Email Deliverability Guide 2026: Checklist and Sender Rules

Email deliverability is how much of your email reaches the inbox instead of the spam folder or nowhere at all. It isn't the "delivered" rate in your email dashboard, which only counts messages a receiving server accepted. In 2026 the baseline is set by Gmail, Yahoo, and Microsoft: all three require bulk senders to authenticate with SPF, DKIM, and DMARC. Gmail and Yahoo also require one-click unsubscribe and spam complaints below 0.3% (aim for under 0.1%). And only email people who asked to hear from you.

This guide is the how-to: a prioritized checklist, the current sender rules, and a triage table for mail that lands in spam. For the numbers, see our 2026 deliverability benchmarks.

What is email deliverability?

Email deliverability is the share of your sent email that lands in recipients' inboxes. Every message ends up in one of three places:

• Inbox (including tabs like Gmail's Promotions).
• Spam or junk folder.
• Nowhere: blocked or bounced before it reached any folder.

Your email platform's "delivered" number usually counts everything that wasn't bounced, so it lumps inbox and spam together. That's why a dashboard can say 99% while sign-ups complain they never got the verification email.

Across Validity's 2025 benchmark data, 87.2% of mail reached the inbox, and Microsoft mailboxes were the hardest at 77.4%. Our benchmarks page breaks that down by provider, region, and industry.

Mailbox providers weigh four things: whether they can verify who sent the message (authentication), your sending history (reputation), how recipients treat your mail (complaints, engagement), and the message itself.

Email deliverability checklist

Work top to bottom. Items 2 through 6 map closely to what Gmail and Yahoo require of bulk senders; the rest keep you well clear of the limits.

1. Send from your own domain, on a subdomain per purpose. Use something like mail.yourapp.com for marketing and lifecycle email, and keep password resets and receipts on a separate subdomain or stream (why the two differ). This limits how much a bad campaign can hurt your login emails.
2. Set up SPF and DKIM for that domain. Both should pass, and DKIM should sign with your domain, not your provider's.
3. Publish DMARC. Start at p=none with reporting, then move to quarantine or reject once reports show every legitimate sender passes.
4. Add one-click unsubscribe to marketing and subscribed mail, plus a visible unsubscribe link, and process opt-outs within two days.
5. Only email people who opted in. Confirm addresses at signup, and never buy or scrape lists.
6. Suppress hard bounces and spam complaints immediately, across every stream, permanently.
7. Keep user-reported spam under 0.1%. Watch it per mailbox provider, not just account-wide.
8. Warm up new domains and IPs. Start with engaged recipients at low volume and increase gradually. Avoid sudden spikes.
9. Stop mailing people who don't engage. Run a re-engagement email, then suppress people who stay silent for months.
10. Keep the message honest. Accurate From name and subject, links on your own domain, no hidden text, and a plain-text part.
11. Monitor weekly. Check Google Postmaster Tools, Yahoo Sender Hub, and Microsoft SNDS alongside your own bounce and complaint rates.

If you send through an email service provider, it handles TLS encryption and reverse DNS for its servers. If you run your own mail servers, those are on you too: Gmail requires both, and Yahoo requires valid forward and reverse DNS.

What are the 2026 sender requirements for Gmail, Yahoo, and Outlook?

All three major consumer mailbox providers now require authenticated mail from high-volume senders, and Gmail and Yahoo also require one-click unsubscribe and low complaint rates. Rules as of September 2026:

Sources: Google sender guidelines⁠, Google sender FAQ⁠, Yahoo sender best practices⁠ and FAQ⁠, Microsoft's announcement⁠ and error 550 5.7.515 help page⁠.

Three details trip people up:

• One-click unsubscribe applies to marketing and subscribed mail, not transactional mail. Password resets and receipts don't need it. They still need authentication, and their complaints still count.
• Gmail's bulk status is sticky. Cross the threshold once and the domain is treated as a bulk sender from then on.
• Recovery takes time. Google says bulk senders become eligible for mitigation only after their spam rate stays below 0.3% for 7 consecutive days, and eligibility doesn't guarantee it.

