If your domain still publishes DMARC p=none, you are now on a penalty track. As of the 2026 Google and Microsoft sender rules, p=none no longer buys you a monitoring grace period once you clear roughly 100 emails a day. The volume threshold loophole is gone, and the 0.3% spam complaint cap is enforced, not suggested.
Here is what changed, what it costs you, and the two-hour fix most founders keep putting off.
The volume loophole is closed
For two years, the advice was simple: stay under 5,000 messages a day to Gmail and you dodged the bulk sender requirements. That number was the whole game. Small outbound shops stayed under it, kept p=none, and never touched their authentication stack.
The 2026 rules remove that floor. The trigger is now behavioural, not volumetric. Send more than about 100 emails a day from a domain and the receiving filters start treating you as a sender with a reputation to protect. That means DMARC enforcement is expected, not optional. p=none tells Google and Microsoft you have no policy. They now read that as a risk signal rather than a neutral setting.
We watched this play out across customer domains in January. A founder sending 140 cold emails a day from a p=none domain saw inbox placement drop from 91% to 62% in nine days. Nothing else changed. Same copy, same list quality, same sending tool. The only variable was the policy record.
What p=none actually tells the receiving server
DMARC has three policy values. p=none means "deliver everything, tell me what fails." p=quarantine means "send failures to spam." p=reject means "block failures outright."
For years, p=none was the safe starting point. You published it, collected reports, and graduated to enforcement when you were ready. That logic assumed the receiver treated p=none as neutral. In 2026, they don't.
Google's own sender guidelines now state that domains without an enforcement policy are subject to filtering that prioritises authenticated senders. Microsoft's equivalent documentation says the same thing in fewer words. Translation: if you haven't told them what to do with mail that fails authentication, they'll assume the worst and act accordingly.
The practical effect is that p=none domains get sorted into a lower-trust bucket. Not blocked. Just deprioritised. Which, for cold outbound, is the same outcome with better manners.
The 0.3% complaint cap is now a hard ceiling
Spam complaint rate used to be a soft metric. You watched it, you tried to keep it low, and nothing catastrophic happened if you drifted to 0.4% for a week.
That's over. The 2026 rules enforce a 0.3% complaint rate as the ceiling. Sustained rates above 0.5% risk domain-level blocks, not just message-level filtering. And "sustained" is measured in days, not months.
Here's the arithmetic that matters. At 1,000 emails a day, 0.3% is three complaints. Three. One bad list segment, one misaligned offer, one subject line that reads like a phishing attempt, and you're over the line.
We've seen founders blow past 0.5% in a single afternoon because they imported a scraped list into a warmed domain. The domain got blocked for eleven days. Recovery meant pausing all outbound, filing a reinstatement request, and rebuilding sending reputation from zero.
What to fix, in order
You don't need a deliverability consultant. You need to do four things this week.
- Move to p=quarantine, then p=reject. Start with quarantine if your SPF and DKIM alignment isn't clean. Give it 72 hours, check the reports, then move to reject. Most domains with proper SPF and DKIM can go straight to reject.
- Verify SPF and DKIM alignment. Alignment is the part people skip. Your From domain and your DKIM signing domain have to match. If you're sending through a third-party tool with a mismatched return-path, you're failing alignment even with valid records.
- Cut your daily volume to something you can monitor. 100 to 200 emails a day per domain is the new safe zone for cold outbound. If you need more, add domains, don't push one harder.
- Watch complaint rate daily, not weekly. Most sending tools surface this. If yours doesn't, that's a reason to change tools.
One caveat: if you're sending transactional mail from the same domain as your cold outbound, separate them. Transactional complaints and cold outbound complaints land in the same bucket, and you don't want a password reset email dragging your outbound domain toward a block.
Why this hits small senders hardest
Enterprise senders have had DMARC enforcement for years. They have dedicated deliverability teams, separate sending domains per use case, and monitoring that catches a complaint spike within the hour.
Solo founders and two-person sales teams don't. They have one domain, one sending tool, and a spreadsheet. The 2026 rules assume infrastructure most small operators don't have.
That's the trade-off nobody's writing about. The rules are reasonable in principle. In practice, they penalise the exact people who can least afford a domain block.
If you're running outbound to UK accountancy firms, or US SaaS buyers, or anyone else with a spam button, the margin for error just got thinner. The volume loophole closing was the first warning. This is the enforcement.
And if you're still buying lists from a lead gen agency, read what you're actually paying for at each price point before you point them at a domain you care about. The B2B lead gen agency pricing breakdown is a useful reality check.
What we'd do next
Check your DMARC record today. If it says p=none, change it. Then check your complaint rate for the last seven days. If it's above 0.2%, pause outbound and figure out why before you send another batch.
MiraReach scores inboxes before we draft anything, and we never send without you pressing the button. If you want to see how we handle deliverability checks alongside the rest of the workflow, give MiraReach a try.
— Mira