Cold email deliverability in 2026: what Gmail, Yahoo and Outlook actually require

The short answer for 2026

To keep cold email deliverable in 2026, authenticate your sending domain, keep user-reported spam under 0.3% of the mail that reaches inboxes, and make unsubscribing easy. These three habits cover most of what Gmail, Yahoo and Outlook.com ask for in writing.

How much of the rulebook applies to you depends on volume. The strictest requirements (DMARC, alignment, one-click unsubscribe) start at about 5,000 messages a day to a provider's consumer inboxes, and Yahoo gives no number. A small cold email program sits far below that, but the rules for every sender and the spam rate still apply.

Everything below comes from the providers' own pages, the standards and the FTC, read on October 17, 2026. We say where those pages disagree or stay silent.

Gmail, Yahoo and Outlook sender requirements for 2026, side by side

These are mailbox-provider policies, not statutes. Google, Yahoo and Microsoft each decide what they deliver to their own users, and they draw the lines differently.

Google (Gmail)

Gmail's requirements for all senders to personal Gmail accounts have applied since February 1, 2024. The bulk tier adds DKIM alongside SPF, DMARC (a policy of none is enough), From-domain alignment, and one-click unsubscribe for marketing and subscribed messages. DKIM keys must be at least 1024 bits, and Google recommends 2048.

Three details get lost in short summaries:

• Google's pages say "more than 5,000," "5,000 or more" and "close to 5,000" a day. Treat the line as approximate.
• The count adds up all mail from one primary domain, so a subdomain does not reset it. A domain that crosses the line once is a bulk sender permanently.
• The guidelines do not apply to mail sent to Google Workspace accounts. Google says its requirements and enforcement apply only when sending to personal Gmail accounts. They do apply to Workspace users who send to personal Gmail.

On enforcement, Google's FAQ says it began ramping up in November 2025, with temporary and permanent rejections for non-compliant traffic. For bulk senders:

• Failed authentication, alignment, reverse DNS, TLS or format checks bring error codes or spam foldering.
• A spam rate above 0.3%, a missing DMARC record, no one-click unsubscribe, or unsubscribe requests not honored within 48 hours mean Google withholds delivery help.

The guidelines page also warns that unauthenticated mail may be marked as spam or rejected with a 5.7.26 error.

Yahoo (and AOL)

Yahoo has the same two tiers but no number. Its FAQ defines a bulk sender as one sending a significant volume and says Yahoo will not specify a threshold, so "5,000 a day" is not a Yahoo rule. The requirements cover AOL and the other consumer brands on Yahoo Mail. Yahoo Japan is a separate entity.

One difference from Google: Yahoo accepts a mailto unsubscribe and only highly recommends the RFC 8058 POST method. Google says a mailto link or a landing page does not meet its one-click requirement.

Microsoft Outlook bulk sender requirements

Microsoft's rule covers Outlook.com and related consumer services (Hotmail, Live.com, MSN). It does not describe Microsoft 365 business mailboxes. Microsoft announced it on April 2, 2025, and the post carries an update note dated April 29.

Its support article defines a high-volume sender as one that sends 5,000 or more messages to Microsoft consumer services using the same From domain. The post and the Outlook.com policies page say "more than 5,000" a day, and the support article gives no time window.

Those senders need SPF and DKIM passing, plus a DMARC record of at least p=none that passes through an aligned SPF or DKIM domain.

Microsoft also recommends a functional unsubscribe link and regular list cleaning. Its FAQ says enforcement first targets large senders, and that all senders benefit from the same practices.

What happens to non-compliant mail

Microsoft's pages do not agree with each other:

• The post's original text says non-compliant mail goes to Junk first and may later be rejected.
• The April 29 update says Microsoft decided to reject with the error 550 5.7.515, taking effect May 5. The next paragraph says that after May 5 mail goes to Junk, with rejection on a date to be announced.
• The Outlook.com policies page says that effective May 5, 2025, non-compliant mail from high-volume senders goes to Junk and, if issues remain unresolved, may be rejected with 550 5.7.515.
• The support article treats 550 5.7.515 as the error senders see and gives no effective date.

We found no Microsoft statement of when rejection began, so confident claims in either direction are unverified.

Do these rules apply to a small cold email sender?

Partly. Authentication, reverse DNS and the spam rate apply at any volume. The bulk tier rarely does.

The bulk line is far away

The Gmail rules for all senders apply at any volume, but only to personal Gmail recipients. The bulk tier is far away for most cold email programs. For example, a team that sends 25 emails a day from each of 3 mailboxes sends 75 a day. Even if every one went to a personal Gmail address, that is 1.5% of the 5,000 line.

Business inboxes have their own filters

Many B2B recipients sit on business mailboxes at Google Workspace or Microsoft 365. Google excludes Workspace recipients from its written guidelines, and Microsoft scopes its rule to consumer services.

The written rules above do not describe how business filters treat SPF, DKIM and DMARC. A missing written rule is not evidence that nothing is checked, so authenticate for every recipient.

Cold email is unrequested mail

The wording clashes with cold outreach. Google tells senders not to message people who did not sign up, and Yahoo tells senders to verify that recipients specifically requested mail. Cold email is unrequested by definition.

Neither page names cold email or exempts it. What you can measure is the spam rate.

One-click unsubscribe and cold email

RFC 8058 defines one-click unsubscribe. The message carries a List-Unsubscribe header with an HTTPS URL, plus a List-Unsubscribe-Post header with the value List-Unsubscribe=One-Click. The receiving system sends a POST without cookies, the sender must not answer with a redirect, and a valid DKIM signature must cover both headers.

