Email deliverability after the new sender requirements

Email deliverability after the new sender requirements gets better when three things are true: your domain authenticates correctly, your list isn't full of bad addresses, and people can stop receiving your messages without a fight.

That sounds basic. It isn't. A 12-person consulting firm can damage its main company domain with a few hundred badly targeted cold emails a week. A larger SaaS company can do the same thing with a much cleaner-looking setup if its CRM, support platform, and sales sequencer all send mail differently.

The practical answer is to treat every sending domain as something that needs authentication, monitoring, complaint control, and a clear opt-out path. Don't wait until Gmail starts deferring messages.

Email deliverability after the new sender requirements: what actually changed?

Gmail and Yahoo tightened their sender rules in 2024. Enforcement is less forgiving now, especially for high-volume traffic. The requirements aren't limited to newsletter companies. They affect any team sending enough mail to create a pattern in mailbox-provider data.

For bulk senders, Gmail expects SPF, DKIM, and DMARC. The visible From domain also needs to align with the domain authenticated through SPF or DKIM. Messages should use TLS, DNS records need to be valid, and spam complaints need to stay below Gmail's stated 0.3% threshold.

Marketing and subscribed messages need a working one-click unsubscribe option. A sentence that says “reply with remove” isn't the same thing. The recipient should be able to unsubscribe from the mailbox interface, without logging in or filling out a form.

Gmail commonly describes a bulk sender as a domain sending around 5,000 messages in one day to personal Gmail accounts. That number isn't a safe harbor. Sending 4,900 unwanted messages doesn't make the traffic healthy. Gmail can still filter it based on complaints, engagement, bounces, authentication, and domain history.

Yahoo has similar expectations. So the useful question isn't “Am I technically a bulk sender?” It's “Would I be comfortable if a mailbox provider inspected this sending setup tomorrow?”

Start with the sending map, not the copy

Most teams don't have a reliable answer to a simple question: what systems are sending email on behalf of our domain?

Make a list of the marketing platform, CRM, sales engagement tool, support desk, billing system, product mailer, and anything else that sends from a company address. Then check which domain each system uses and whether SPF and DKIM are configured there.

Look for these problems:

• A vendor sends with a domain that doesn't align with the address in the From field.
• Two systems publish incompatible SPF records.
• A forgotten platform still has permission to send.
• Sales prospecting uses the same domain as invoices and password resets.
• DMARC is missing, or it has stayed at p=none for years with nobody reading the reports.

That fourth problem deserves more attention. If a prospecting tool hurts the domain used for customer receipts, support tickets, and account notices, the damage spreads well beyond outbound.

A reasonable setup for a 40-person software company might separate product and prospecting traffic from the main customer communication domain. Not with deceptive lookalike domains. Use domains the company controls, make the relationship clear, and document which system is allowed to send from each one.

Fix authentication before rewriting the sequence

Clever subject lines won't repair a failed DKIM signature.

SPF should authorize the services that send mail, while staying within the DNS lookup limit. DKIM should sign messages with a domain your company controls. DMARC should tell receiving servers what to do when authentication fails and should send reports to an address someone actually monitors.

Starting DMARC with p=none is often sensible. It lets a team see what is sending before it blocks anything. But leaving it there indefinitely is not a plan. Once legitimate sources are identified and aligned, move toward enforcement. The right timing depends on how many systems send mail and whether old applications still lack authentication.

Alignment catches a common false positive. A message may pass DKIM while the signing domain belongs to the email vendor and does not match the From domain recipients see. One dashboard says “passed.” Gmail still sees a mismatch.

Use email deliverability as an ongoing operating task, not a DNS project you finish once. Records change when a company adds a CRM, switches providers, or gives a new sales tool permission to send.

Cold outreach has a different failure pattern

The bad response to deliverability trouble is usually to buy more domains and spread the same campaign across them. That doesn't fix the campaign. It just makes the problem harder to see.

A typical failure looks like this: a 25-person B2B services firm imports 18,000 contacts from a data vendor, sends five touches over ten days, sees a few replies, then notices rising bounces and spam complaints. The team blames Gmail and adds three new domains.

The real issue is usually weak targeting and poor list hygiene. Remove hard bounces immediately. Suppress unsubscribes permanently. Don't keep sending to contacts who ignore every attempt. And don't assume a low open rate is the only sign of trouble. Some recipients never see the message because it was filtered first.

The cold outreach itself should have a reason tied to the recipient. A finance leader at a 300-person fintech might care about a processor migration, a new audit requirement, or a recently announced acquisition. “Improve your operations” is not a reason. Neither is a five-email sequence written for every company in the database.

In my view, teams get this backward all the time. They treat unsubscribe handling as a compliance checkbox and relevance as a copywriting exercise. Both are deliverability controls. A recipient who understands why they got the email is less likely to report it as spam.

For cold outbound, three or four well-spaced attempts is usually enough unless the account shows a new reason to continue, such as a funding round, a newly hired VP of Sales, a SOC 2 milestone, or a public technology change. One-click unsubscribe is a safety valve, not permission to send more aggressively.

Measure the failure before changing things

Open rates are weak evidence now. Privacy features and mailbox filtering make them difficult to interpret, and some platforms count opens that don't represent a person reading the message.

Track hard bounces, soft deferrals, spam complaints, unsubscribes, positive replies, and delivery by mailbox provider. Compare those numbers before and after a list import, a provider change, or a volume increase.

Google Postmaster Tools can show domain and IP reputation, spam rates, authentication results, and delivery errors for eligible senders. It won't explain every problem, and low-volume domains may not get much data. Still, it is more useful than treating the sequencing platform's dashboard as ground truth.

Take a baseline before making changes. For example, the 40-person software company above could record weekly delivery, bounce, complaint, unsubscribe, and reply rates across its three sending domains. If complaints jump after a new list import, pause that source. If delivery falls after adding a sales platform, inspect authentication and alignment before rewriting the emails.

The next action is often smaller than teams expect: remove questionable contacts, fix one sending source, and stop the sequence that is generating complaints. Then watch what happens for a full sending cycle before adding more volume.