Email deliverability requirements in 2026: The Google, Yahoo and Microsoft sender rules, warm-up and the numbers to wa

Email deliverability requirements in 2026 come from Gmail, Yahoo and Microsoft. Bulk senders of about 5,000 or more messages a day must authenticate with Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM) and an aligned Domain-based Message Authentication, Reporting and Conformance (DMARC) record. Gmail and Yahoo set a spam rate ceiling below 0.3%, and Yahoo asks bulk senders for one-click unsubscribe. Microsoft has rejected non-compliant bulk mail since May 5, 2025.

What are the email deliverability requirements in 2026

Three mailbox providers set the baseline: Google for Gmail, Yahoo, and Microsoft for Outlook.com, Hotmail and Live. Their rules split into requirements for every sender and stricter ones for bulk senders. The table below puts them side by side, with the date each set took effect.

Acronyms first. SPF is Sender Policy Framework. DKIM is DomainKeys Identified Mail. DMARC is Domain-based Message Authentication, Reporting and Conformance. A PTR (pointer) record is reverse DNS.

The Gmail rules are on Google's sender guidelines: spam rates "below 0.3%" in Postmaster Tools, PTR records for sending domains or IPs, and a TLS connection. Gmail also requires a DKIM key of 1024 bits or longer for personal accounts.

Yahoo's list is on its Sender Hub. It asks bulk senders for a functioning list-unsubscribe header that supports one-click unsubscribe, and it requires them to honor unsubscribes within 2 days. Yahoo calculates spam rate on mail delivered to the inbox. In our reading, a rate you compute on total sends will read lower than Yahoo's figure.

Microsoft's change was about the penalty. From May 5, 2025, non-compliant bulk mail was rejected instead of filtered to junk, with error code 550 5.7.15 Access denied. This applies to mail sent for you by third-party email service providers on your domain. Microsoft lists clear unsubscribe links as a recommended practice for large senders, not a requirement.

A worked check

Take a team that sends 6,000 emails a day to Gmail addresses. It counts as a bulk sender at Gmail and at Microsoft. It needs SPF, DKIM and an aligned DMARC record before anything else. Then work out the spam ceiling: 0.3% of 6,000 is 18 complaints a day. At 19 complaints, the team is over the line on that day's volume.

Delivery rate and deliverability are different numbers

Most email dashboards show a delivery rate that looks healthy. That number answers a narrower question than many readers assume.

MessageFlow separates the two. Delivery rate "measures whether an email was accepted by the recipient’s mail server." Deliverability "measures whether the message actually appears in the inbox." A message can be accepted and then filed to spam, and the delivery rate still counts it as a success. The same guide states it directly: "A 99% delivery rate does not guarantee strong deliverability."

The signals mailbox providers weigh

According to MessageFlow, providers look at several signals before they decide where a message goes:

• Domain reputation
• Authentication alignment
• Engagement behavior
• Complaint rate
• Bounce patterns
• Sending consistency

The same source says domain reputation "is now more influential than IP reputation," and that deliverability is "the cumulative outcome of long-term sending behavior." One clean campaign does not repair a weak history.

The ranges commonly cited

The ranges come from MessageFlow. The complaint target in that guide is lower than the provider ceiling covered in the previous section. We read it as a working buffer below the ceiling, not as a new rule.

Worked example

The guide describes this exact pattern: "If delivery rate remains high but inbox placement drops, filtering or reputation issues are likely affecting email deliverability."

Two practical checks

First, report inbox placement by mailbox provider. MessageFlow advises teams to "Monitor inbox placement by domain (Gmail vs Outlook vs regional providers)." Second, watch list age. Add both checks to your demand gen dashboard next to delivery rate, so nobody reads acceptance as inbox placement.

Who counts as a bulk sender, and why secondary domains do not reset the count

Gmail's definition is short. A bulk sender is any sender that sends close to 5,000 messages or more to personal Gmail accounts within a 24-hour period. Two details in that definition decide most outbound plans: what gets counted, and how long the label lasts.

