A great deal of deliverability advice still describes a world that ended in November 2025. That's when Gmail stopped temporarily deferring non-compliant bulk mail and started rejecting it outright — meaning the message doesn't go to spam, doesn't go to Promotions, and never arrives at all.
What actually changed, and when
Three providers, three dates, one direction of travel.
February 2024. Google and Yahoo made SPF, DKIM and DMARC mandatory for senders reaching 5,000 or more messages a day to their users, alongside one-click unsubscribe on marketing mail and complaint-rate limits. Enforcement began softly, with temporary deferrals.
May 2025. Microsoft joined for its consumer domains — Outlook.com, Hotmail.com, Live.com — with equivalent authentication requirements at a minimum DMARC policy of p=none.
November 2025. The significant one. Gmail moved to hard enforcement: permanent rejections rather than temporary deferrals. Mail that fails the requirements is refused before it reaches any mailbox.
The distinction that matters A deferral is a delay you can fix. A rejection is a message that was never delivered to anything — not the inbox, not spam, not Promotions. There is no folder to check.
Reported inbox placement now diverges sharply on compliance: compliant senders averaging high placement rates against a substantial fraction of non-compliant mail being filtered or refused. Two years in, the gap between compliant and non-compliant programmes is the widest it has been.
The threshold catches people who don't think it applies
The most common way organisations discover they're subject to these rules is by failing them.
The 5,000-a-day threshold counts all mail from your sending domain to that provider's users. Password resets. Order confirmations. Receipts. Shipping notifications. Alerts. Not just campaigns.
Which means a B2B company with a few hundred active customers can cross the line on transactional volume alone, without ever sending a marketing campaign large enough to feel like "bulk." If you concluded the rules didn't apply to you because you don't do mass marketing, check your actual daily volume by domain before assuming that's still true.
Transactional mail also has the strongest case for strict DMARC independently, since spoofing a company's receipt and notification domain is the highest-value target for phishing.
Authentication is now table stakes, not strategy
Here's where most deliverability guides mislead by proportion. They spend the majority of their length on SPF, DKIM and DMARC setup — which is now a binary compliance gate rather than a competitive advantage.
Everyone who is delivering has done it. It gets you to the starting line. It doesn't win the race.
The short version of what's required:
- SPF — which servers may send on your behalf
- DKIM — a cryptographic signature proving the message wasn't altered
- DMARC — what to do when the first two fail, plus reporting. Providers now expect it to be valid, aligned and deliberate even at
p=none - Domain alignment — your visible From domain matching your authenticated domain. Misalignment is flagged faster than it used to be
- One-click unsubscribe on marketing mail, per RFC 8058
- Valid reverse DNS and TLS
Set it up, verify it with a testing tool, then stop thinking about it. The interesting work is entirely elsewhere.
Keap
Powerful CRM and email automation platform built for small business growth
Best for: Small Business CRM & Email
0.3% is the number that decides everything
Complaint rate is the single most consequential metric in modern deliverability, and it's smaller than most people realise.
Below 0.10% is the working ceiling stable senders aim for. 0.30% is the hard line — three complaints per thousand delivered messages. Send 50,000 emails and 150 people hitting "report spam" puts you over.
What makes it severe isn't just the placement penalty. Reporting indicates that exceeding 0.30% also costs access to provider mitigation support — so at exactly the moment you have a problem, you lose the ability to get help resolving it, until the rate has stayed below the line for a sustained period.
And recovery is slow. Restoring reputation after a complaint-rate breach typically takes several weeks of disciplined sending, not days.
| Messages delivered | Complaints at 0.10% | Complaints at 0.30% |
|---|---|---|
| 5,000 | 5 | 15 |
| 25,000 | 25 | 75 |
| 100,000 | 100 | 300 |
Look at the first row. On a modest send, fifteen annoyed recipients can put you over the enforcement threshold. That's the practical reality of the current regime, and it's why list quality is no longer a nice-to-have.
Open rate is broken — stop monitoring it
Nearly every deliverability guide tells you to watch your open rate. That advice hasn't been sound for years.
Privacy features that pre-load images register opens no human performed, which inflates the metric and severs its relationship to actual engagement. Use it to judge inbox placement and you'll be reading noise. Worse, use it to define your "engaged" segment — the standard advice for protecting deliverability — and you'll keep sending to people who never opened anything, which is precisely what generates complaints.
That measurement break is covered in more detail in what Apple and Gmail's privacy updates changed for email marketers. For deliverability specifically, replace it with:
- Complaint rate from provider postmaster tools and feedback loops. The number that actually triggers enforcement.
- Domain and IP reputation as reported by the providers themselves.
