Email deliverability in 2026: what changed and the 2027 checklist

TL;DR

• Since November 2025, Gmail has been ramping up enforcement of its sender requirements, including temporary and permanent rejections. Microsoft has rejected non-compliant mail to Outlook.com from high-volume senders since 5 May 2025.

• DMARC became a full standard in May 2026 (RFC 9989): the pct tag is retired and t=y is the new way to test a stricter policy.

• Monitoring changed too: Google is retiring the reputation dashboards in Postmaster Tools, Microsoft moved SNDS to a new portal, and open rates are no longer a reliable signal.

• The 2027 checklist comes down to five areas: authentication, unsubscribe, complaints and list quality, sending setup and monitoring.

Email deliverability rules did not get a big new announcement in 2026. Instead, the rules set in 2024 and 2025 started to bite: Microsoft rejects mail that misses them and Gmail has added rejections to its enforcement, DMARC became a formal standard, and the tools senders use to monitor their reputation changed. This guide covers what changed between 2024 and 2026, what it means for B2B cold and marketing email, and a 15-point checklist to work through before you send in 2027.

What changed in email deliverability from 2024 to 2026

The short version: rules that started as guidelines in February 2024 are now enforced with rejections. Gmail and Yahoo set the baseline in 2024, Microsoft followed in May 2025, Gmail ramped up enforcement in November 2025, and 2026 brought a new DMARC standard and new monitoring tools.

Figure: the mailbox provider changes behind email deliverability in 2027, from Google, Yahoo, Microsoft and IETF sources.

Gmail: from spam folder to rejections

Gmail's email sender guidelines have applied to every sender since 1 February 2024. All senders need SPF or DKIM, valid forward and reverse DNS, a TLS connection, correctly formatted messages and a spam rate below 0.3% in Postmaster Tools. Bulk senders, defined as anyone sending close to 5,000 messages a day to personal Gmail accounts, also need both SPF and DKIM, a DMARC record (p=none is enough), a From domain aligned with SPF or DKIM, and one-click unsubscribe on marketing mail.

Two details matter for 2027:

• Bulk status is permanent. Google's sender guidelines FAQ says senders who cross the threshold once "are permanently considered bulk senders." Volume is counted at the primary domain level, so mail from a subdomain counts toward the main domain.

• Enforcement got harder in November 2025. The same FAQ now says: "Starting November 2025, Gmail is ramping up its enforcement on non-compliant traffic. Messages that fail to meet the email sender requirements will experience disruptions, including temporary and permanent rejections."

In practice, failing authentication, reverse DNS, TLS or From alignment now risks an SMTP rejection (error codes such as 5.7.26 or 5.7.30), not just the spam folder. A spam rate above 0.3%, a missing DMARC record or missing one-click unsubscribe makes you ineligible for Google's delivery support. Google also says a spam rate above 0.1% already hurts inbox placement for bulk senders.

Google has also flagged where the rules are heading: "It's likely that DMARC alignment with both SPF and DKIM will eventually be a sender requirement." If you align only one of them today, fix the other before it becomes mandatory.

Microsoft: rejections since May 2025, Promotions in 2026

Microsoft announced its own rules for Outlook.com, Hotmail and Live in April 2025. Domains sending more than 5,000 emails a day must pass SPF and DKIM and publish DMARC at p=none or stricter, aligned with SPF or DKIM. Microsoft first said non-compliant mail would go to Junk, then changed course in an update on 29 April 2025: from 5 May 2025, it rejects that mail with the error "550; 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level," per its announcement on Tech Community.

Two Microsoft changes in 2026 matter for B2B senders:

• Promotions in Microsoft 365. Business mailboxes now tag promotional bulk mail with a Promotions tag, and admins can route it to a Promotions folder. Microsoft's bulk complaint level documentation says this was rolling out to all organisations by mid-September 2026. Marketing email to business inboxes can now land out of the main view even when it passes every check.

• A new SNDS portal. Microsoft's Smart Network Data Services moved to a new portal in 2026, and access now expires 10 months after approval unless you re-verify it.

If you send cold email from Microsoft 365 mailboxes, also check the tenant-wide limit on external recipients. Microsoft's Exchange Online limits cap external recipients per tenant in each 24-hour window, scaled by licence count, with trial tenants capped at 5,000 a day.