How do SPF, DKIM, and DMARC work together?

Each protocol answers a different question, and DMARC ties the other two to the address your recipients actually see.

A typical setup for a product sending from mail.yourapp.com looks like this. Your provider gives you the exact values:

; SPF for the envelope domain your provider uses
mail.yourapp.com.                TXT    "v=spf1 include:<provider-spf-domain> ~all"

; DKIM public key, usually a CNAME to your provider
s1._domainkey.mail.yourapp.com.  CNAME  s1.<provider-dkim-domain>.

; DMARC policy for your organizational domain, with aggregate reports
_dmarc.yourapp.com.              TXT    "v=DMARC1; p=none; rua=mailto:dmarc-reports@yourapp.com"

Alignment is a common failure point. DMARC passes only when SPF or DKIM passes for a domain that matches your From address. If your provider signs with its own domain (for example d=provider.com), DKIM passes but doesn't align, and DMARC then fails unless SPF passes for a Return-Path on your domain. The fix is custom DKIM on your domain, which many email providers support. Under DMARC's default relaxed alignment, mail.yourapp.com aligns with a From address at yourapp.com.

Once aggregate reports show all your legitimate senders passing, move DMARC from p=none to p=quarantine, then p=reject. Enforcement protects your domain from spoofing. It's also a prerequisite for BIMI, which can show your logo in supporting inboxes: Gmail's BIMI⁠ needs DMARC at quarantine or reject plus a Verified Mark Certificate or Common Mark Certificate. BIMI doesn't improve inbox placement by itself.

To check any message, open it in Gmail, choose Show original, and look for PASS next to SPF, DKIM, and DMARC.

How do you add one-click unsubscribe?

One-click unsubscribe is defined in RFC 8058⁠. The message carries two headers:

List-Unsubscribe: <https://yourapp.com/unsubscribe?token=8f3a2c>, <mailto:unsubscribe@yourapp.com>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

When a recipient clicks the unsubscribe button Gmail or Yahoo shows next to your From name, the mailbox provider sends a POST request to that HTTPS URL. For it to count:

• The URL must unsubscribe the person on the POST itself: no login, no confirmation page, no "are you sure?".
• Your DKIM signature must cover both headers.
• The body still needs a visible unsubscribe link.

Many email platforms add these headers for marketing sends; check a raw message from each type of send to be sure. An easy unsubscribe also protects you: a recipient who can't find it clicks "Report spam" instead, and complaints hurt your reputation where unsubscribes don't.

How does sender reputation work?

Sender reputation is a mailbox provider's running judgment of your domain and sending IPs, built from complaints, bounces, spam-trap hits, authentication, volume patterns, and engagement. No provider publishes the formula.

• Domain reputation follows your authenticated domain wherever you send from. It's the one you carry between email platforms.
• IP reputation belongs to the sending servers. On a shared pool you share it with the provider's other customers; on a dedicated IP it's all yours.

A reputable shared pool is usually the right call for a SaaS product. A dedicated IP only helps if you send enough steady mail to keep its reputation established, and then its warm-up and upkeep are your job.

When you start a new domain or IP, or change infrastructure, Google recommends⁠ starting at low volume to engaged recipients, sending at a consistent rate, and avoiding sudden spikes. Our bounce-rate guide includes a batch-by-batch warm-up plan.

How should you handle bounces, complaints, and inactive users?

List hygiene is the part of deliverability you fully control:

• Hard bounces (the address doesn't exist) should be suppressed after the first failure. Validity's 2025 data put the average unknown-user rate at 1.46%; Amazon SES reviews accounts at a 5% bounce rate.
• Soft bounces (full mailbox, temporary server trouble) should be retried. Suppress addresses that keep soft bouncing.
• Spam complaints should suppress that person from all non-essential mail. Yahoo sends complaint reports through its Complaint Feedback Loop⁠; sign up for it.
• Inactive subscribers drag down engagement, and some become spam traps when providers recycle abandoned addresses. Send a re-engagement email, then stop mailing people who don't respond.

