In short
- Google, Yahoo and Microsoft all apply bulk sender rules at 5,000 or more messages a day per domain.
- Since November 2025 non-compliant mail is rejected outright rather than filtered into spam.
- Microsoft returns error 550 5.7.15 Access denied. Nothing arrives, and no open rate shows it.
- SPF, DKIM and DMARC are all required, with DMARC at p=none as the floor.
- One-click unsubscribe under RFC 8058 is required for marketing mail and must work without a login.
- The spam complaint ceiling is 0.3%, and Yahoo calculates it in a way that punishes you twice.
What changed, and why your dashboard did not tell you
For most of the last decade, a badly configured marketing email had a soft outcome. It went to the spam folder. Somebody might still find it. Your reporting still counted it as delivered.
That is over. Google, Yahoo and Microsoft have each changed from filtering non-compliant mail to rejecting it. Microsoft’s enforcement completed in November 2025. A rejected message is never accepted by the receiving server, so it never reaches a folder of any kind.
The reason this catches teams out is that rejection is invisible in the places marketers look. Open rate is calculated on messages that were delivered. If a third of your sends are being refused at the door, your open rate can look healthy while a third of your audience hears nothing.
The number to watch is the bounce and rejection log in your sending platform, and specifically the error codes in it.
The rules, stated plainly
Who they apply to
Bulk sender requirements apply at 5,000 or more messages a day to a given provider from a given domain. Google, Yahoo and Microsoft have converged on the same threshold.
Two things about that number are commonly misread. It is per domain, so splitting sends across several sending domains changes what counts. And it is per provider, so 5,000 to Gmail is what matters, rather than 5,000 in total across every mailbox provider.
Authentication: SPF, DKIM and DMARC
All three are required.
- SPF must pass for the sending domain. The DNS record has to list every authorised host, and it has to stay accurate as you add tools.
- DKIM must pass, which proves the message was not altered in transit.
- DMARC must exist, with a minimum policy of p=none. Stronger policies of quarantine or reject give better protection against someone spoofing your domain.
The requirement people miss is alignment. The domain in the From: header has to align with either the SPF domain or the DKIM domain. A message can pass SPF and DKIM and still fail DMARC because neither aligns with what the recipient sees in the From: line.
One-click unsubscribe
Marketing and promotional mail must carry a one-click unsubscribe header under RFC 8058.
Three conditions attach to it. The link has to work without forcing the recipient to log in. The request has to be honoured within two days. And transactional mail, meaning order confirmations, password resets and similar, is exempt.
An unsubscribe link buried in a preference centre that asks people to sign in does not satisfy this. Neither does one that takes a week to process.
The spam complaint threshold
The enforcement ceiling is 0.3%, and all three providers recommend staying below 0.1%.
There is a detail here that the guides rarely cover, and it costs money. Google calculates the complaint rate against everything it accepted. Yahoo calculates it against inbox-delivered mail only, excluding what already went to spam.
The consequence compounds. Once some of your mail starts going to spam at Yahoo, the denominator shrinks, so the same number of complaints produces a higher rate, which sends more mail to spam. A sender who is slightly over the line at Google can be badly over it at Yahoo.
What this means for cold outbound specifically
If you run outbound, the rules above are a floor rather than a strategy.
Cold email carries a higher complaint rate than opted-in marketing by its nature, so the 0.3% ceiling arrives sooner. The standard answer is to keep that volume away from the domain your invoices and support replies go out on.
Separate sending domains give full isolation, because a blocked domain has no effect on your primary. Subdomains are easier to set up and give partial isolation, since reputation on a subdomain is evaluated separately but still associates with the parent. Teams that start on a subdomain often change to separate domains once volume rises.
Whichever you choose, warm-up is not optional and cannot be compressed. A new domain sending thousands of messages in its first week is the clearest possible signal of a problem.
The check to run this week
None of this requires buying anything. It requires an hour.
- Look up your own SPF, DKIM and DMARC records for every domain you send from, including the ones your marketing platform sends on your behalf.
- Confirm alignment. Check that the From: domain matches the SPF or DKIM domain, rather than assuming that passing both is enough.
- Send yourself a marketing email and confirm the one-click unsubscribe appears in the mail client and works without a login.
- Open the bounce log in your sending platform and search for 550 5.7.15 and similar rejection codes. This is where refused mail shows up, and where nobody looks.
- Find your complaint rate for the last 90 days, per provider rather than in aggregate.
- Count your daily volume per provider per domain, and work out whether you cross 5,000.
If step four returns anything, stop and fix that before writing another campaign. There is no subject line that rescues a message the server refused.
Questions, answered
We send fewer than 5,000 a day. Do these rules apply to us? The formal requirements start at that threshold, and the underlying behaviour does not. Mailbox providers evaluate authentication and complaints on every sender. Below the threshold you are less likely to be rejected outright and just as likely to be filtered.
Our platform handles authentication. Is that enough? Usually it handles DKIM and its own SPF include. Alignment and DMARC are set on your DNS, so they are yours. This is the most common gap we find.
Should DMARC be set to reject? Eventually. Starting at p=none while you read the reports is sensible, because going straight to reject can block legitimate mail from tools you had forgotten about. The point of p=none is to find those before they break.
Does a high spam rate ever recover? Yes, though slowly, and only if the cause is removed. Sending more mail to prove the list is fine makes it worse.
Do these rules apply to B2B mail to corporate mailboxes? Google and Microsoft rules cover their consumer services directly, and corporate Microsoft 365 tenants inherit much of the same filtering behaviour. Assume they apply.
Sources
- Microsoft, “Strengthening the Email Ecosystem: Outlook’s New Requirements for High-Volume Senders”, Microsoft Tech Community.
- Google and Yahoo bulk sender requirements, as summarised by PowerDMARC, Red Sift and dmarcian.
- Validity, “Keeping the Inbox Safe: Microsoft’s New Bulk Email Rules Explained”.
- RFC 8058, one-click unsubscribe.
This is one part of a bigger picture. Start with our guide to B2B email marketing for the whole sequence.