Yahoo and Apple

Yahoo's sender requirements match Gmail's in substance: SPF or DKIM for everyone, and SPF, DKIM, DMARC at p=none or stricter, one-click unsubscribe and a spam rate under 0.3% for bulk senders. Yahoo does not publish a volume threshold and asks senders to honour unsubscribes within 2 days. Since 24 June 2025, AT&T's consumer email domains have routed through Yahoo, per the Yahoo postmaster blog, so Yahoo's rules now cover those inboxes too.

Apple's iCloud Mail requirements for bulk senders are stricter on consent: opt-in lists only, with no purchased, rented or appended lists, and mail that misses the requirements "will be rejected." Apple offers no complaint feedback loop.

DMARC is now a standard: what RFC 9989 changes

In May 2026 the IETF published DMARC as RFC 9989, a Proposed Standard that replaces RFC 7489. Reporting moved to two companion documents, RFC 9990 and RFC 9991. The changes that affect how you write a DMARC record:

• pct is retired. The pct tag, used to apply a policy to a percentage of mail, is now historic.

• t=y is the test mode. With t=y, a quarantine policy is applied as none and a reject policy as quarantine, so you can stage a stricter policy safely.

• np covers non-existent subdomains. A new tag sets the policy for subdomains that do not exist, a common spoofing route.

• A DNS tree walk replaces the Public Suffix List for finding the organisational domain.

Google's DMARC help page still shows pct examples, and no mailbox provider has said when it will adopt RFC 9989. For new records or policy changes in 2027, use t=y rather than pct. Our SPF, DKIM and DMARC setup guide covers the records step by step.

How you monitor deliverability changed too

The dashboards senders relied on are changing:

• Google Postmaster Tools. Google's deprecation notice says every dashboard moves to Postmaster Tools v2 except Domain and IP Reputation, which will be retired. Google's page still says it has postponed retiring the old interface, while Spam Resource reported in August 2026 that many senders now only see v2. Use the v2 compliance dashboard, which shows pass or fail on each sender requirement.

• Microsoft SNDS and JMRP. Re-verify access every 10 months in the new portal, and enrol in the Junk Mail Reporting Program to see complaints.

• Open rates. Google says plainly that it "doesn't track open rates" and that low open rates are not an accurate signal of deliverability. Apple Mail Privacy Protection also hides opens. Track replies, bounces, SMTP errors and DMARC reports instead.

What the 2026 numbers say

Validity's 2026 Email Deliverability Benchmark, based on 2025 sending, puts global inbox placement at 87.2%, up 3.7% on the year before. Microsoft remains the hardest provider to reach, with 77.4% of mail reaching the inbox and 15.1% going to spam.

Figure: inbox placement by mailbox provider in 2025, Validity 2026 Email Deliverability Benchmark Report.

Validity's average complaint rate was 0.06%, and the report says "under 0.1 percent is now the expectation." Treat 0.3% as the point where Gmail stops helping you, not as a target. Validity's data comes mostly from marketing email, so read it as a direction for cold outbound, not a benchmark. For outbound numbers, see our cold email benchmarks and email deliverability benchmarks.

What this means for B2B cold email

Most B2B cold email goes to Google Workspace and Microsoft 365 business inboxes, not to personal Gmail or Outlook.com accounts. Google's FAQ says its sender guidelines "don't apply to messages sent to Google Workspace accounts," and Microsoft's 5,000-a-day rule covers its consumer service. That does not mean business inboxes are easier. They run their own filtering, and Microsoft 365 now sorts promotional bulk mail into Promotions.

The practical takeaways for 2027:

• Authenticate every domain as if you were a bulk sender. It costs nothing extra and protects you when one campaign tips you over 5,000 a day to personal inboxes.

• Keep cold email on separate domains and mailboxes from your main marketing and transactional mail, so a complaint spike on outbound does not hurt invoices or newsletters. Our guide to cold email inbox providers covers the setup. To size how many inboxes you need, try our cold email inbox calculator.

• Verify lists before you send. Hard bounces and spam traps do the fastest damage. A verification tool such as Emailable removes them before they cost you.

• Test placement, not opens. Seed tests with GlockApps or MailGenius show where mail lands at Gmail and Microsoft before a full send.

• Write fewer, better emails. Complaint rates come from relevance. Our cold email deliverability guide covers volume, warmup and copy.

