Outbound Email Deliverability at Scale (2026)

Outbound email deliverability at scale means passing SPF, DKIM and DMARC alignment, keeping spam complaints under Google’s 0.30% ceiling (0.10% is the recommended target), and honouring one-click unsubscribe under RFC 8058 within two days. Since 5 May 2025, Microsoft rejects non-compliant bulk mail outright instead of filing it to junk.

If reply rates are sliding and you cannot tell whether the fault is copy, list or infrastructure, start with infrastructure. It is the layer enterprise procurement now audits before letting a vendor near a shared inbox, and it is the layer most revenue teams have not touched since IT set the domain up. We book AI-driven sales appointments for scale-up and enterprise clients across Australia and the US — 50,769+ since 2017 — and the single biggest predictor of a client’s reply rate is whether their sending infrastructure was built for volume or inherited from a startup’s first cold-email tool.

What Google, Yahoo and Microsoft actually require

Three mailbox providers set the rules that matter for outbound at scale, and as of 2026 they broadly agree with each other.

Google’s bulk sender guidelines have applied since 1 February 2024 to anyone sending more than 5,000 messages a day to Gmail and Googlemail addresses. They require SPF and DKIM on the sending domain, a published DMARC record (minimum policy p=none, aligned to SPF or DKIM), a spam rate that stays below 0.30% in Google Postmaster Tools, and one-click unsubscribe on every marketing message via the List-Unsubscribe and List-Unsubscribe-Post headers. Google’s own guidance is blunt about the target: stay under 0.30%, but aim for under 0.10%.

Yahoo’s sender requirements mirror Google’s almost line for line — SPF and DKIM, a DMARC policy of at least p=none with alignment, a spam rate under 0.3%, and one-click unsubscribe. Yahoo is explicit on the mechanism and the clock: it recommends the RFC 8058 POST method and requires that unsubscribe requests be honoured within two days.

RFC 8058 is the actual specification both providers point to. It defines the List-Unsubscribe header (an HTTPS URI identifying the recipient and list) and List-Unsubscribe-Post (a fixed value telling the mail client it can fire a one-click POST, no login, no second click, no landing page with a hidden re-subscribe checkbox). If your unsubscribe still routes through a marketing-preferences page, you do not have one-click unsubscribe by this definition, regardless of what your ESP’s dashboard tells you.

Microsoft came later and hit harder. Microsoft’s own rollout announcement confirms that from 5 May 2025, Outlook, Hotmail and Live.com began requiring SPF, DKIM and a DMARC record with passing alignment from any domain sending 5,000 or more messages a day — and non-compliant mail is not filtered to junk, it is refused at the SMTP level with a 550 5.7.515 “access denied” response. That distinction matters operationally: a message in spam is a deliverability problem you can measure and fix; a message Microsoft never accepted never shows up in any report you own.

What changed in 2026: rejection, not foldering

Microsoft’s May 2025 shift to outright rejection is well documented, down to the exact error code senders see. What is less settled is where Google and Yahoo are heading next, and we want to be precise about the difference between what these platforms have announced and what the deliverability industry is reporting about them.

As of this writing, Google’s own sender guidelines page still describes non-compliance as risking that a message “might not be delivered as expected, or might be marked as spam” — not a guaranteed hard rejection. A cluster of deliverability vendors (dmarcian, Redsift, PowerDMARC and others publishing 2026 compliance guides) report that Gmail moved from temporary 421 deferrals to permanent 550 rejections for repeat non-compliant senders starting around November 2025, and that a p=none DMARC policy is increasingly treated as a yellow flag rather than a pass at volume, even though it technically still satisfies the published minimum. We have not found a Google or Yahoo announcement that states this in those terms — it is vendor reporting on observed enforcement behaviour, not a platform policy change we can point you to. Treat it as directionally credible and operationally worth acting on, not as gospel to quote to your CISO as an official rule.

What is not in dispute: publishing DMARC at p=none and stopping there is a starting position, not an end state. Every major mailbox provider’s own documentation frames p=none as a monitoring phase before you move to p=quarantine or p=reject. At real outbound volume, a domain that has sat at p=none for years reads as unmanaged, and unmanaged is exactly the signal these systems are built to filter on.

Domain and infrastructure architecture for senders at real volume

Most reply-rate problems at scale are not about what you are sending. They are about what else is sending from the same place.

Separate your domains by traffic type. Cold outbound, transactional mail (receipts, password resets, booking confirmations) and lifecycle/nurture mail behave completely differently from a mailbox provider’s point of view — different expected volumes, different engagement rates, different complaint tolerances. Send all three from one domain and a spike in cold-outbound complaints drags down the domain your customers rely on to receive their password reset. Most mature senders run at least three sending domains or subdomains: one for cold outbound, one for transactional, one for lifecycle marketing.

Use subdomains deliberately, not by accident. A subdomain (outbound.yourcompany.com versus notify.yourcompany.com) gets its own DKIM keys and can carry its own DMARC posture while still inheriting some of the parent domain’s trust. The mistake we see most often is a company that already has this structure but never told their outbound tool, which quietly reverts to sending from the root domain the moment someone reconfigures a CNAME.

