Three records that prove you are you
Mailbox providers decide where your email goes largely on whether they can trust the domain in the From: line. Three DNS records establish that trust.
SPF lists the servers allowed to send for your domain. DKIM adds a cryptographic signature to each message so the receiver can check it wasn't altered and really came from your domain. DMARC ties the two to the visible From: domain (this is “alignment”), tells receivers what to do when a message fails (p=none, quarantine or reject), and asks them to send you reports.
DMARC itself was updated in May 2026: RFC 9989 replaced the original RFC 7489, added tags for non-existent subdomains and a test mode, and removed the old pct tag [6]. Existing v=DMARC1 records keep working; just stop using pct. Google asks for DKIM keys of at least 1024 bits and recommends 2048 [1].
_dmarc.yourdomain.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com" Start at p=none, read the reports for a few weeks, fix every legitimate sender that fails, then move to p=quarantine and eventually p=reject.
What Gmail and Yahoo require
Since February 2024 Google has required every sender to Gmail to authenticate with SPF or DKIM, have valid forward and reverse DNS, use TLS, format messages properly, and keep the spam rate reported in Postmaster Tools below 0.3% [1]. Google's stricter advice is to stay under 0.1%: rates above that already hurt inbox placement [1,2].
Bulk senders, roughly 5,000 or more messages a day to personal Gmail accounts, must also use both SPF and DKIM, publish DMARC, align the From: domain, and for marketing mail offer one-click unsubscribe plus a visible unsubscribe link [1]. Two details catch teams out: mail from the same primary domain counts together, and once you cross the threshold you are permanently a bulk sender [2]. A company that runs newsletters and outreach on one domain can get there in aggregate.
Google began ramping up enforcement, meaning temporary and permanent rejections, in November 2025 [2]. Unsubscribe requests must be processed within 48 hours [2]. Yahoo's rules mirror Google's, including SPF and DKIM for bulk senders, aligned DMARC, one-click unsubscribe and honoring unsubscribes within two days [3].
- One-click unsubscribe is a specific standard (RFC 8058): a List-Unsubscribe header with an HTTPS URL, a List-Unsubscribe-Post header, both covered by your DKIM signature, and a POST that works without a login or cookies [4].
- A mailto: link or a link to a landing page alone does not satisfy Google's requirement [2].
Outlook.com, and Microsoft 365 limits
Microsoft announced in April 2025 that domains sending more than 5,000 emails a day to Outlook.com, Hotmail and Live addresses must pass SPF and DKIM and publish DMARC of at least p=none, aligned with SPF or DKIM [5]. Enforcement began on May 5, 2025, first by routing non-compliant mail to Junk; the rejection it moves to reads “550; 5.7.515 Access denied, sending domain does not meet the required authentication level” [5].
If you read older material saying Microsoft 365 caps each mailbox at 2,000 external recipients a day: Microsoft cancelled that plan in January 2026 [8].
Volume, ramp-up and warm-up
Google Workspace allows each user up to 2,000 messages a day (1,500 by mail merge) and 3,000 external recipients, and notes the limits can change without notice [7]. These are ceilings, not targets. No mailbox provider publishes a “safe” number; Google's guidance is simply to increase volume gradually and watch spam reports [2].
Vendor data points the same way. In Woodpecker's benchmark of the last 90 days of 2025, mailboxes sending 1–20 emails a day had a 2.0% median reply rate, against 0.5% for mailboxes sending 101–200 a day [16]. That is a correlation, and heavy senders likely differ in other ways too, but nobody's data suggests that more volume per mailbox helps. Instantly suggests new domains start at 5–10 emails a day and ramp over four to six weeks [17].
Gradually ramping real volume is uncontroversial. Automated “warm-up networks” that trade fake opens and replies between mailboxes are not: Spamhaus lists warm-up tools and fake engagement among the practices it criticizes [13]. Treat synthetic engagement as something anti-abuse organizations consider manipulation.
Bounces, list verification and catch-alls
Mail servers report failures with enhanced status codes. A 4.x.x code is temporary, so retry later with backoff. A 5.x.x code is permanent; 5.1.1 means the mailbox does not exist [11]. Suppress hard bounces immediately and never retry them.
Keep bounce rate under 2% [17,18]. Smartlead's 2026 data puts the typical bounce rate at 1.54% and calls 2% the danger line [18], and Woodpecker found campaigns under 2% bounce got noticeably more replies than those over 20% [16]. In Saleshandy's platform data, verified-valid addresses bounced at 1.21% and unverified ones at 2.11% [19], so verify lists shortly before you send.
Catch-all domains accept any address during the SMTP conversation, so a verifier can't confirm the mailbox exists. In a small Hunter test, catch-all addresses bounced far more often than verified ones [12]. Cap their share of a send and mail them in small batches.
Blocklists, and what anti-abuse groups think of cold email
Spamhaus runs the most widely used blocklists, covering IPs (SBL, XBL, CSS, PBL) and domains (DBL). Lookups and removal requests go through check.spamhaus.org, and removal is at Spamhaus's sole discretion [14]. Fix the cause before asking; listings recur if the behavior does.
You should know where the anti-abuse community stands. In June 2025 Spamhaus wrote that “cold emailing, as it's practiced today, is spam,” defining spam by consent rather than content, and named scraping, warm-up tools, lookalike domains and AI-generated templates at scale [13]. M3AAWG published a position in November 2025 aimed at cold email that mimics one-to-one correspondence [15]. Being legal under CAN-SPAM and being welcome at the receiving end are different bars. The rest of this course aims at the second.
Why opens are no longer a metric
Open tracking works by loading an invisible image. Apple's Mail Privacy Protection, launched in 2021, stops senders learning when an email is opened [9]; in practice Apple preloads remote images, so an “open” registers whether or not a person read anything. Apple accounted for 76.56% of measured opens in Litmus's September 2026 data [10], and Litmus treats those opens as unreliable.
Benchmark publishers have adjusted: Smartlead's 2026 report drops open rate entirely [18], and Woodpecker says to treat reply rate as the number that matters [16]. Never use opens to judge a subject line or trigger a “saw you opened it” follow-up. Many practitioners also switch off open tracking and keep links out of first emails, though that is consensus rather than a measured result.
