For years, deliverability advice focused almost entirely on subject lines: avoid the word “free,” keep it short, don’t use too many exclamation points. That advice still matters at the margins, but it is no longer the main reason emails end up in spam. Since February 2024, Gmail and Yahoo have enforced technical authentication requirements for bulk senders, Microsoft followed in May 2025, and by 2026 the gap between compliant and non-compliant senders has become severe. Reported industry data puts compliant senders at roughly 89% inbox placement, while non-compliant senders see somewhere between 22% and 34% of their email routed to spam, a three to seven times difference driven almost entirely by technical setup rather than subject line wording.
If your open rates have been declining and your subject lines and content have not meaningfully changed, this is the most likely place to look. Here is what is actually happening and what to do about it.
What Changed: Bulk Sender Requirements
Starting in February 2024, Google and Yahoo introduced formal authentication requirements for anyone sending more than 5,000 emails per day to personal Gmail or Yahoo addresses. Microsoft added similar requirements for Outlook.com, Hotmail, and Live.com addresses starting in May 2025. The core requirements across all three providers are broadly the same:
- Valid SPF and DKIM authentication for your sending domain
- A published DMARC record, at minimum set to a monitoring policy
- A spam complaint rate kept below 0.3%, with Google recommending 0.1% as the real target for reliable inbox placement
- One-click unsubscribe functionality built into the email headers, not just a link in the footer
- Proper message formatting and valid domain records
One detail catches a lot of businesses off guard: Google has stated that once your domain crosses the 5,000-email daily threshold even a single time, it is permanently treated as a bulk sender going forward. And even senders who stay under that threshold are affected in practice, since spam filtering algorithms increasingly treat unauthenticated mail with suspicion regardless of volume.
SPF, DKIM, and DMARC, Explained Simply
These three protocols work together, and understanding the basics is enough to have a productive conversation with whoever manages your DNS records, even if you are not the one implementing it.
SPF (Sender Policy Framework) is a DNS record listing which mail servers are allowed to send email on behalf of your domain. Think of it as a guest list. If an email claims to be from your domain but comes from a server not on that list, receiving providers treat it with suspicion.
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each outgoing email. It proves two things: that the message actually came from your domain, and that nobody altered it in transit. This is closer to a tamper-evident seal than a guest list.
DMARC (Domain-based Message Authentication, Reporting, and Conformance) ties the two together. It tells receiving providers what to do when a message fails SPF or DKIM checks, and critically, it requires that the domain in the visible “From” address actually matches the domain that SPF or DKIM authenticated. This is called alignment, and it is where a lot of setups quietly break, particularly when using a third-party platform like Mailchimp or HubSpot without properly configuring custom domain authentication inside that tool.
The Most Common Way Businesses Fail This Without Realizing It
A surprisingly common failure point has nothing to do with malicious activity or major misconfiguration. It happens when a business uses multiple email tools, a CRM, a marketing platform, a helpdesk, a transactional email service, and each one is technically allowed to send on the domain’s behalf, but the SPF record only accounts for some of them, or the DKIM signature does not align with the visible sender domain. The email still sends. It just does not authenticate properly, and it either lands in spam or gets rejected outright with no warning to the sender.
There is also a hard technical limit worth knowing about: SPF records can only trigger 10 DNS lookups. Businesses using several third-party sending tools can exceed this without realizing it, which causes SPF to fail completely rather than partially. If your business has added new marketing or sales tools over the past year or two, this is worth checking specifically.
What a Passing vs. Failing Setup Actually Looks Like
You do not need specialized tools to get a first read on your own setup. Send a test email to a Gmail account you control, open it, and use the “Show original” option in the message menu. Gmail displays the authentication results directly: SPF, DKIM, and DMARC should each show “PASS” with aligned domains. A “FAIL” or “SOFTFAIL” result on any of them means your DNS records need attention, and it is worth involving whoever manages your domain’s DNS or your email service provider’s support team to correct it.