What Gmail counts

Gmail counts all messages sent from the same primary domain. Its own example is a sender that, every day, sends 2,500 messages from solarmora.com and 2,500 messages from promotions.solarmora.com to personal Gmail accounts. That sender is a bulk sender. Subdomains roll up to the parent.

The count covers only personal Gmail recipients. Gmail states that its sender guidelines don't apply to messages sent to Google Workspace accounts. For a B2B list, in our reading, this means total send volume overstates Gmail exposure. Size the count from the share of your list on personal Gmail addresses, not from the whole file.

The label does not come off

Senders who hit the threshold at least once are permanently considered bulk senders. Gmail adds that changes in email sending practices will not affect permanent bulk sender status once it's assigned. One heavy day, such as an event follow-up or a reactivation blast, sets the status for good.

Worked example: an outbound team on subdomains

An outbound team sends from three subdomains of one company domain.

The primary domain passes it, so example.com is a bulk sender, permanently.

Lookalike secondary domains

A separately registered lookalike domain is a different primary domain, so it carries its own count. We think that is the reason teams buy them. The trade is that each one starts as a new domain. Gmail defines a new domain as any domain that hasn't sent more than 5,000 emails a day to personal Gmail accounts since January 1, 2024, and says the enforcement progression for new domains will be on an accelerated timetable. Splitting volume does not lower the bar. It spreads the same requirements across more domains that each have less history.

Gmail also ramped up its enforcement on non-compliant traffic starting November 2025. Our working rule: assume every sending domain your team owns, primary or secondary, will be treated as bulk. Set up authentication, unsubscribe handling and monitoring on each one before it sends its first message.

How to set up SPF, DKIM and DMARC with records you can copy

Publish three Domain Name System (DNS) records on the secondary domain before it sends any mail. The template below uses getexample.com as the secondary domain and s1 as the DKIM selector. Swap in your domain, your email service provider's (ESP) include value and the public key the ESP generates.

The SPF record lists the servers allowed to send for the domain. Yahoo states that SPF records allow Yahoo to reject messages from unlisted IPs. For the DomainKeys Identified Mail (DKIM) key, Yahoo asks senders to sign with a minimum 1024-bit key length.

What each DMARC tag does

Domain-based Message Authentication, Reporting and Conformance (DMARC) lives in a TXT record with a special name: _dmarc.yourdomain.com. Valimail's breakdown of the tags:

• v=DMARC1 opens every record.
• p= sets the policy. p=none: Useful for monitoring without taking action. Quarantine sends failures to spam, and reject refuses them.
• rua= names the mailbox for aggregate reports. Yahoo says including it is strongly recommended to allow monitoring during initial setup.
• sp= sets a subdomain policy. If you don’t set this, subdomains inherit the main policy.
• pct= applies the policy to part of your mail: “pct=50” means only half.
• adkim= and aspf= set alignment, with “r” for relaxed (default) or “s” for strict.

How relaxed alignment works

For bulk senders, Yahoo requires that the domain in the From: header is aligned with either the SPF domain or the DKIM domain, and states that Relaxed alignment is acceptable.

Here is a worked example. Your From address is ana@getexample.com. The ESP signs with d=getexample.com and uses bounce.getexample.com as the return path. Under relaxed alignment, both checks pass, because each domain shares the organizational domain getexample.com. Under strict alignment (aspf=s), the SPF check fails because bounce.getexample.com is not an exact match. DKIM still passes, so DMARC still passes.

Moving from none to reject

We use this order on every secondary domain:

1. Start at p=none. Read the aggregate reports until every legitimate sender (the ESP, the customer relationship management system, the sales engagement tool) shows SPF or DKIM passing and aligned.
2. Move to p=quarantine; pct=50. Watch the reports for any legitimate mail that starts failing.
3. Raise to p=quarantine with no pct. Leaving pct out applies the policy to all mail.
4. Move to p=reject. Keep the rua address in the record so failures stay visible.

Moving the policy only shows up in reports. Recipients will notice anything you break, so change one tag at a time.

Do cold emails need an unsubscribe link

Yes, if you send at bulk volume, and there are two separate things to build. One is the visible unsubscribe link in the body of the email. The other is a pair of header lines that let the mailbox provider show its own unsubscribe button. They do different jobs, and Yahoo asks for both.

