THE 2026 GUIDE TO NOT LANDING IN SPAM

In February 2024, Gmail and Yahoo stopped asking nicely. Bulk senders (anyone sending roughly 5,000+ messages a day to their users) got a hard list of requirements, and mail that didn't meet them started going to spam or getting rejected outright. Microsoft followed for Outlook senders in 2025. The rules haven't relaxed since; they've tightened, and enforcement has crept down to smaller senders too.

The good news: the rules are public, mechanical, and completely achievable for a small team in an afternoon or two. This guide covers all of them, in the order that matters.

1 · Authentication: SPF, DKIM and DMARC, and they must agree

Authentication answers one question for the receiving server: is this message really from the domain it claims? Three DNS records do the work:

• SPF lists which servers may send mail for your domain. One TXT record. If your ESP sends for you, their include goes in it.
• DKIM is a cryptographic signature on each message, proving it wasn't tampered with. Your ESP gives you a CNAME or TXT record to publish.
• DMARC tells receivers what to do when SPF or DKIM fail, and gives you reports on who's sending as you. The 2024 rules made a DMARC record mandatory for bulk senders; p=none is the accepted minimum, but plan the journey to p=quarantine.

The part people miss is alignment: the domain in your visible From address must match the domain SPF or DKIM validated. Sending "from" you@yourbrand.com while only your ESP's own domain signs the mail fails alignment, and fails the requirement. Set up a custom sending domain in your ESP; every serious one supports it.

2 · One-click unsubscribe, the real kind

Bulk senders must support RFC 8058 one-click unsubscribe: List-Unsubscribe and List-Unsubscribe-Post headers that let Gmail render its own "Unsubscribe" button, and you must honour the request within two days. A link in your footer is not a substitute; the headers are the requirement. Every mainstream ESP now sets them; if you send through your own infrastructure, this one is on you.

Counterintuitive but true: easy unsubscribes protect you. A subscriber who can't find the exit uses the "Report spam" button instead, and that costs you roughly a hundred times more.

3 · The complaint-rate maths

The headline number of the whole regime: keep your Gmail user-reported spam rate under 0.3%, and ideally under 0.1%. At 0.3%+ sustained, your mail starts failing. Not just the campaign that offended, everything after it.

Do the arithmetic for your own list: on a 20,000-send campaign, 0.3% is just 60 people tapping "spam". Sixty mildly annoyed people. That's why complaint rate is really a consent problem: people report mail they don't remember opting into. Old lists, purchased lists, and "we imported everyone who ever bought" lists blow this number faster than any subject line can save it.

Watch it for free in Google Postmaster Tools. If you do only one monitoring thing after reading this, register there.

4 · Bounce rate: the number you control before you send

Complaints punish you for who you email; bounces punish you for not knowing whether they exist. Mailbox providers read a high hard-bounce rate as "this sender doesn't know their own list", the signature of a spammer. ESPs enforce it before Gmail even sees the problem: cross ~2% and you get warnings; sit near 5% and you're looking at account review or suspension. (We wrote a whole piece on the thresholds ESPs won't put in writing.)

Bounces are also the most fixable number in email: verify addresses before the send, not after the damage. Lists decay at roughly 2–3% a month as people change jobs and abandon inboxes; a list untouched for a year is carrying a quarter of dead weight. Clean it and your bounce rate drops to a rounding error the same afternoon.

5 · List hygiene is the multiplier on everything above

Authentication proves who you are. Hygiene proves you're worth listening to. The practices that hold the whole regime together:

• Verify at the point of capture. Catch typos and disposables before they ever enter the list. An API call at signup costs less than one bounce.
• Clean before big sends. Black Friday on a year-old list is how deliverability horror stories start.
• Cut the chronically unengaged. Someone who hasn't opened in a year is a complaint (or a recycled spam trap) waiting to happen. Win-back once, then let go.
• Never buy a list. Purchased lists are where spam traps live, consent doesn't, and complaint rates go to die. No exceptions.

6 · Engagement: the signal you can't fake

Once the mechanical requirements pass, inbox placement is decided by how your last few campaigns performed: opens, replies, moves-to-inbox on one side; deletes-without-reading and spam reports on the other. The practical implications: send to people who recently engaged more often than to those who haven't; keep volume consistent rather than spiky; and warm up any new domain or IP gradually instead of going from zero to 50,000 overnight.

7 · The infrastructure details that trip people up

• Reverse DNS: your sending IPs need valid PTR records (your ESP handles this on shared infrastructure).
• TLS: mail must be delivered over an encrypted connection. Again, any modern ESP has it, but check if you self-host.
• Consistent From: pick a From domain and stay on it. Reputation accrues to the domain; changing it restarts the meter.
• Subdomain strategy: send marketing from a subdomain (news.yourbrand.com) so a bad campaign can't drag down your transactional mail.

The checklist

authentication gets you to the door. a clean list gets you through it ✦

Everything in the left column except one row is a one-time setup. The exception, bounces, is the ongoing one, and it's the row this whole site exists for.

← back to all guides