Bugrahan Unsal, home

EmailBy 6 min read

Email deliverability in 2026: the Gmail, Yahoo and Outlook rules, and what CASL adds

Gmail, Yahoo and Outlook now send bulk email that fails their rules to spam or reject it outright. These are the rules, the dates they took effect, what Canada’s anti-spam law adds and the order I fix things in for a store or B2B company.

Emails flying out of a phone held over a laptop, on their way to the inbox

Since February 2024, Gmail and Yahoo have asked anyone who sends email at volume to prove who they are, make leaving easy and keep spam complaints low. Microsoft added similar rules for Outlook.com in May 2025. Mail that misses them goes to spam or bounces, which is why a campaign can show as sent and still miss the inbox.

What changed, and when

  • October 3, 2023: Google announced rules for bulk senders to Gmail, with Yahoo backing the same standard.
  • February 1, 2024: Gmail’s requirements took effect. Yahoo began enforcing its own in February and rolled them out gradually through the first half of 2024.
  • June 2024: One-click unsubscribe became enforceable at both. Gmail also stopped offering mitigation, its help with delivery problems, to bulk senders with a spam rate above 0.3%.
  • May 5, 2025: Outlook.com began enforcing SPF, DKIM and DMARC for domains that send more than 5,000 emails a day. Failing mail goes to Junk and can be rejected with the error 550; 5.7.515.
  • November 2025: Gmail began “ramping up its enforcement on non-compliant traffic”, in Google’s words, with temporary and permanent rejections.

Enforcement started gradually and has tightened since. Domains new to bulk sending face a faster enforcement timetable at Gmail, and Google added a Compliance status dashboard to Postmaster Tools to help senders meet the rules.

Who counts as a bulk sender

Google defines a bulk sender as one that sends close to 5,000 messages or more to personal Gmail accounts in 24 hours. Mail from every address on the same primary domain counts toward that number, and once Gmail gives you the status, it never expires. The rules cover personal Gmail accounts only, not Google Workspace.

Microsoft’s threshold is more than 5,000 emails a day to Outlook.com addresses. Yahoo says it will not specify a volume threshold at all.

A B2B company that mostly emails work addresses may sit below these lines. I would still set up everything in this guide: one campaign to a list full of Gmail addresses can cross the threshold, and the label is permanent.

SPF, DKIM, DMARC and alignment

Three DNS records prove a message really comes from you:

  • SPF lists the servers allowed to send mail for your domain.
  • DKIM signs each message with a key published in your DNS. Gmail requires a key of at least 1,024 bits.
  • DMARC tells receiving servers what to do with mail that fails and sends you reports.

Gmail, Yahoo and Microsoft all ask bulk senders for both SPF and DKIM, plus a DMARC record of at least p=none, the policy that only monitors. Then check alignment: the domain in your From address must match the domain that passed SPF or DKIM (a subdomain of the same root counts). Only one of the two has to align, though Microsoft prefers both. If your email platform signs with its own domain and uses its own bounce address, both checks pass, neither aligns and DMARC fails.

For every sender, bulk or not, Gmail also asks for SPF or DKIM, valid forward and reverse DNS, a TLS connection and a spam rate below 0.3%. And send from your own domain, never a @gmail.com address: your platform can’t authenticate a domain you don’t own, and Google’s rules say not to impersonate Gmail From headers.

One-click unsubscribe and the two-day clock

Gmail and Yahoo require bulk senders to support one-click unsubscribe in marketing and subscribed messages. It works through two email headers, as set out in RFC 8058:

  • List-Unsubscribe-Post: List-Unsubscribe=One-Click
  • List-Unsubscribe: <https://example.com/unsubscribe/abc123>

Keep a clearly visible unsubscribe link in the body as well. Google says a mailto: link alone doesn’t meet its one-click requirement. Transactional messages, such as order confirmations and password resets, don’t need one-click unsubscribe. Google asks you to process requests within 48 hours and Yahoo within 2 days, while Microsoft asks every sender for an unsubscribe option that is easy to find and use.