Google and Yahoo require it from bulk senders for marketing and subscribed mail, not transactional mail. Whether a one-to-one sales email counts as marketing is not defined:

• Google says recipients, not Google, decide what kind of message they received.
• Yahoo says it will not decide what must carry an unsubscribe link, and suggests adding one-click when complaints run high.
• Microsoft asks for a clear, easy-to-find unsubscribe and names no one-click rule.

So below the bulk line, one-click is formally optional. We would add it anyway. It costs little, Google says it helps keep the spam rate low, and RFC 8058 itself notes that recipients who cannot leave easily tend to report mail as junk instead.

Honor requests fast: Google says 48 hours and Yahoo says 2 days. The legal deadline is longer (10 business days, below), so work to the shorter one.

What the law adds: CAN-SPAM

CAN-SPAM is a US law, and it differs from provider policy. The FTC says it covers all commercial email, not just bulk, with no exception for business-to-business mail. It requires:

• Accurate From, To, Reply-To and routing information.
• A subject line that is not deceptive.
• A clear disclosure that the message is an ad.
• Your valid postal address.
• A clear way to opt out, which must keep working for at least 30 days after sending.
• Opt-outs honored within 10 business days.

The FTC's guide lists penalties of up to $53,088 per violating email. The figure is adjusted over time, so check the current amount.

The guide does not mention RFC 8058. It asks for a return email address or another easy internet-based way to opt out. Outside the US, rules differ by country: see our GDPR cold email guide. This is a summary of the FTC's guide, not legal advice.

What the spam rate threshold measures

Google's number is the user-reported spam rate in Postmaster Tools: spam reports divided by mail sent to the inbox, calculated daily, and only for mail authenticated by DKIM. Two consequences follow.

First, mail that Gmail already filed under spam is not sent to the inbox, so by that definition it is not in the denominator. A low rate does not prove good placement.

Second, the arithmetic is unforgiving at low volume. 0.3% is 3 reports per 1,000 inbox deliveries, and 0.1% is 1 per 1,000. For example, if 30 of a day's emails reach personal Gmail inboxes, a single report is about 3.3% for that day.

You may not see the figure at all. Google says Postmaster Tools dashboards can be empty when a day's volume is too low, and Gmail's feedback loop is an aggregate Postmaster Tools dashboard for large-volume senders, not a stream of per-message complaints.

At cold email volume your practical signals are hard bounces, replies asking you to stop and unsubscribe clicks. None of the Google, Yahoo or Microsoft pages we read publishes a bounce-rate limit, so verify addresses and decide how to treat catch-all domains before you send.

On volume, Google advises a steady rate and slow increases, and warns that suddenly doubling volume can bring rate limiting or reputation drops. For per-mailbox ranges, see how many cold emails per day.

A pre-send checklist for cold email deliverability

DMARC is now specified by RFC 9989, published in May 2026, which obsoletes RFC 7489. For setup steps, see SPF, DKIM and DMARC for cold email.

Common claims about the 2026 rules, checked

Guides disagree with each other and with the primary pages on a few points. These are the ones we checked. Third-party examples of the Yahoo and Microsoft claims are linked in the sources, as examples and not as endorsements.

How FoxKnock handles this

FoxKnock sends only through mailboxes you connect: Google Workspace or any SMTP and IMAP mail server, connected with an app password. It does not run a shared sending pool, so your own domain's reputation is the one on the line.

Microsoft 365 is limited. FoxKnock connects mailboxes only with a password over SMTP and IMAP, and it does not offer Microsoft sign-in. Microsoft no longer accepts passwords (Basic authentication) for IMAP in Exchange Online and is retiring it for SMTP AUTH, so a Microsoft 365 mailbox may not connect or may not sync replies.

The guardrails at default settings:

• Volume. 25 sends a day per mailbox, a hard maximum of 50, and at least 90 seconds between sends. A new mailbox starts at 8 a day and climbs in a straight line to its limit over 21 days. More than 3 mailboxes on one domain needs an explicit confirmation.
• Auto-pause. A mailbox pauses when bounces exceed 2% of its last 100 sends or complaints exceed 0.1% of its last 1,000 (each needs at least 20 sends). It backs off for 15 minutes when Gmail throttles.
• Opt-out. Every email carries List-Unsubscribe and List-Unsubscribe-Post headers (RFC 8058), a one-click unsubscribe link and your postal address. No postal address, no real send. Suppression is workspace-wide and checked when a step is queued and again when it sends.
• DNS check. Each mailbox gets a check of its SPF, DKIM, DMARC and MX records, with plain-English fixes.
• Quality gate. Spam trigger words are flagged, and a fake Re: or Fwd: subject on a first email is blocked.

What it does not do:

• There is no warm-up network, no inbox-placement testing and no seed lists, and no tool can guarantee placement. The ramp only controls how much you send.
• The DNS check does not cover PTR records or TLS, and it cannot show whether a message passes, so send yourself a test and read the headers.
• FoxKnock adds the unsubscribe headers but does not sign mail itself, so confirm that your mail provider's DKIM signature covers them.
• There is no connection to Postmaster Tools or Yahoo Sender Hub, so check those yourself.

The complaint count comes from feedback-loop reports that reach the mailbox. Gmail's feedback loop is an aggregate dashboard rather than per-message reports, so the 0.1% pause is a tripwire for what FoxKnock can see, not a copy of Google's number.

See cold email sending for the details. If you want to see the DNS check on your own domain, the free plan includes one mailbox and 500 one-time credits with no card, and you can start with the free credits.

Provider rules change without notice. Everything above was read on October 17, 2026, and none of it is legal advice.