TL;DR

As of February 2024, Gmail and Yahoo reject bulk senders that fail SPF, DKIM, or DMARC alignment. Not two of three. One. They also require a one-click unsubscribe header and a spam complaint rate under 0.3 percent for anyone sending more than 5,000 messages a day. Content filters, warm-up lore, and unsubscribe copy all matter later, but if your DNS is wrong the message never reaches the content filter. Fix authentication first, sending reputation second, everything else after.

What actually decides inbox vs spam?

Inbox placement is a weighted score that Gmail, Outlook, and Yahoo compute per sender. The inputs, in rough order of weight: is the mail cryptographically signed and aligned, does the sending IP and domain have a positive history, do recipients open and reply, do recipients hit "report spam", and does the message body look like something a human wrote to another human.

  • Authentication is a hard gate. Fail SPF + DKIM alignment and you are in spam before content is even read.
  • Reputation is a slow gate. It builds and decays over weeks.
  • Content is the last gate. Fix it last because fixing it first without the first two changes nothing.

SPF, DKIM, DMARC: the how-to

SPF

SPF is a TXT record on your sending domain that lists which servers may send mail as you. Example record for a domain that sends via Google Workspace:

v=spf1 include:_spf.google.com ~all

example SPF record

The ~all is a soft fail. Use -all (hard fail) only once you are certain every sending source is listed. Missing sources cause legitimate mail to be rejected.

DKIM

DKIM signs each outgoing message with a private key. The public key sits in a TXT record at selector._domainkey.yourdomain.com. Your email provider generates the key. For Google Workspace the selector is usually google, so the record lives at google._domainkey.yourdomain.com. Publish exactly what the provider gives you, then flip on signing in the admin console.

DMARC

DMARC tells receivers what to do when SPF or DKIM fail, and where to send reports. A safe starting record on _dmarc.yourdomain.com:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; adkim=s; aspf=s

example DMARC record (monitoring mode)

Start at p=none for two weeks, read the aggregate reports, fix any legitimate source that fails alignment, then move to p=quarantine and eventually p=reject. Gmail and Yahoo require at least p=none for bulk senders.

Send from a subdomain, not the root

Cold outreach should send from a subdomain like mail.yourdomain.com or go.yourdomain.com. That way a reputation hit on outbound never damages your transactional or root-domain mail.

What do the 2026 Gmail and Yahoo rules require?

In February 2024 Google and Yahoo published aligned bulk-sender requirements. They apply to any sender sending more than roughly 5,000 messages per day to Gmail or Yahoo users, and they are enforced by silent spam-folder placement, not by error responses.

  • SPF and DKIM must both pass and align with the From domain.
  • DMARC record required at minimum p=none.
  • One-click List-Unsubscribe header (RFC 8058) required.
  • Spam complaint rate must stay under 0.3 percent, and ideally under 0.1 percent.
  • Bounce rate must stay under 2 percent.
  • From address must not impersonate Gmail or Yahoo domains.

Google sender guidelines (official) Google docs.

Yahoo sender best practices (official) Yahoo docs.

Google Postmaster Tools (monitor your reputation) Postmaster.

How do you warm up a new sending domain?

A new domain or a new sending mailbox has zero reputation. Ramp slowly. Below is a conservative schedule that works for a single mailbox sending cold outreach to mixed Gmail, Outlook, and business inboxes.

  • Day
    1-3
    Sends per day
    5
    Notes
    Warm-up network only. Send and reply to seed accounts.
  • Day
    4-7
    Sends per day
    10
    Notes
    Add 2 to 3 real prospects per day. Watch for bounces.
  • Day
    8-14
    Sends per day
    20
    Notes
    Increase warm-up traffic. Real cold at 5 to 10 per day.
  • Day
    15-21
    Sends per day
    35
    Notes
    Real cold at 15 to 20 per day. Check Postmaster Tools daily.
  • Day
    22-28
    Sends per day
    50
    Notes
    Real cold at 25 to 30 per day. Reputation should read "medium" or "high".
  • Day
    29-30
    Sends per day
    75
    Notes
    Steady state. Do not exceed 100 per mailbox per day for cold outreach.
Suggested 30-day warm-up for a new cold-sending mailbox.

One mailbox is a ceiling, not a strategy

If you need to send 500 cold emails a day, you need 5 to 10 mailboxes across 2 to 3 domains, not one mailbox pushed to 500. Volume per mailbox is the reputation-killer.

Decision tree: my email went to spam, now what?

  1. 01

    1. Check authentication

    Send a test to mail-tester.com or check-auth@verifier.port25.com. If SPF, DKIM, or DMARC fail, stop and fix that first. Nothing else matters.

  2. 02

    2. Check Postmaster Tools

    Look at domain reputation and IP reputation for the last 7 days. If either is "low" or "bad", pause sending and let it recover.

  3. 03

    3. Check complaint rate

    If complaint rate is above 0.3 percent, your list or your copy is the problem. Pause, tighten targeting, and rewrite the opener.

  4. 04

    4. Check volume ramp

    If you jumped from 20 to 200 sends per day, back off to the last volume that worked and ramp 20 percent per week.

  5. 05

    5. Check content only after 1 to 4

    Remove tracking pixels, remove link shorteners, keep body under 120 words, include a plain-text unsubscribe line, avoid attachments.

The one thing to remember

Inbox placement is authentication first, reputation second, content last. If SPF, DKIM, and DMARC do not pass and align, no amount of subject-line tuning will save the send. Ramp volume slowly, keep complaint rates under 0.1 percent, and send cold from a subdomain so a bad campaign never touches your transactional mail.

Is cold email legal in 2026 Legal side.

FAQ

Do I need a separate domain for cold outreach?

Not required, but a separate subdomain is strongly recommended. It isolates reputation from your transactional and root-domain mail.

How long until a new domain is safe to send from?

Two to four weeks of warm-up with real conversational traffic. There is no shortcut.

Does adding an unsubscribe link hurt reply rate?

No measurable effect in most tests. Not having one hurts inbox placement and violates the Gmail/Yahoo rules.

Are open-tracking pixels bad for deliverability?

They add a tiny external image reference that some filters flag. For cold outreach the marginal signal is not worth the risk. Turn them off.

What complaint rate is safe?

Under 0.1 percent is safe. Between 0.1 and 0.3 percent is a warning zone. Over 0.3 percent triggers Gmail bulk-sender enforcement.