Email deliverability checklist for 2026: the checks to run this week, in order

Google, Yahoo and Microsoft have moved from filtering non-compliant bulk mail to refusing it. Microsoft began rejecting failing mail to Outlook.com, Hotmail and Live addresses on May 5, 2025, and Google ramped up enforcement in November 2025, with temporary and permanent rejections. The full comparison of what each provider asks for is in the bulk sender requirements guide. This is the sequence we run, in order, with what each check proves.

What is at stake

A rejected message arrives nowhere, so there is no spam folder to fish it out of. Microsoft's rejection reads like this (Microsoft):

550 5.7.515 Access denied, sending domain <domain> does not meet
the required authentication level.

The bulk rules start at about 5,000 messages a day, and most account-based programs sit well under that. Run the checks anyway, for the two reasons at the end.

Day one: find out what you send

Before you touch DNS, answer two questions in writing. How many messages leave each of your domains in a day, at peak, counting every system? And which systems are those? Include the CRM, the email platform, the invoicing tool, the helpdesk, the applicant tracking system, the calendar scheduler, the survey tool and anyone's automations. You cannot authorize a sender you have not listed.

Day one: read one message's headers before changing anything

Send yourself a message through your sending path and open the raw source. In the Authentication-Results header you want SPF, DKIM and DMARC to pass, and the domain that passed SPF or DKIM to match your From domain. An SPF pass for your platform's bounce domain, with no aligned DKIM signature, looks healthy on every dashboard and still fails DMARC. Google rate-limits it with 4.7.32: From not aligned with the SPF or DKIM domain.

Day two: SPF, one record, and the lookup budget

Publish one SPF record at the domain apex listing only the senders from your inventory, and keep it under the 10-lookup limit. SPF, DKIM and DMARC explained shows how fast four includes reach it.

Day two: DKIM signed with your own domain

Have each sending platform generate a key pair and publish the selector. The setting is usually called a branded or authenticated sending domain. You want a signature whose d= value is your domain, not your vendor's.

Day three: DMARC, starting at none

Publish a DMARC record with p=none and a working rua= address. That satisfies all three providers and turns on aggregate reports, which name every system sending as you, including the ones your inventory missed. DMARC itself is now RFC 9989, a Proposed Standard published in May 2026.

Day four: one-click unsubscribe that works

Add the RFC 8058 header pair and make the endpoint accept an anonymous POST. Google and Yahoo require it for marketing mail; Microsoft's requirements do not mention it. Yahoo says an unsubscribe not honored within two days fails the requirement, and Google recommends 48 hours.

Test it as a recipient would: use the provider's own unsubscribe control, watch for the POST in your logs, and confirm the address is gone from the next send. An easy unsubscribe is the cheapest protection for your complaint rate, because the alternative is the spam button.

Day four: PTR, forward-confirmed, and TLS

Google asks every sender for valid forward and reverse DNS on its sending IPs, and a TLS connection. Both are usually your platform's job. Check them anyway if anything sends from your own servers.

Day five: read the complaint numbers, not the open rate

Get into Google Postmaster Tools and Yahoo's Sender Hub. The number to watch is the reported spam rate: Google asks bulk senders to stay below 0.10% and never reach 0.30%. It is what the receiving side thinks of your mail, and everything upstream only earns you the right to be judged.

Week two onward: move the policy

Once the aggregate reports show only your own mail, authenticating cleanly, move DMARC to quarantine, then to reject. This is the one step that can block your own mail, so give it two weeks of clean reports first.

Why a 150-account program should care about a 5,000-a-day rule

Two reasons, and neither is about the threshold.

The first is that the count is per domain. Google counts every message from a primary domain and its subdomains toward the bulk line, and bulk status never expires. A newsletter platform on a subdomain can make the whole domain a bulk sender, and the sales rep writing to eleven people inherits the status.

The second is arithmetic. Google calculates the spam rate daily, and 0.10% is one complaint in 1,000 messages:

A program that sends 300 messages on a busy day has no room at all: one complaint is 0.33%, over the 0.30% line. Postmaster Tools may show no data for a day that small, so a careless send is also harder to see. Small, high-intent programs have less room for a careless send than a large list does.

The email domain checker runs the DNS half of these checks on your domain for free. If you would rather someone set up your sending properly, tell us what you are trying to fix.