Microsoft and Gmail just turned cold email into a technical sport. Since May 2025, Microsoft refuses unauthenticated mail over 5,000 messages per day. Gmail requires SPF, DKIM, and DMARC for bulk senders. If your domain isn't configured correctly, your carefully crafted outreach is going straight to spam. Here's what you need to fix today.
The rules are not optional anymore
This isn't a suggestion. It's enforcement. Microsoft's threshold is 5,000 messages per day. Cross it without proper authentication and your mail is rejected outright. Gmail's rules are broader: any sender sending over 5,000 messages per day must have SPF, DKIM, and DMARC set up. They also require a one-click unsubscribe and a spam complaint rate under 0.10%.
That last number is the one most founders miss. 0.10% means one complaint per 1,000 emails. If you're sending 10,000 emails a month, that's ten complaints. Ten people clicking "report spam" instead of "unsubscribe" and your domain is flagged.
We've seen it happen. A customer running outbound to UK accountancy firms lost 60% of their deliverability overnight. Their open rates dropped from 38% to 11%. The emails were good. The infrastructure wasn't.
What makes 2026 different is that these thresholds are no longer reactive—they're preemptive. Both providers now run continuous authentication checks at the SMTP level, not just periodic reputation scoring. That means a misconfigured DKIM key or a missing DMARC alignment policy will trigger a hard bounce before your message ever reaches the spam folder. There is no warning period, no grace window for "fixing it next week." The technical standard is binary: pass or fail.
For small teams, the operational implication is stark. You can no longer rely on a third-party sending tool to "handle" authentication for you. Most ESPs will set up SPF and DKIM, but DMARC alignment—specifically, ensuring the domain in the From header matches the domain used for DKIM signing—is often left to the sender. If you're using a subdomain for tracking links or a separate domain for your sending IP, you've already introduced a misalignment risk. Gmail's parser checks this on every single message, not just bulk batches.
The complaint-rate threshold compounds the problem. Under 0.10% is not a target; it's a ceiling. To stay under it, you need list hygiene that filters out disengaged contacts before they become complainants. That means sunsetting leads who haven't opened in 90 days, removing anyone who hasn't replied to a previous sequence, and—critically—making the unsubscribe link visible and functional in every email. One-click unsubscribe is now a compliance requirement, not a courtesy. If a recipient has to hunt for the link or click through a preference center, they'll hit "report spam" instead. That single behavioral difference is what separates a flagged domain from a healthy one.
SPF, DKIM, and DMARC are table stakes now
If you're using a modern sending platform like Instantly, Smartlead, or Lemlist, these records are probably set up automatically. But "probably" isn't good enough when your pipeline depends on it. The 2026 enforcement shift isn't a technical tweak; it's a fundamental reclassification of authentication as the baseline for inbox placement. Microsoft and Gmail now treat a missing or misconfigured DMARC record less like a configuration error and more like a signal of intent. Unauthenticated bulk mail is increasingly routed to spam or rejected outright, regardless of content quality. This means the old workaround—layering a warmup tool on top of a sloppy DNS setup—no longer compensates for weak authentication. The providers have effectively outsourced the first layer of spam filtering to the sender's own DNS records.
Here's the checklist we run before any new domain goes live:
- SPF record includes only your sending platform's IPs. Too many includes and you'll hit the DNS lookup limit, which silently breaks authentication for recipients using strict alignment checks.
- DKIM key is unique to your domain, not shared with other customers on the platform. Shared keys create a systemic risk: if another sender on that key gets flagged, your domain inherits the reputational damage through association.
- DMARC policy is set to quarantine or reject, not just p=none. Gmail looks at your DMARC policy as a trust signal. A p=none policy tells the filter you're still testing, which is a reasonable stance for a brand-new domain—but not for one that's been sending for months. The longer you stay in monitoring mode, the more you signal that you haven't validated your own authentication chain.
- Your From domain matches your sending domain. No more sending from a .co while your website is .com. Beyond the obvious brand confusion, this mismatch breaks DMARC alignment, forcing you to rely on relaxed alignment—which providers increasingly treat as a weaker signal than strict alignment.
Most platforms handle this in their onboarding. But we've audited enough setups to know that half of them have a broken SPF record or a DMARC policy that's still in monitoring mode. The deeper issue is that these platforms optimize for speed-to-first-send, not for long-term authentication hygiene. They'll generate the records, but they won't verify that your DNS provider hasn't truncated the TXT value, or that your domain isn't already blacklisted from a previous owner's misuse. Fix that before you send another email. Authentication is no longer a prerequisite for delivery—it's the first filter that determines whether your carefully crafted outreach ever reaches a human inbox.
Spam rate under 0.10% is a product problem, not a technical one
Here's where it gets uncomfortable. The 0.10% spam complaint threshold isn't something you can configure your way out of. It's a content and targeting problem.
