For years, the worst case for a badly configured marketing email was the junk folder. Someone would eventually notice, you would clean the list, and things would improve. That is no longer the worst case.
Google escalated enforcement in late 2025. Mail that fails the bulk-sender requirements now gets a 550 rejection rather than a spam-folder delivery. Microsoft returns 550 5.7.515. The message does not arrive in any folder, and unless somebody is reading bounce reports, nothing in your marketing platform will tell you.
What actually changed
If you send 5,000 or more messages a day to personal accounts, you are a bulk sender, and three things are now mandatory rather than advisory:
- Authentication. SPF and DKIM both configured, with at least one aligned to your From domain, plus a DMARC record and valid reverse DNS.
- One-click unsubscribe. A
List-Unsubscribeheader that works on the first click, on marketing mail. Transactional messages are exempt. - Complaint rate below 0.3%. That is the enforcement ceiling, not a target. Google’s guidance is to stay under 0.1%.
That 0.3% figure deserves emphasis, because it is smaller than people expect. On a 50,000-address send, 150 complaints is enough to trigger it.
The mistake almost everyone makes
Publishing a DMARC record at p=none and considering the job finished.
p=none is a monitoring mode. It asks receiving servers to report what they see and to take no action. It satisfies the letter of the requirement while providing none of the protection, and it means anybody can still spoof your domain. The record is a starting point, not a destination:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comRead the aggregate reports for a few weeks, find the legitimate senders you had forgotten about — the CRM, the invoicing system, the events platform someone signed up for in 2019 — get those aligned, then move through p=quarantine to p=reject. Skipping that middle step is how companies accidentally block their own invoices.
Separate your sending
The single highest-value change most businesses can make is to stop sending everything from one domain.
Marketing, transactional and cold outreach should each live on their own subdomain. They have completely different risk profiles: a campaign to a stale list can damage reputation badly, and if your order confirmations share that reputation, they go down with it. Splitting them means a bad campaign is a marketing problem rather than a trading one.
Cold outreach in particular should never touch your primary domain. Tools like Smartlead and Instantly exist partly to manage this — dedicated sending domains, per-mailbox volume caps, automated warm-up — and using them properly means the worst outcome of a bad prospecting list is a burned throwaway domain.
While we are here: your open rates are fiction
Apple Mail Privacy Protection pre-fetches tracking pixels. A meaningful share of the opens in your reporting never involved a person.
This matters beyond vanity metrics, because open rate is what a lot of automation triggers on. If your re-engagement sequence fires based on opens, it is firing on noise. Move the triggers, and the reporting, onto clicks, replies and attributed revenue.
Where to start
If you have not looked at this recently, do these in order:
- Check whether you have a DMARC record at all, and what policy it is set to.
- Pull your complaint rate from Google Postmaster Tools. If it is above 0.1%, that is the priority.
- Check what else sends mail as your domain. The list is usually longer than anyone expects.
- Only then look at the campaigns themselves.
Fixing content before fixing authentication is the wrong order, and it is the order most people choose.
If your campaigns have gone quiet and you are not sure why, get in touch — a deliverability diagnosis is a short piece of work and it tells you whether the problem is configuration, reputation, or the list itself.