Editor’s note: This is an evergreen guide, not a news explainer. Research for this piece covered the past two weeks of email marketing coverage. It turned up no single, verifiable development big enough to carry a dedicated news story. What it did turn up was a year of steadily tightening enforcement from Gmail, Yahoo, and Microsoft that a lot of senders still haven’t adapted to. That is the more useful thing to write about right now, so this piece is a practical email deliverability checklist instead.
If your open rates have dropped without warning, the cause is usually one of a small set of sender rules that Gmail, Yahoo, and Outlook now enforce automatically. This email deliverability checklist walks through exactly what each provider checks, in plain terms, so you can find and fix the gap before your next send.
Gmail, Yahoo, and Microsoft each publish their own version of these rules. They overlap heavily: authentication, a working unsubscribe link, a low spam complaint rate, and clean message formatting. Miss one, and mail that used to land in the inbox starts bouncing or landing in spam instead.
What “Bulk Sender” Means Under Gmail, Yahoo and Outlook Rules
Gmail defines a bulk sender as any domain sending more than 5,000 messages a day to personal Gmail addresses, according to Google’s email sender guidelines. Microsoft uses the same 5,000-message threshold for Outlook.com addresses. That rule took effect on May 5, 2025.
Yahoo does not publish an exact number. Its Sender Hub best practices describe bulk mail as anything sent in “significant volume.” Most deliverability teams treat recurring marketing and subscribed traffic as in scope regardless of size.
If you run a newsletter, a transactional flow, or an ecommerce campaign through an ESP like Klaviyo, Mailchimp, or HubSpot, you are almost certainly a bulk sender. You likely meet at least one of these definitions already. The rules apply whether you send 6,000 emails a day or 600,000, which is why knowing your status is the first step in any email deliverability checklist.
The Email Deliverability Checklist: 9 Rules to Follow
Each item below maps to a specific requirement from Gmail, Yahoo, or Microsoft. Most senders already meet two or three of these. The ones that trip people up are usually DMARC alignment, the spam complaint rate, and one-click unsubscribe.
1. Authenticate With SPF, DKIM, and DMARC Alignment
Gmail’s guidelines require SPF and DKIM for every sending domain, plus a published DMARC record. Google says the DMARC policy itself can be set to p=none. Even so, the From: domain still has to align with either the SPF domain or the DKIM domain for the message to pass.
Yahoo and Microsoft ask for the same three records. Microsoft’s postmaster policies recommend a DMARC policy of p=reject, which is stricter than the minimum Gmail and Yahoo accept.
Having SPF and DKIM configured is not the same as having them aligned. A common gap: the DKIM signing domain is a subdomain the ESP controls, while the visible From: address uses your root domain. If those two don’t match under DMARC’s alignment rules, authentication fails even though SPF and DKIM both technically pass.
2. Support One-Click Unsubscribe and Honor It Quickly
All three providers require a working List-Unsubscribe header that lets a recipient opt out in one click, plus a visible unsubscribe link in the email body itself. Yahoo’s documentation is the most specific: requests must be processed within two days.
Gmail and Microsoft don’t publish an exact number of hours. Both still expect unsubscribe requests to be honored promptly. Treat two business days as the safe ceiling across all three.
The RFC 8058 POST method is the version Yahoo calls out as preferred over a plain mailto link. It lets the unsubscribe happen without opening a new email client.
3. Keep Spam Complaint Rates Under 0.3 Percent
Google’s sender guidelines set 0.3% as the hard ceiling for spam complaints in Postmaster Tools, with 0.1% recommended as a safer target. Yahoo publishes the same 0.3% ceiling.
Both providers calculate this rate only from mail that reached the inbox and was then marked as spam. Mail filtered to spam automatically doesn’t count. A rising complaint rate often shows up before a drop in deliverability does. That is why checking Postmaster Tools regularly belongs on this email deliverability checklist, not just an annual audit.
4. Encrypt the Connection With TLS
Gmail added a TLS requirement for the connection used to transmit mail, not just for links inside the message. Most modern ESPs handle this automatically. It’s still worth confirming with your provider if you’re on a smaller or self-hosted sending setup.
