Cold email deliverability in 2026: rejected, not filtered.

What actually changed

Nothing new was published this month. The requirements outbound teams talk about are the ones Google set out in its email sender guidelines, which took effect on February 1, 2024. Microsoft followed with matching rules for Outlook.com, announced in its Defender for Office 365 blog and enforced from May 5, 2025.

What has moved is how hard those rules bite. For most of 2024, mail that fell short was more likely to be filtered to spam. Google's own sender guidelines FAQ now says that from November 2025 Gmail is ramping up enforcement, and that non-compliant messages will see temporary and permanent rejections. Microsoft has said the same: messages that fail its authentication requirements will be rejected with "550; 5.7.515 Access denied".

That matters more than it sounds. A message in spam still counts as sent in most sequencing tools, so a team can run for weeks believing a campaign is live when nobody is reading it. A rejection comes back as a bounce. It is visible, which makes it fixable, but only if someone checks bounce codes rather than just bounce counts.

The requirements, in plain terms

Google splits its rules in two. Every sender to Gmail needs SPF or DKIM, valid forward and reverse DNS, TLS, properly formatted messages and a reported spam rate under 0.3%. Senders of more than 5,000 messages a day to Gmail accounts need all of the following:

• SPF and DKIM, both set up for the sending domain.
• A DMARC record. The policy can be p=none, but it must exist.
• Alignment: the domain in the From header must match the SPF or DKIM domain.
• One-click unsubscribe (the List-Unsubscribe-Post header) on marketing and subscribed mail, plus a visible unsubscribe link in the body.
• A spam rate in Postmaster Tools kept below 0.3%.

The 5,000 figure counts messages to Gmail addresses from your domain in a day, across every mailbox on that domain. A team of reps on one domain can cross it without any single rep sending much. Google's FAQ also says that once a domain is classed as a bulk sender it stays one permanently, so dropping back under the line does not reset anything.

Why 0.1% is the number to watch

Google publishes 0.3% as the line not to cross, measured in Postmaster Tools. Most deliverability practitioners manage to 0.1% instead, and that is the number we watch. Complaint rates are measured on what recipients mark as spam, and cold outreach to a poorly fitted list can move from fine to over the line inside a week.

For outbound, the levers that move complaints are the obvious ones, and they are list quality and relevance before they are anything technical. A contact who recognises why you wrote rarely presses the spam button, even if they do not reply.

A checklist for outbound teams

1. Never send cold volume from your primary domain. Use separate sending domains, so a problem on outreach never reaches your invoices, support or customer mail.
2. Check SPF, DKIM and DMARC on every sending domain, and check alignment, not just presence. A DKIM signature for your sending tool domain does not align with yours.
3. Add one-click unsubscribe headers and a visible opt out. Cold email is not exempt in practice, and a clear opt out lowers complaints.
4. Register every sending domain in Google Postmaster Tools and read it weekly. It is the only first-party view of your spam rate at Gmail.
5. Track bounces by code. A rise in 550 5.7.x responses is an authentication or reputation problem, not a bad list.
6. Verify every address before it enters a sequence. Hard bounces are a reputation signal of their own.
7. Warm new domains gradually and keep daily volume per mailbox modest. There is no published safe number, so ramp and watch.

This is the setup our outsourced SDR teams run on by default: separate warmed domains, SPF, DKIM and DMARC monitored daily, and verified data before anything is sent. If you want yours checked, the pipeline audit covers deliverability as one of its four areas.

What this does not change

Authentication gets mail accepted. It does not get mail read. A compliant domain sending a generic message to the wrong buyer will still be ignored, and complaints from that list will eventually undo the technical work. The sequence, the list and the reason for writing still decide whether outbound works.