If your emails are getting marked as spam, it's because they look like spam. Or they're going to people who never asked for them and have no reason to care. The technical setup gets you to the inbox. The message keeps you there.
We've found that the biggest driver of spam complaints is irrelevant personalisation. Using someone's first name isn't personalisation. Mentioning their company name isn't personalisation. That's just mail merge. Real personalisation means referencing something specific: a recent funding round, a job posting, a change in their pricing page.
If you can't find something specific to say, don't send the email. One fewer email is better than one more spam complaint.
This is also why the 2026 enforcement shift matters more than most founders realise. Microsoft and Gmail aren't just filtering on headers or sending volume anymore — they're correlating complaint rates with engagement signals across the entire mailbox. A recipient who deletes your email without opening it, then later marks a different email from you as spam, still counts against your sender reputation. The complaint is the final vote, but the pattern of disengagement leading up to it is what triggers the algorithmic review. That means your deliverability is now a lagging indicator of your targeting quality, not a technical metric you can tune in isolation.
For small sales teams, this collapses the margin for error. You can't afford a 10,000-email blast to a purchased list and hope the spam rate stays under 0.10% because you've configured DKIM correctly. The math simply doesn't work. At that volume, even a 0.5% complaint rate — which feels low in absolute terms — gets you flagged. The only sustainable approach is to shrink your list to people who have demonstrated intent, and then personalise so specifically that the email feels like a reply to something they've done, not a broadcast to a segment. That's not a technical constraint. It's a product decision about who you're willing to contact and why.
Domain reputation is your new competitive advantage
Here's the opportunity hiding inside these regulations. Most small teams are still sending from shared domains or poorly configured setups. Their deliverability is dropping. Your properly configured domain is now a differentiator.
We've seen it play out. Two competitors sending to the same ICP. One has clean authentication and a spam rate of 0.04%. The other has a broken DMARC record and a spam rate of 0.18%. The first lands in the primary inbox. The second lands in promotions or spam. Same message quality, wildly different results.
This is the regulatory moat. The teams that treat email infrastructure as a core competency will pull ahead. The ones that ignore it will wonder why their outbound stopped working.
The shift is structural, not cosmetic. Microsoft and Gmail are no longer evaluating individual messages in isolation; they are scoring the sending identity across a rolling window of volume, complaint velocity, and authentication consistency. That means a single misconfigured SPF record or a sudden spike in bounces doesn't just hurt one campaign—it depresses the trust score for every future send from that domain. For small teams, this changes the calculus of outreach entirely. You can no longer compensate for weak infrastructure with better copy or more personalization. The gatekeeping happens before your message is even rendered.
What does this mean operationally? It means domain warm-up is not a one-time ritual but a continuous discipline. It means you need a dedicated subdomain for marketing sends, isolated from your transactional email, so a bad campaign doesn't poison your customer-facing communications. It means monitoring your DMARC alignment and your spam complaint rate weekly, not quarterly. The teams that internalize this will treat deliverability as a product feature, not an IT afterthought. They will build feedback loops that catch authentication drift before it compounds. And because most of their competitors will not do this—will continue to treat email as a write-and-send activity—the gap will widen every quarter. The regulation is not the obstacle. The inertia of everyone else is your opening.
What we'd do next
Run an audit of your current setup today. Check your SPF, DKIM, and DMARC records. Look at your spam complaint rate in your sending platform. If any of those are off, fix them before your next campaign. But don't stop at the technical layer—that's only the first gate. The 2026 rules are designed to force a structural shift in how you acquire and segment your list. A perfectly authenticated domain won't save you if your recipient engagement signals are weak. Microsoft and Gmail are now weighting reply rates and manual "mark as not spam" actions more heavily than ever before. That means your list hygiene is a strategic asset, not a compliance checkbox. If you're renting lists or scraping contacts, those domains are already flagged in shared reputation databases. You need to move to a verified opt-in model where every address has a clear, documented source.
Then look at your emails. If you can't point to the specific reason each prospect should care, rewrite it. The rules are stricter now, but the fundamentals haven't changed. Send relevant emails to relevant people from a properly configured domain. That's the whole game. Yet the nuance is in the cadence and the content architecture. A single irrelevant email can spike your complaint rate above the 0.1% threshold that triggers automatic throttling. You need to build a pre-send scoring system that evaluates each message against the recipient's firmographic fit, recent engagement with your brand, and the timing of your last touch. If a prospect hasn't opened your last three emails, they're not a lead—they're a liability. Purge them or move them to a re-engagement flow with a clear opt-out prompt. The senders who survive 2026 will be the ones who treat every email as a permission-based interaction, not a broadcast event.
If you want to skip the manual audit, see how MiraReach handles this. We check deliverability setup before we draft a single email.
— Mira