5. Set Up Valid Forward and Reverse DNS
Your sending IP needs a PTR record that resolves back to a hostname. That hostname needs to resolve forward to the same IP. Microsoft’s policies specifically call out generic or missing PTR records as a reason mail gets deferred.
6. Format Messages According to RFC 5322
This is the technical specification for how an email message should be structured: headers, line breaks, and encoding. Most ESPs comply by default. This mainly affects anyone sending through custom scripts or legacy SMTP setups rather than a modern platform.
7. Don’t Spoof Gmail, Yahoo, or Outlook From: Addresses
Google’s guidelines say it will apply DMARC quarantine enforcement against mail that impersonates a Gmail From: header. The page does not give an exact date for when that kicks in fully. The safer practice, regardless of the timeline, is simple: never send marketing mail using a From: address on someone else’s domain.
8. Separate Marketing Traffic From Transactional Traffic
Yahoo specifically recommends sending bulk or marketing mail from different IPs and DKIM domains than transactional mail like receipts and password resets. This keeps a spike in promotional complaints from dragging down the reputation your account-critical emails depend on.
9. Keep Your List Clean
Yahoo’s guidance also calls out prompt removal of invalid recipients and consistent opt-in confirmation as part of staying under the complaint threshold. A list full of old, unengaged, or hard-bounced addresses raises your spam rate even when your content and authentication are fine. That is why list hygiene belongs on this email deliverability checklist alongside the technical DNS items.
Where Yahoo’s Checklist Differs From Gmail’s
Yahoo’s rules track Gmail’s closely, but two details are worth flagging. First, Yahoo gives a concrete two-day window for honoring unsubscribe requests, where Gmail is vaguer. Second, Yahoo explicitly recommends ARC (Authenticated Received Chain) for anyone whose mail gets forwarded, which matters more for Yahoo and AOL inboxes than it does for Gmail.
Yahoo also calculates its spam complaint rate from delivered mail only, the same approach Gmail uses. That means a complaint rate that looks fine in your ESP’s dashboard can still be high by Yahoo’s own measurement. This happens whenever a chunk of your mail is already landing in spam before anyone gets the chance to complain.
What Microsoft Added for Outlook and Hotmail
Microsoft’s bulk sender rules took effect in May 2025, making them the newest of the three, and they closely mirror Gmail’s. The one meaningful difference: Microsoft recommends a DMARC policy of p=reject rather than accepting p=none as sufficient. It also publishes the exact rejection message senders will see when they fail, a 550 5.7.515 error citing an authentication shortfall.
Microsoft also caps simultaneous connections at 500 without prior arrangement. It flags connections from dynamic IP space as a red flag on its own, separate from authentication status.
Why Gmail’s Enforcement Ramp-Up Still Matters
Gmail’s underlying sender requirements haven’t changed since 2024. What changed is how strictly Google enforces them. On November 3, 2025, Google added a note to its Bulk Sender Guidelines FAQ stating that enforcement on non-compliant traffic was ramping up that month. Messages failing the requirements, Google said, would “experience disruptions.”
Deliverability researcher Al Iverson covered the change at the time on SpamResource. He noted that Gmail had previously enforced the rules somewhat selectively. Non-compliant senders, he wrote, should now expect more deferrals and outright rejections rather than a warning period.
What this means for you: if you set up SPF, DKIM, and DMARC back in 2024 and haven’t checked them since, that configuration is a year old. The enforcement you’re now facing is not. A record that passed loosely under lighter enforcement can start failing outright once Gmail applies the rule more strictly. There is no separate announcement pointed at your domain specifically when that happens.
Applying This Checklist Inside Your ESP
Most of what this checklist covers is platform-agnostic, but where you fix it depends on your ESP. Klaviyo, Mailchimp, and HubSpot all expose domain authentication settings in their sending domain setup. Most will flag a failed DKIM or SPF check directly in their dashboard before you send.