The visible link and the headers are different requirements

Yahoo's bulk sender rules, enforced beginning in February 2024, list three items under easy unsubscribe. You need to implement a functioning list-unsubscribe header that supports one-click unsubscribe for marketing and subscribed messages. You need a clearly visible unsubscribe link in the email body, which may point to a preference page. And you need to honor unsubscribes within 2 days.

In our reading, cold outreach sent from a domain over the bulk threshold counts as marketing mail, so both elements apply to it.

The two header lines to copy

List-Unsubscribe: <https://example.com/unsub?t=TOKEN>, <mailto:unsub@example.com?subject=unsubscribe>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

The second must carry the single pair "List-Unsubscribe=One-Click". Your DomainKeys Identified Mail (DKIM) signature has to cover at least the List-Unsubscribe and List-Unsubscribe-Post headers, so check that your sending platform signs them.

Yahoo calls the Post (RFC 8058) method highly recommended and says the mail-to: method is acceptable.

Why the POST line exists

The RFC states the problem plainly: mail software sometimes fetches URLs in mail header fields, and thereby accidentally triggers unsubscriptions. Security scanners would load the link, and the recipient would be removed without clicking anything.

The POST line separates a deliberate request from a scanner fetch. Your endpoint should process a POST without a confirmation step, while a plain fetch of the same address does nothing.

The RFC also names the cost of a slow process: if an unsubscription process is too difficult, the recipient's alternative is to report mail from the sender as junk. We think that is the practical reason to build both lines even below the bulk threshold, since every unsubscribe that replaces a junk report keeps your complaint rate down.

What spam complaint rate is too high

The published ceiling is 0.3%. Gmail tells all senders to keep spam rates reported in Postmaster Tools below 0.3%, and Yahoo lists the same rule for all senders: keep your spam rate below 0.3%. Many operators work to a lower line. MessageFlow gives a best practice threshold: below 0.1%, and we use that figure as the target and treat 0.3% as the point of damage.

At 300 messages a day, the 0.3% ceiling works out to 0.9 complaints, and at 5,000 a day it is 15.0.

Worked example: spam complaints a day that reach a 0.3% complaint rate

Item	Value
100 sends a day	0.3 complaints a day
300 sends a day	0.9 complaints a day
1,000 sends a day	3 complaints a day
5,000 sends a day	15 complaints a day

Example sending plan: 10 mailboxes at 30 messages each a day is 300 a day, or 6,300 over 21 sending days. Source: Take the Market calculation: daily sends times the complaint rate (illustrative volumes)

Check the denominator before you trust your own rate

The two providers do not divide by the same thing you do. Gmail's figure is the one reported in Postmaster Tools, not the one in your sending platform. Yahoo says its spam rate is calculated in our system based on mail delivered to the inbox. Mail that lands in spam is not in that base.

In our reading, this means your platform's rate (complaints over all sent) will usually look lower than the provider's rate (complaints over inbox-delivered). A program with weak inbox placement has a smaller denominator, so each complaint weighs more.

How few complaints a day it takes

The arithmetic is daily sends times the rate.

Take a typical outbound plan: 10 mailboxes at 30 messages each a day is 300 a day, or 6,300 over 21 sending days. The 0.3% ceiling allows 0.9 complaints a day at that volume. That is less than one. A single report on a given day puts that day over the line.

The 0.1% target allows 0.3 complaints a day, which works out to roughly one report every three sending days. At 100 messages a day the ceiling is 0.3 complaints, so one report in a day is several times over it.

The volume a program can absorb grows only with sends. At 5,000 a day the ceiling is 15 complaints, which is why a large newsletter can absorb a bad day that would mark a small outbound domain.

What to do with the numbers

1. Set the alert at 0.1%, not 0.3%. In our reading, by the time you reach the ceiling, the reputation hit has already started.
2. Read rates over a rolling window, not a single day. At low volume one day is noise; a run of days is a trend.
3. Track complaints per mailbox and per domain. One bad sequence on one mailbox can carry the whole domain's rate.
4. Size the list to the complaints you can absorb. If you are backing pipeline targets into send volume with the reverse funnel calculator, check that the send number the calculator returns still leaves room under 0.1% given the reply quality you expect.

