Between February 2024 and May 2025, the three inbox providers that matter most quietly changed the rules of email marketing. Gmail and Yahoo went first, Microsoft followed. What used to be best practice became a condition of delivery, enforced at the SMTP level. Most of the mistakes still being made in 2026 are variations on not having noticed.
Key takeaways
- Over 5,000 messages a day to Gmail, Yahoo or Outlook consumer accounts triggers mandatory SPF, DKIM and DMARC.
- Google asks senders to stay under a 0.10% spam rate and never exceed 0.3%.
- Apple Mail Privacy Protection has made open rate unusable as a primary metric since 2021.
- CAN-SPAM penalties run to $53,088 per non-compliant email, with opt-outs due within 10 business days.
Group one: the four that now stop delivery
1. Sending unauthenticated mail at volume
Since February 2024, Google and Yahoo have required senders of more than 5,000 messages a day to personal accounts to publish SPF, DKIM and DMARC records, use TLS, hold a valid reverse DNS entry and comply with RFC 5322 formatting. Microsoft applied equivalent requirements to Outlook.com, Hotmail and Live accounts from 5 May 2025, rejecting non-compliant mail outright with a 550 5.7.15 error rather than filing it in spam. A DMARC record at p=none satisfies the minimum, and there is no longer a version of this that is optional for a serious sender.
2. Treating one-click unsubscribe as a nice-to-have
The same rules require a working List-Unsubscribe header with POST support, so the reader can leave from the inbox interface without opening the message, and Google asks that those requests be processed within two days. A programme that only offers a link buried in the footer is now non-compliant as well as annoying, and every reader who cannot find it has an easier alternative: the spam button.
3. Letting the complaint rate drift
Google’s guidance is explicit about the number. Keep the spam rate reported in Postmaster Tools below 0.10%, and never let it reach 0.3%. That second figure is roughly three complaints in a thousand deliveries, which a single badly targeted campaign to a cold segment can produce on its own. Reputation recovers slowly, and it recovers at the domain level, so one aggressive campaign degrades every transactional message the same domain sends afterwards.
4. Mailing a list you did not build
Purchased and scraped lists fail on every axis at once: high bounce rates, high complaint rates, spam traps, and no lawful basis under European rules. The damage is not confined to the campaign, because bounce and complaint signals attach to the sending domain and persist. Suppressing hard bounces immediately and retiring addresses that have not engaged in a year is unglamorous work that protects everything else.
| Requirement | Gmail and Yahoo | Outlook consumer accounts |
|---|---|---|
| In force since | February 2024 | 5 May 2025 |
| Volume trigger | 5,000 messages a day | 5,000 messages a day |
| Authentication | SPF, DKIM and DMARC | SPF, DKIM and DMARC at p=none minimum |
| One-click unsubscribe | Required, honoured within 2 days | Strongly expected on bulk mail |
| Failure mode | Filtering and rate limiting | Rejection at SMTP, 550 5.7.15 |
Group two: the three that flatter your reporting
5. Still steering by open rate
Apple introduced Mail Privacy Protection with iOS 15 in September 2021. Where it is enabled, Apple’s proxy servers preload remote content, including the tracking pixel, whether or not the recipient opened anything. Every one of those becomes a recorded open. Any subject line test, re-engagement segment or send-time decision built on open rate is therefore partly measuring Apple’s infrastructure. Clicks, replies and downstream conversion survive; opens do not.
6. Benchmarking against vendor averages
Sending platforms publish attractive aggregate figures. Brevo’s 2025 benchmark, drawn from 11.9 billion emails sent in 2024 across more than 19,000 businesses, reported an average open rate of 33.9%, a click rate of 4.32% and a click-to-open rate of 11.37%. Those are that provider’s own customers, not a measurement of the market, and the open-rate component carries the Apple problem described above. They are a rough sanity check, never a target.
7. Calling a test early
Stopping a send-time or subject-line test the moment one variant pulls ahead reliably produces results that do not repeat. Decide the sample and the duration before the send, run both variants into the same audience across the same window, and accept that a difference of a few tenths of a point on a list of a few thousand is noise. The same discipline problem shows up across channels, and we went through it in detail in our piece on how dark social breaks marketing attribution.
Group three: the three that cost money
8. One message for the whole list
Undifferentiated sending is the root cause of most complaint-rate problems, because irrelevance is what people report as spam. Behavioural segmentation, meaning what someone opened, clicked or ignored, generally outperforms demographic splits, and the simplest useful version is a three-way split by recency of engagement, with the least engaged group mailed least often rather than most.
9. Designing for your own inbox
Image-only emails break for anyone blocking remote content, and a message whose call to action lives inside a graphic disappears entirely. Keep the offer in live text, keep the important content above the fold of a phone screen, and check that every link resolves. Technical checks before send are dull and they catch the errors that no amount of copywriting recovers from.
10. Assuming one legal regime covers everything
The United States and Europe start from opposite defaults. Under CAN-SPAM, commercial email may be sent without prior permission, provided the header and subject line are not deceptive, a physical postal address appears, the opt-out mechanism stays functional for at least 30 days after sending, and requests are honoured within 10 business days. Each non-compliant message is a separate violation, with penalties up to $53,088. Under the GDPR and the ePrivacy rules, the default is reversed: prior consent is generally required for marketing to individuals, with a narrow exception for existing customers contacted about similar products, and the opt-out must be offered both at collection and in every message. A single template sent to a mixed international list will breach one of the two.
Where to start if the list is long
In order: publish the authentication records, add and test the one-click unsubscribe header, pull the spam rate from Postmaster Tools and look at it honestly, then remove open rate from every dashboard that drives a decision. Those four take a technical afternoon between them and remove the failure modes that make everything downstream unmeasurable. The segmentation and copy work that occupies most email marketing advice is worth doing afterwards, on a programme that is actually arriving.
Wondering whether the channel still earns its place?
The constraints have tightened, and the economics have not stopped working.
Sources: Google email sender guidelines, in force since February 2024, for the 5,000 messages a day threshold to personal Gmail accounts, mandatory SPF, DKIM and DMARC, TLS, valid reverse DNS, RFC 5322 compliance, one-click unsubscribe via List-Unsubscribe and List-Unsubscribe-Post honoured within two days, and the Postmaster Tools spam rate to be kept below 0.10% and never above 0.3%; Microsoft announcement of Outlook requirements for high-volume senders, applicable from 5 May 2025, including rejection at SMTP with error 550 5.7.15; Apple Mail Privacy Protection, introduced with iOS 15 in September 2021, preloading remote content and rendering open rate unreliable; Brevo email marketing benchmark published in 2025, based on 11.9 billion emails sent in 2024 across more than 19,000 businesses, reporting 33.9% open, 4.32% click and 11.37% click-to-open, which are that provider’s client figures rather than a market measurement; United States Federal Trade Commission guidance on the CAN-SPAM Act for the 30-day opt-out mechanism, the 10 business day deadline and the maximum penalty of $53,088 per non-compliant email under the current inflation adjustment; Regulation (EU) 2016/679 and the ePrivacy rules for the consent-based European regime and the existing-customer exception. Penalty amounts are adjusted periodically and applicable obligations depend on where your recipients are: this is general information, not legal advice. Updated August 2026.