For the full background on how filtering works, start with our email deliverability guide.

The 2027 email deliverability checklist

Work through these 15 checks for every sending domain before you plan 2027 campaigns. The first group and the fix-first items are the ones that now lead to rejections.

Figure: the 2027 email deliverability checklist, built from Google, Yahoo, Microsoft and Apple sender requirements and RFC 9989.

Authentication

1. SPF and DKIM on every sending domain, with 2048-bit DKIM keys (Google's minimum is 1024).

2. DMARC published and aligned with SPF or DKIM. Aim for both: Google says that will likely become a requirement.

3. Move DMARC from p=none to quarantine, then reject, using t=y while you test.

Unsubscribe

4. One-click unsubscribe headers (RFC 8058) on marketing and subscribed mail.

5. A visible unsubscribe link in the body of every marketing email.

6. Opt-outs honoured within 48 hours (Gmail) and no later than 2 days (Yahoo).

Complaints and lists

7. Spam complaints under 0.1%, and never 0.3% or higher.

8. Lists verified and hard bounces removed before every send.

9. No purchased lists, and long-inactive contacts removed. Yahoo deletes accounts after 12 months of inactivity, so old addresses bounce.

Sending setup

10. Cold, marketing and transactional email on separate streams, with a consistent From address for each.

11. Valid reverse DNS (PTR) and TLS on every sending IP.

12. Sending volume kept inside your Microsoft 365 tenant limits if you send from 365 mailboxes.

Monitoring

13. Google Postmaster Tools v2 set up, with the compliance dashboard checked weekly.

14. Microsoft SNDS and JMRP enrolled, with access re-verified every 10 months.

15. DMARC aggregate reports and SMTP error codes reviewed, instead of open rates.

Figure: the requirements the Postmaster Tools v2 compliance dashboard reports on, per Google's help pages, 14 October 2026.

FAQ

What changed in email deliverability in 2026?

DMARC became a formal standard (RFC 9989) in May 2026, Google announced it is retiring the reputation dashboards in Postmaster Tools, Microsoft moved SNDS to a new portal, and Microsoft 365 started tagging promotional bulk mail as Promotions. The bigger shift came just before: since November 2025, Gmail has been ramping up enforcement, including temporary and permanent rejections.

Does Gmail reject emails that fail SPF, DKIM or DMARC?

Yes. Since November 2025, Gmail can apply temporary and permanent rejections to messages that fail its sender requirements, such as missing authentication, missing reverse DNS, no TLS or a From domain that does not align.

What spam rate is acceptable for Gmail?

Keep it below 0.1%. Google says rates above 0.1% already hurt inbox placement, and at 0.3% or higher bulk senders lose access to Google's delivery support until the rate stays under 0.3% for 7 days.

Do Gmail's sender rules apply to Google Workspace inboxes?

No. Google says its sender guidelines do not apply to messages sent to Google Workspace accounts. They cover personal Gmail accounts. Workspace inboxes run their own filtering, so authenticate fully anyway.

What is RFC 9989?

RFC 9989 is the 2026 DMARC standard that replaces RFC 7489. It retires the pct tag, adds t=y as a test mode, adds an np tag for non-existent subdomains and replaces the Public Suffix List with a DNS tree walk.

Are open rates still useful for deliverability?

Not as a deliverability signal. Google says it does not track open rates and that low opens are not an accurate sign of a problem, and Apple Mail Privacy Protection hides opens. Use replies, bounces, SMTP errors, complaint rates and DMARC reports.

Bottom line

Email deliverability in 2026 was less about new rules than about enforcement. Microsoft rejects mail that misses its sender requirements and Gmail has added rejections to its enforcement, DMARC has a formal standard with a new test mode, and the reputation dashboards many teams relied on are going away. The 2027 work is to authenticate every domain fully, keep complaints well under 0.1%, separate your sending streams and monitor through Postmaster Tools v2, SNDS and DMARC reports rather than open rates.

If you want outbound that books meetings without risking your domain, book a call with GROU.

About this guide

We are GROU, a B2B pipeline agency that runs lead generation, outbound and LinkedIn content for B2B companies. The requirements and dates in this guide come from Google, Yahoo, Microsoft, Apple and IETF documentation and Validity's 2026 benchmark, checked on 14 October 2026.

Some links in this article are affiliate. We may earn a small commission at no extra cost to you.