- Click rate — imperfect, but a click is at least an action a person took.
- Conversion or reply — the least gameable signal available.
- Seed testing — sending to accounts you control across providers and observing where the message actually lands. This is the only direct measure of placement rather than a proxy for it.
Set up provider postmaster tooling if you haven't. It's free, it reports the metric that gets you blocked, and a surprising number of teams have never opened it.
What actually decides placement now
Once authentication is handled, providers are judging one thing: do recipients want this mail?
The signals they use are behavioural, and they're mostly things you influence at acquisition rather than at send time.
How the address was collected. Purchased lists, scraped addresses and pre-ticked boxes generate complaints at rates that no amount of good copy offsets. Confirmed opt-in costs you list size and buys you deliverability — the trade-off discussed in building an owned audience properly.
Whether the first send meets expectations. Someone who signed up for a discount code and receives a newsletter three days later doesn't remember signing up. That gap is where a large share of complaints originates, and it's fixed by a welcome sequence rather than by a filter.
Consistency of sending pattern. Sudden volume spikes read as compromise or list-buying. If you normally send twice a month and plan twelve sends in November, ramp gradually through October rather than jumping — the single most commonly ignored piece of seasonal preparation.
Whether unsubscribing is easy. A hard-to-find unsubscribe link converts people who would have left quietly into people who hit "report spam." Make it obvious. The complaint costs you far more than the subscriber does.
Relevance of what you send. Segmented, genuinely relevant mail generates fewer complaints than undifferentiated broadcasts to everyone, which makes personalisation a deliverability tactic as much as a performance one. The same applies to triggered messages — a cart recovery email arrives when the recipient was already thinking about you, which is why triggered flows typically show far healthier engagement than campaigns.
Engagement recency across the list. A large list of people who haven't interacted in a year isn't an asset; it's a dilution of your engagement signal. Suppressing them improves deliverability for everyone else, which is counterintuitive right up until you see it work.
The volume problem everyone is contributing to
Worth naming, because it explains why the environment keeps tightening.
Automated outreach tooling multiplied per-sender volume across the industry, and mailbox providers responded by tuning filters against the patterns that automation produces — uniform structure, high send-to-engagement ratios, new domains at volume. Paired testing has found AI-written cold email flagged as spam at roughly double the rate of human-written equivalents, a dynamic covered in what autonomous prospecting means for marketers.
The consequence for legitimate senders is that the bar rose without you doing anything. Brands report deliverability problems appearing in 2026 having made no changes to their own programme — because the environment moved, not because they did.
There's also a Microsoft-specific detail worth knowing: it weighs IP reputation more heavily than Google does. If you're on a shared IP with a poor-quality sender, your Outlook deliverability can suffer despite your own authentication and behaviour being sound. Worth checking with your platform what your IP situation actually is.
Fixing a problem that already exists
In order, and resist skipping to step four.
- Establish which failure you have. Rejections with error codes, or silent filtering. Different problems, different fixes.
- If it's authentication: verify SPF, DKIM, DMARC and alignment with a testing tool. Fix and re-test. Usually resolved within a day.
- If it's reputation: check complaint rate and domain reputation in postmaster tooling first, so you know the scale.
- Suppress aggressively. Stop sending to anyone with no click or conversion in ninety days. This will feel like destroying your list. It is the fastest available remedy.
- Reduce volume and rebuild. Send less, to people who engage, consistently, for several weeks. Reputation recovers on a timescale of weeks, not days.
- Fix the acquisition source. If complaints came from one signup path, repairing reputation without repairing that path just resets the clock.
Step four is where most teams stall, because suppressing half a list feels like an admission of failure. It's better understood as removing the people who were already not receiving your mail — and who were degrading placement for the people who were.
Content still matters, just less than you'd think
Two adjustments worth making, kept brief because copy is a smaller factor than list quality.
Design weight affects placement. Image-only emails with almost no text, excessive link density and heavily nested tables all correlate with filtering. A reasonable text-to-image balance and clean markup help — and they also help the significant share of recipients whose client blocks images by default.
Interactive formats add a variable. If you're experimenting with richer email formats, a build error in the enhanced version can affect how the whole message is handled, which makes staged rollout sensible rather than optional. That's one of several practical arguments in our look at interactive email for building the plain version to production standard first.
What matters much less than the folklore suggests: individual "spam trigger words." Modern filtering weighs sender reputation and recipient behaviour far above vocabulary, and rewriting subject lines to avoid the word "free" is displacement activity when your complaint rate is the actual problem.
The parts that are genuinely optional
Three things frequently presented as essential that mostly aren't, at least not yet.