Warm up new domains and IPs on a realistic curve. A brand-new sending domain or IP has no reputation, and mailbox providers treat sudden volume from an unfamiliar source as the single strongest spam signal there is. Deliverability practitioners and ESPs (Postmark and Mailgun both publish this guidance) converge on a similar shape: start at a few hundred sends a day to your most engaged contacts, increase gradually over four to six weeks rather than days, and watch spam-complaint and bounce rate at every step rather than following a fixed calendar regardless of what the metrics say. Skip the ramp and you can burn a domain’s reputation in the first week of a new campaign.

A shared IP pool is not a smaller dedicated IP — it behaves differently. On a shared pool, your deliverability partly rides on every other sender using that pool; a smaller sender can borrow reputation from well-behaved neighbours, but bad actors on the same pool drag everyone down. A dedicated IP puts you in full control — nobody else’s mistakes touch you, but you start from zero and build the reputation yourself. ESP guidance generally holds that a dedicated IP only earns its keep once you are sending consistent six-figure monthly volume; below that, a shared pool with a good reputation usually outperforms an under-warmed dedicated one.

Buying more inboxes is treating the symptom. Spinning up another twenty mailboxes to spread volume around does not fix a spam-complaint problem, a consent problem or a copy problem — it just gives the same underlying issue more surface area to fail on, and more domains to eventually burn. If your current infrastructure is already flagged, adding capacity accelerates the decline rather than reversing it.

SMS deliverability: the parallel compliance track

Email has mailbox providers gatekeeping delivery; SMS has carriers, and the registration requirements differ by country. In the US, unregistered A2P 10DLC brand and campaign registration is what the major carriers filter against — an unregistered 10-digit long code sending application-to-person traffic gets throttled or blocked regardless of message content, because the carrier has no vetted record of who is sending or why. In Australia, the relevant mechanism is SMS sender ID registration, which sits alongside the Communications Alliance’s Reducing Scam Calls and Scam SMS industry code (C661:2022), registered with the ACMA. These are not interchangeable: a US A2P registration does nothing for an Australian carrier, and an AU sender ID does nothing on a US 10-digit long code. We cover both registration processes in detail on the pages linked above — the short version for this page is that SMS deliverability at scale is a registration and carrier-trust problem before it is a content problem, exactly like email.

The uncomfortable point: deliverability is downstream of consent

Here is the part of this page that is easy to skip past. You can get SPF, DKIM and DMARC perfectly aligned, run a textbook six-week warm-up, split your domains cleanly by traffic type, and still land in the spam folder — because the platforms are not measuring your infrastructure in isolation, they are measuring what recipients do when your mail arrives. A list you cannot evidence consent for will generate complaints no amount of authentication fixes will offset, because Gmail, Yahoo and Outlook do not know or care whether the recipient technically opted in somewhere three years ago. They measure the click on “report spam,” not your intent when you bought or scraped the list.

This is also where the legal and technical layers meet without being the same thing. Consent, disclosure and opt-out rules under frameworks like the US TCPA or Australia’s Spam Act are a separate legal question from whether Gmail accepts your mail — we cover that layer, and the enterprise procurement questions that come with it, in our AI outbound compliance checklist for enterprise. The two layers reinforce each other: a list built without evidenced consent is both a legal exposure and a deliverability liability, and fixing one without the other leaves you still exposed.

It is also why we run outbound on a permission-and-relevance-first basis for corporate sales teams rather than maximising raw list size. A smaller list of contacts who match a real buying signal produces a lower complaint rate than a large, loosely-sourced one, and complaint rate is the metric every mailbox provider on this page is actually watching.

Diagnostic table: matching the symptom to the cause

Frequently asked questions

What counts as a “bulk sender” under Google and Yahoo’s rules?

Both providers apply their requirements to anyone sending more than 5,000 messages a day to their domains, counted in aggregate across your sending infrastructure, not per campaign. Google states this threshold directly in its sender guidelines. Below that line the requirements are still best practice, but enforcement is looser.

What spam complaint rate is actually safe?

Under 0.30% is the hard ceiling both Google and Yahoo publish; Google’s own guidance recommends staying under 0.10% and treating 0.30% as a line you should never approach, not a target to hover near.

Does my DMARC policy need to be set to p=reject?

Not to meet the published minimum — p=none with passing alignment satisfies Google and Yahoo’s stated requirements. In practice, deliverability vendors report that mailbox providers increasingly treat a long-parked p=none policy as a negative signal at volume, though this is industry reporting rather than a stated platform rule. Moving toward p=quarantine once your aligned mail is confirmed clean is the safer long-term position.

How long do I have to action an unsubscribe request?

Yahoo’s sender requirements specify two days from request to actioned. RFC 8058 defines the one-click mechanism itself — a compliant List-Unsubscribe-Post header lets the mail client fire the request with no further clicks from the recipient.

Should cold outbound and transactional email share a sending domain?

No. A complaint spike on a cold-outbound campaign will drag down the reputation of any transactional mail sharing that domain, including receipts and booking confirmations your existing customers rely on. Separate domains or well-managed subdomains contain the damage to the traffic type that caused it.

Is a dedicated sending IP always better than a shared pool?

Not below real volume. A dedicated IP gives you full control of your own reputation but starts from zero and needs its own warm-up; a well-managed shared pool can outperform an under-warmed dedicated IP for a sender who is not yet sending consistent six-figure monthly volume.

Is SMS deliverability governed by the same rules as email?

No — SMS runs on carrier registration rather than mailbox-provider authentication. In the US that is A2P 10DLC brand and campaign registration; in Australia it is sender ID registration under the ACMA-registered scam-SMS industry code. The two are not transferable across markets.