How many cold emails to send per mailbox per day, with a warm-up schedule

The ramp and caps below are our planning numbers, not a mailbox provider rule. Google, Yahoo and Microsoft publish no per-mailbox daily limit for cold outreach. They judge authentication, complaints and engagement, which earlier sections covered. A ramp exists so a new mailbox builds a sending history before it carries full volume.

A five-week warm-up ramp

If a gate fails, hold the mailbox at its current week's volume for another week. If complaints rise, cut the volume in half. Do not keep climbing on schedule while the numbers move the wrong way.

Worked example: mailboxes and domains for a monthly target

Assume a target of 30,000 cold sends a month.

1. Sends per mailbox per month: 30 a day × 21 sending days = 630.
2. Mailboxes needed: 30,000 ÷ 630 = 47.6, so round up to 48.
3. Domains needed at three mailboxes per domain: 48 ÷ 3 = 16.
4. Daily volume across the fleet: 48 × 30 = 1,440.

Spreading volume across 16 domains limits the damage if one domain's reputation drops. As covered earlier, it does not change how providers count you as a sender.

Sequence length changes how many contacts that volume reaches

Sends are not contacts. A four-step sequence uses four sends per contact, so 30,000 sends a month reaches about 7,500 new contacts at steady state. A six-step sequence reaches 5,000.

In our reading, the gap between cycle length and sequence length argues for more spaced-out touches rather than more mailboxes. A contact who goes quiet at week six can re-enter a slower sequence a quarter later, and that does not require new sending capacity.

Work backward from the pipeline number before you buy domains. Use the reverse funnel calculator to turn a meeting target into contacts and sends. Then size mailboxes against the steady-state cap, and add the five weeks of warm-up to your launch date.

The numbers to watch in Postmaster Tools, and a weekly check

Set it up once per sending domain, then read it on a fixed day each week.

Setup and verification

Sign in at postmaster.google.com, add the domain, then go to your DNS provider and add the TXT record provided by Google. If that fails, Google offers a second verification method that involves adding a CNAME record. Add every cold outreach domain separately. The Compliance status dashboard data applies to primary domains only, so a subdomain rolls up into its parent.

Limits that change how you read the data

• Lag. Typically, the data is updated within 24 hours but can take longer. Judge a change made on Monday no earlier than Wednesday.
• Dates. Postmaster Tools uses Coordinated Universal Time (UTC). A US afternoon send can land on the next day's bar.
• DomainKeys Identified Mail (DKIM) only. Some dashboards show data only for messages authenticated with DKIM.
• Low-volume gaps. Microsoft's guide reports that if you send over 100 messages per day to unique Gmail users, reputation data is generated for that day. Small cold domains will show blank days. In our reading, a blank day is missing data, not a clean one.
• Masked spam rate. If Gmail automatically sends a significant number of your messages to spam, the rate shown in the dashboard might seem low. Read spam rate next to reputation, never alone.

What each dashboard shows

A Bad rating matters because email coming from this entity will almost always be rejected at connection time or marked as spam. One error reason worth knowing: rate limits apply when the Domain or IP is sending traffic at a suspiciously high rate, which points back to your per-mailbox volume.

Weekly checklist

1. Set the time range to 7 days, then compare against 30.
2. Note spam rate and reputation per domain in your demand gen dashboard.
3. Flag any domain with blank days and confirm its daily Gmail volume.
4. Open Compliance status. After a fix, it can take up to 7 days for changes to be reflected, so log the fix date.
5. Read the delivery error reasons and match each to one owner.

What this page does not cover

This page does not cover the laws that govern commercial or cold email in any country, and nothing here is legal advice. It also leaves out step-by-step setup inside specific email service providers and rules for Microsoft business mailboxes, since the Microsoft rule described here applies to consumer domains.

Related on Take the Market: Demand creation vs demand capture: definitions, the 95-5 rule, budget split and measures; Intent data explained: first, second and third party, and what a surge score can and cannot tell you; Content syndication in B2B: how it is priced, what counts as a lead, and how to check quality.