If you’re already running automated flows, this is also a good moment to audit your sequences. DevByteDaily’s marketing automation guide covers the welcome, nurture, and re-engagement flows worth checking. A single automation sending to a stale list is often the hidden source of a rising complaint rate.
Tools like HubSpot’s AI assistant, covered in our look at HubSpot Breeze’s pros and cons, can help draft and summarize campaign performance. They don’t fix authentication problems, though. That still requires DNS changes at the domain level, usually made once and checked periodically rather than touched per campaign.
Once your deliverability is stable, you still need to know whether the campaigns themselves are working. Delivery rate, click-through, and revenue per email are covered in DevByteDaily’s guide to marketing analytics for email.
Example Scenario: Diagnosing a Deliverability Drop
Here’s a hypothetical to show how this email deliverability checklist gets used in practice. Say a mid-size ecommerce brand notices its Gmail open rate has dropped by half over three weeks, with no change to subject lines, send times, or list size.
Working through the checklist in order, the first two items check out: SPF and DKIM both pass in Postmaster Tools. The third item is where the problem shows up. The brand switched ESPs two months earlier and never updated its DMARC record’s alignment tag. DKIM technically passes, but it doesn’t align with the visible From: domain under DMARC.
Under looser enforcement, that misalignment might have gone unnoticed for months. Under the stricter enforcement Gmail flagged in November 2025, it is enough to push a meaningful share of mail into spam, or to trigger outright rejections. In this hypothetical, fixing the DMARC alignment tag is a single DNS record change. It only gets found, though, if someone actually runs the checklist instead of assuming “we set this up already” covers it.
Common Mistakes That Break an Email Deliverability Checklist
A few patterns show up again and again, even among senders who think they’ve already run this checklist once and covered the basics.
- Treating DMARC as “set once” rather than monitoring it after an ESP migration, a new subdomain, or a rebrand.
- Measuring spam complaint rate from the ESP’s dashboard only, instead of checking Google Postmaster Tools or Yahoo’s own feedback loop, which can show a different number.
- Mixing marketing and transactional mail on the same sending domain, so a promotional campaign’s complaints put password-reset emails at risk.
- Assuming a small list is exempt from bulk sender rules. Gmail and Microsoft’s 5,000-message threshold is a daily volume count, not a subscriber count, so a smaller list sent to frequently can still cross it.
FAQ
Do these rules apply if I send fewer than 5,000 emails a day?
Gmail’s and Microsoft’s formal bulk sender requirements kick in at 5,000 messages a day to their respective domains. Below that, enforcement is generally lighter. Basic authentication, a clean list, and a visible unsubscribe link are still good practice regardless of volume.
Can I set my DMARC policy to p=none and still pass Gmail’s and Yahoo’s requirements?
Yes. Both Gmail and Yahoo accept p=none as a valid policy, as long as the record exists and your mail passes DMARC alignment. Microsoft recommendsp=reject, which is stricter than what Gmail and Yahoo require.
How do I check my current spam complaint rate?
Google Postmaster Tools shows this for domains sending to Gmail. Yahoo’s Complaint Feedback Loop provides the equivalent data for Yahoo and AOL addresses. Your ESP’s own reported complaint rate may differ from both, since it may not account for mail filtered straight to spam.
Does a spam folder placement count against my complaint rate?
No, according to both Gmail’s and Yahoo’s documentation. Both calculate the rate from mail that was delivered to the inbox and then marked as spam, not mail the filter caught automatically. That distinction is one reason a rate that looks acceptable in Postmaster Tools can coexist with a real inbox placement problem.
Why This Matters and What To Do Next
Deliverability rules used to be something you set up once and mostly ignored. Gmail’s shift toward stricter, less forgiving enforcement since November 2025 means that is no longer a safe assumption. Yahoo and Microsoft are moving in the same direction.
Run through this email deliverability checklist against your own sending domain this week. Start with DMARC alignment and your current spam complaint rate in Postmaster Tools. Those two items cause more silent deliverability drops than anything else on this list, and both are free to check.
Leave a response