BIMI and verified marks. Displays your logo in supporting clients and requires strict DMARC plus a paid certificate. The costs generally only make sense above substantial list sizes. Worth having on the roadmap; not the reason your mail is filtered.
Dedicated IPs. Useful at high consistent volume, actively harmful below it — a dedicated IP with insufficient volume never establishes reputation. Most senders are better off on a well-managed shared pool.
Elaborate warm-up tooling for established domains. Warm-up matters for new domains and IPs. For an established sender with a reputation problem, the fix is suppression and consistency, not a warm-up service.
Keeping it healthy
A short recurring routine beats an annual panic.
- Monthly: complaint rate and domain reputation in postmaster tooling. Five minutes.
- Quarterly: suppress subscribers with no engagement in ninety days, and re-verify authentication in case DNS changed.
- Before any volume increase: ramp gradually. This applies to seasonal peaks, campaign launches and new automated flows equally.
- When adding a new signup source: watch complaint rate for that cohort specifically for a month, because one bad acquisition path can undo a year of good sending.
- Whenever a new flow goes live: confirm it inherits your authentication and unsubscribe headers. New automated flows are a common place for headers to go missing.
For smaller senders there's a genuine advantage here worth naming: a modest, well-curated list of people who genuinely opted in will outperform a large neglected one on every metric that providers actually measure. Deliverability is one of the few areas where being small and disciplined beats being large and sloppy outright — a version of the asymmetry described in how smaller brands compete against bigger competitors.
One final note on the discipline. Deliverability is infrastructure rather than a campaign channel: fragile when unmanaged, dependable when instrumented. Teams that treat it as something to think about when results dip generally discover it at the worst possible time, which is usually the week of a major send.
The short version
The grace period ended in November 2025 — non-compliant bulk mail is now rejected outright rather than filtered, so there's no folder to check. The 5,000-a-day threshold counts transactional email, which catches out organisations who assumed the rules didn't apply. Authentication is a binary gate rather than a differentiator; get it right once and move on. The number that actually decides your fate is complaint rate, where 0.3% is three per thousand and exceeding it also costs you access to provider support. Stop using open rate for anything — replace it with complaint rate, clicks, conversions and seed testing. And treat suppression as the primary tool: sending less, to people who want it, is the fastest fix available and the best prevention.
Sending consistently and seeing engagement quietly fall?
We audit authentication, reputation and list health, then rebuild email programmes that reliably land.
Explore Email Automation →Frequently asked questions
What are the bulk sender requirements in 2026?
Senders reaching 5,000 or more messages a day to a provider's consumer users need SPF, DKIM and DMARC configured with proper domain alignment, one-click unsubscribe on marketing mail, valid reverse DNS, and spam complaint rates kept low. Google and Yahoo began enforcing in February 2024; Microsoft joined for its consumer domains in May 2025. Crucially, Gmail moved from temporary deferrals to permanent rejections in November 2025, so non-compliant mail is now refused outright rather than delivered to spam. Verify current requirements with each provider before any large send, since thresholds change.
What spam complaint rate is acceptable?
Below 0.10% is the working ceiling most stable senders aim for, and 0.30% is the hard line — that is three complaints per thousand delivered messages. Exceeding 0.30% does more than degrade placement: reporting indicates it also costs access to provider mitigation support, meaning you cannot get help resolving the problem until the rate has stayed below the threshold for a sustained period. Recovery from a complaint-rate breach typically takes weeks rather than days, which makes this a prevention problem rather than a fixable one.
Does the 5,000 a day threshold include transactional email?
Yes, and this catches many organisations out. The threshold counts all mail from your sending domain to that provider's users, including password resets, receipts, order confirmations and notifications. A B2B company with a few hundred active customers can cross the line on transactional volume alone without ever running a large marketing campaign. If you assumed the rules did not apply because you do not send bulk marketing, check your actual daily volume by domain before assuming you are exempt.
Why is open rate no longer a reliable deliverability metric?
Because privacy features that pre-load images register opens that no human performed, which inflates the number and breaks its relationship to actual engagement. Using it to judge inbox placement or to segment engaged subscribers produces misleading results in both directions. More reliable signals are complaint rate and domain reputation from provider postmaster tools, click rate, conversion, and direct seed testing that shows where messages actually land across different mailbox providers.
How do you fix a deliverability problem?
Diagnose before changing anything. Check whether messages are being rejected outright, which points to an authentication failure and produces specific SMTP error codes, or being accepted and filtered, which points to a reputation and engagement problem. Authentication issues are usually fixable within a day. Reputation issues are not — the standard remedy is aggressively suppressing unengaged segments, reducing volume, and sending only to people who have interacted recently, then holding that discipline for several weeks while the signal recovers.