Many bad addresses enter at signup: typos, disposable domains, bots, and test accounts. Our guide to reducing email bounce rate covers how to stop them at the form.

Does email content affect deliverability?

Yes, but less than most checklists suggest. There's no reliable list of banned words and no magic image-to-text ratio. What mailbox providers do penalize:

• Deception. Google's guidelines specifically prohibit deceptive headers, subjects, and display names, and hidden content.
• Untrustworthy links. Link shorteners, mismatched link text, and domains with bad reputations. Link to your own domain where you can.
• Image-only emails. They look like spam and show little beyond alt text when images are off. Use live text, alt text, and a plain-text part.
• Unwanted mail. Recipients marking it as spam is a major negative signal. Mail that matches what people signed up for, at the frequency they expected, avoids most of that.

How do you monitor email deliverability?

Start with the mailbox providers' own tools, which show how the receiver sees you:

Then track these numbers per mailbox provider and per message type:

Seed-list tests (sending to a panel of test inboxes) can catch a template or domain that goes to spam, but treat them as directional. EmailTooltester stopped publishing seed-based rankings in 2025 because results were "increasingly inconsistent."

Why are my emails going to spam?

Match the symptom to the most likely cause before changing anything:

Fix the cause, then give it time. Reputation recovers over days to weeks of clean sending, not after one good campaign.

Deliverability is part of what Dreamlit's experts own when they run activation email for SaaS teams. See how Dreamlit works.

References

• Google: Email sender guidelines⁠
• Google: Email sender guidelines FAQ⁠
• Yahoo Sender Hub: Sender best practices⁠
• Microsoft: Outlook's requirements for high-volume senders⁠
• Microsoft: Fix error 550 5.7.515 in Outlook.com⁠
• RFC 8058: Signaling one-click functionality for list email headers⁠
• RFC 7208 (SPF)⁠, RFC 6376 (DKIM)⁠, RFC 9989 (DMARC, May 2026)⁠
• Google: Set up BIMI⁠
• Validity: 2026 Email Deliverability Benchmark Report⁠
• Amazon SES: Reputation metrics messages⁠
• EmailTooltester: why it stopped seed-list rankings⁠

Frequently asked questions

What is email deliverability?

Email deliverability is how much of your email reaches the inbox rather than the spam folder or nowhere at all. It is different from the delivered rate in your email dashboard, which only counts messages the receiving server accepted.

What are the Gmail and Yahoo bulk sender requirements?

Bulk senders (Gmail's line is about 5,000 messages a day to personal Gmail accounts) must pass SPF and DKIM, publish a DMARC record aligned with the From domain, support one-click unsubscribe on marketing mail, process unsubscribes within two days, and keep user-reported spam below 0.3%. Yahoo's bulk rules are nearly identical, though it doesn't publish a volume threshold.

Does Outlook.com have sender requirements too?

Yes. Since May 5, 2025, domains sending 5,000 or more messages a day to Microsoft consumer addresses (Outlook.com, Hotmail, Live, MSN) must pass SPF and DKIM and publish DMARC of at least p=none aligned with SPF or DKIM. Non-compliant mail is rejected with error 550 5.7.515.

What spam complaint rate is too high?

Gmail and Yahoo treat 0.3% as the hard line, and Google asks senders to stay below 0.1%. That is one complaint per 1,000 messages delivered to the inbox. Validity's 2025 benchmark data averaged 0.06%.

Why are my emails going to spam?

The usual causes are authentication that fails or doesn't align with your From domain, a spike in spam complaints, mailing old or unconfirmed addresses, sudden volume jumps from a new domain, and misleading content. Check a message's Authentication-Results header first, then your complaint and bounce rates by mailbox provider.

Does email authentication guarantee inbox placement?

No. SPF, DKIM, and DMARC let receivers verify that mail using your domain is authorized, and they are now required for bulk senders, but mailbox providers still filter authenticated mail based on reputation, complaints, and engagement.

Do I need a dedicated IP address?

Usually not. A reputable shared pool suits small or irregular senders. A dedicated IP only helps if you send enough steady, wanted mail to build and keep its reputation, and you become responsible for warming it up.