DMARC record or a record without a policy, since every bulk sender is required to publish one. Google also advises keeping the rate of messages that users report as spam below 0.1% and preventing it from ever reaching 0.3% or higher.

 

What happens to mail that misses them

Google describes its enforcement against bulk senders that fall short as gradual and progressive. Microsoft set out two stages, routing messages from noncompliant high-volume senders to the junk folder first and then rejecting them if problems remain unresolved, with the error "550; 5.7.515 Access denied, sending domain does not meet the required authentication level." Either outcome can keep an automated healthcare message away from the patient's inbox, since a rejected message is never delivered and a junked one lands outside the main mail view.

 

Why inbox delivery affects attendance

A systematic review and meta-analysis in BMJ Open analyzed how electronic notifications affect attendance at healthcare appointments, covering reminders sent by text message, email, or instant messaging. Its primary analysis included 21 studies, comparing 8,345 patients who received electronic text notifications with 7,731 who received none.

Its authors concluded that electronic notifications improve attendance and reduce missed appointments across healthcare settings, and that sending several notifications could improve attendance further. For high-volume senders, whether an emailed reminder gets that chance now depends partly on passing the mailbox providers' authentication checks.

 

How the Paubox Email API handles authentication

Paubox lists optimized deliverability among the features of its HIPAA email API, updating the customer's SPF record and configuring DKIM and DMARC so outbound messages avoid spam folders. That page also states that Paubox supports only TLS 1.2 and 1.3, following National Security Agency guidance, where Transport Layer Security (TLS) is the protocol that encrypts email as it moves between servers, and that every account includes a business associate agreement. Each message sent through the API comes back with its delivery status and delivery time, giving a sending team a record of what reached recipients. Encrypted messages arrive directly in the patient's inbox without a password or portal, and a free plan covers up to 300 emails a month.

Learn more: Paubox Email API | Paubox Email API pricing | SMTP mail via Paubox Email API

 

How federal agencies were held to a stricter standard

In October 2017, the Department of Homeland Security issued Binding Operational Directive 18-01, a compulsory direction to federal executive branch departments and agencies. The directive required agencies to set a DMARC policy of "reject" for all second-level domains and mail-sending hosts within one year of issuance. A reject policy tells receiving servers to refuse unauthenticated messages claiming to come from the domain. Federal agencies were required to reach that level by October 2018, more than six years before Microsoft began enforcing its own DMARC requirement for high-volume senders to Outlook.com.

 

FAQs

Do these rules apply to transactional healthcare email or only marketing?

Google counts messages sent from a domain to personal Gmail accounts, and Microsoft counts messages to its consumer accounts, so automated patient notifications count toward the 5,000-a-day threshold alongside marketing.

 

What happens if a bulk sender has no DMARC record?

Gmail rate limits the messages, according to Google's sender guidelines FAQ. Outlook routes noncompliant high-volume mail to junk and can reject it if problems remain unresolved.

 

Is a bulk sender classification permanent?

For Gmail, yes. Google states that senders who meet the bulk sender criteria even once are permanently considered bulk senders.

 

Do the rules affect patient care?

They influence whether a message reaches the inbox. A BMJ Open meta-analysis found electronic appointment notifications improve attendance and reduce no-shows, which depends on the message being delivered.

 

How does Paubox help with these requirements?

Paubox updates the customer's SPF record and configures DKIM and DMARC for its Email API, supports only TLS 1.2 and 1.3, and reports delivery status for each message.