Spam Rate: The Threshold That Quietly Determines Everything
Beyond authentication, your spam complaint rate is the other major factor providers are watching, and it interacts with authentication in a way that can trap senders in a bad cycle. Once a domain’s spam rate crosses 0.3% with Gmail, the domain becomes ineligible for delivery support, and it has to maintain a spam rate below that threshold for seven consecutive days before eligibility is restored. In practice, this means a domain that has already fallen into poor engagement patterns can struggle to recover, since low inbox placement itself further reduces engagement, which keeps the complaint rate elevated.
The math here is less forgiving than it sounds. A sender delivering 10,000 emails only needs 30 recipients to click “report spam” to cross the 0.3% line. Clean list hygiene, genuine opt-in practices, and easy unsubscribe options are not just good etiquette, they are now a direct technical requirement for staying out of enforcement territory.
What This Means for Your Email Strategy
None of this replaces good subject lines, relevant content, or solid list segmentation. Those still matter for engagement once an email actually reaches the inbox. What has changed is that they are no longer sufficient on their own. A perfectly written subject line on an unauthenticated domain will still land in spam. If you want the tactical, copywriting side of deliverability, our guide to writing better subject lines and our roundup of subject line ideas that avoid spam triggers cover that ground in depth. This piece is specifically about the technical foundation that has to be in place before any of that copywriting advice can actually pay off.
If you are newer to email marketing generally and want the fundamentals before diving into authentication specifics, our beginner’s guide to email marketing is a solid starting point, and our guide to tracking the metrics that actually matter is useful once your deliverability foundation is solid and you are ready to optimize performance.
A Practical First Checklist
If you have not audited your setup recently, here is where to start: confirm SPF and DKIM are configured for every platform that sends email on your domain’s behalf, not just your primary email service provider. Publish a DMARC record if you do not already have one, even a monitoring-only policy is better than nothing and satisfies the baseline requirement. Check your spam complaint rate through Google Postmaster Tools if you send through Gmail-connected infrastructure. Confirm one-click unsubscribe is implemented through email headers, not just a footer link. And if you use multiple third-party sending tools, count your SPF record’s DNS lookups to make sure you are not silently exceeding the 10-lookup limit.
Frequently Asked Questions
Do these requirements apply to my business if I only send a few hundred emails a month?
The strict enforcement technically applies to bulk senders crossing 5,000 emails per day, but spam filtering algorithms increasingly favor authenticated mail regardless of volume. Setting up SPF, DKIM, and DMARC is good practice even well below that threshold.
What is the difference between SPF, DKIM, and DMARC in one sentence each?
SPF authorizes which servers can send on your behalf, DKIM cryptographically signs your messages to prove they were not altered, and DMARC tells receiving providers what to do when either check fails, while requiring the visible sender domain to align with what was authenticated.
Is a DMARC policy set to “none” good enough?
It satisfies the minimum requirement and allows monitoring, but it does not actively block spoofed email. Most deliverability guidance recommends progressing toward a quarantine or reject policy over time rather than staying on a monitoring-only setting indefinitely.
Why would my email suddenly start failing when nothing about my content changed?
This is one of the most common patterns right now. It usually means a new sending tool was added without updating SPF, a DNS change broke DKIM alignment, or your spam complaint rate quietly crossed the enforcement threshold. The content itself is rarely the actual cause.
Can I fix this myself, or do I need a developer?
Checking your current status is something anyone can do using Gmail’s “Show original” feature or a free authentication checker tool. Making the actual DNS changes typically requires access to your domain’s DNS settings, which is often handled by whoever manages your website hosting or IT infrastructure.
Want Your Email Program Audited for Both Deliverability and Content?
Technical authentication gets your email into the inbox. Strong content and strategy get it read once it’s there. If you want both reviewed, get your free growth plan or schedule a quick chat with our team.
Source: http://whoishostingthis.com
About The Author
