For years, sending requirements were guidance. They are now enforcement. If you send at volume to Gmail or Outlook and your authentication is incomplete, your mail does not land in spam — it gets refused at the door, and your recipients never know it existed.
The frustrating part is that almost none of this is about your content. It is DNS records and headers, most of it a half-day of work, and it is the difference between a programme that delivers and one that quietly stops.
Whether this applies to you
- Google: since 1 February 2024, senders of more than 5,000 messages a day to Gmail personal accounts have to meet its bulk sender requirements.
- Microsoft: a high-volume sender is one sending 5,000 or more messages a day to Microsoft consumer services, counted per domain in the 5322.From address.
- The threshold is a floor, not a switch you can drop back below. Treat it as permanent once you cross it, and assume every provider trends this way.
Note what is being counted: messages per day, to personal inboxes, per sending domain. A B2B programme sending to company mailboxes may be under the line today and over it the moment a campaign goes out to a consumer list.
What is actually required
- SPF and DKIM on the sending domain, both passing. Not one of the two — both.
- A published DMARC record. The policy can be p=none; you do not have to quarantine or reject to be compliant, you have to have the record.
- Alignment: the domain in the visible From: header must align with either the SPF domain or the DKIM domain. This is the requirement most people fail while believing they pass, because SPF and DKIM can both be green on a domain that is not the one recipients see.
- One-click unsubscribe on marketing and subscribed messages — the List-Unsubscribe-Post: List-Unsubscribe=One-Click header alongside a List-Unsubscribe header. Transactional mail is out of scope.
- TLS on transmission.
- Valid forward and reverse DNS, meaning a PTR record for your sending IPs.
The numbers that decide it
Google publishes one hard figure: keep the spam rate reported in Postmaster Tools below 0.30%, and never reach it. That is the ceiling, not the target.
Run the programme at 0.10%. The gap between the two is your margin for a bad segment, a bought list somebody imported, or a subject line that misfires. Sitting at 0.25% is not compliance with room to spare — it is one campaign away from enforcement, on a metric that reports with a lag.
What failure actually looks like
Microsoft is the clearest example of the shift, because it published the escalation. From 5 May 2025, non-compliant high-volume mail was routed to the Junk folder — a grace period, in effect. It now rejects outright, with a specific bounce:
550 5.7.515 Access denied, sending domain [domain] does not meet the required authentication level.
That is the important change. A spam-foldered message still exists and can still be found. A rejected message never arrived, and nothing in your ESP dashboard will look like a content problem — you will see a bounce rate climbing on one provider while everything else looks healthy.
The order things break in
Requirements get published as flat lists, which is not how they fail. In practice it goes like this:
- One provider starts refusing. Usually Outlook first, because its enforcement is the bluntest. Your overall metrics barely move, because that provider is a slice of the list.
- Your bounce rate rises on that slice, and reputation damage follows the bounces rather than causing them.
- Transactional mail goes with it, if it shares the domain. This is the expensive part: password resets and order confirmations do not get retried by the customer, they get raised as support tickets.
- By the time the aggregate numbers look bad enough to investigate, you are recovering reputation rather than protecting it — and that is measured in weeks.
What to do this week
- Check alignment, not just authentication. Send yourself a message and confirm the From: domain matches the SPF or DKIM domain. This is where most failures hide.
- Publish DMARC at p=none if you have nothing. It is compliant, it is safe, and it starts the reporting you will need before you can ever tighten it.
- Open Google Postmaster Tools and look at your actual spam rate. It is free and it is the provider's own number, not your ESP's estimate.
- Separate transactional from marketing at the subdomain level, so a marketing reputation problem cannot take your receipts down with it.
None of this improves a single campaign. All of it decides whether the campaigns you already have arrive at all.