Spam complaint limits: 0.1% and 0.3%

Every “Report spam” click counts against you. Google wants your spam rate below 0.1% and never at 0.3% or higher, measured daily in Postmaster Tools. In plain numbers, 0.1% is one report for every 1,000 emails and 0.3% is three. Above 0.1%, inbox delivery already suffers. Above 0.3%, Google won’t offer mitigation until your rate stays under 0.3% for seven days in a row.

Yahoo’s limit is also 0.3%, calculated on mail delivered to the inbox, so it may not match your own count. The fix sits upstream, in who you email. Google’s own advice: make sure people opt in, confirm each address, never buy lists, ask subscribers from time to time whether they want to stay and consider removing people who never open.

What CASL adds in Canada

The mailbox rules decide where your email lands. Canada’s Anti-Spam Legislation (CASL) decides whether you may send it at all. It covers commercial messages sent to people in Canada, including from other countries, so a US store emailing Canadian customers must follow it too. The basics, from the CRTC’s guidance:

  • Consent. Express consent doesn’t expire, but people can withdraw it at any time. Implied consent lasts two years after a purchase and six months after an inquiry.
  • How you ask. The person must tick the box themselves, and the request can’t be bundled with your terms and conditions. It must include your mailing address and say that consent can be withdrawn.
  • Abandoned carts. A cart left behind is not a purchase. The CRTC suggests asking for express consent at checkout: “if you are unsure, ask for express consent.”
  • Every message identifies the sender and carries a mailing address and an unsubscribe link, both valid for at least 60 days. Unsubscribes must be processed within 10 business days.
  • B2B. A business card or a published work address implies consent only if your message relates to the person’s role and they haven’t said they don’t want it. A list of published addresses that someone else compiled or sold doesn’t create implied consent on its own. Messages between organizations that already have a relationship, about the recipient organization’s activities, are exempt.
  • Proof. The sender has to prove consent, so keep the date, source and wording of every opt-in.

Penalties go up to $1 million per violation for an individual and $10 million for a business.

A checklist for stores and B2B companies

This is the order I work in when I audit an email program: the technical setup first, then consent, then monitoring.

  1. Send from your own domain. Give receipts, newsletters and account alerts their own From addresses, as Google recommends, and keep each one consistent.
  2. Publish SPF, DKIM and DMARC. Add the records your email platform gives you, start DMARC at p=none with a rua address for reports and check that DKIM aligns with your From domain.
  3. Turn on one-click unsubscribe for every campaign and flow, keep a visible link in the footer and test that one click removes the address.
  4. Fix your signup forms. An unticked box, a consent line with your mailing address and the right to withdraw, and a record of when and where each person joined.
  5. Clean the list. Stop mailing addresses that bounce, ask quiet subscribers whether they want to stay and remove those who never open.
  6. Watch the numbers every week. Spam rate and Compliance status in Google Postmaster Tools, plus Yahoo’s complaint reports, which you get by enrolling your DKIM domain in its Complaint Feedback Loop.
  7. Tighten DMARC. Once the reports show only your own services, move from p=none toward quarantine and then reject, the policy Microsoft recommends.

Ask for consent at the moment you collect the address. On the Lumen Painting website, the AI assistant saves an estimate request only after the visitor agrees to be contacted. For Shopify stores, the abandoned cart rule above shapes your Klaviyo flows, and consent for tracking is covered in privacy, consent and tracking in Canada. Audits, flows and list cleanup are part of my email marketing and CRM service, and signup forms with consent built in are part of website development.

Sources

Bugrahan Unsal is a B2B and B2C marketing director in Toronto. He leads marketing for Glass Railing Store and RF Transparent and builds AI tools and websites. More about Bugrahan.

Follow on LinkedIn (opens in a new tab)

More from the blog

Want your email setup checked before the next campaign?

Tell me about your business and what you want to change. A few sentences are enough, and I reply by email.

Get a free quoteSchedule an interview