Email deliverability: Google, Yahoo, Microsoft rules stay

For several months now, the deliverability rules set by the web’s major players have no longer moved only in press releases.

They have become the normal way email works.

After checking official sources over the last 48 hours, no major new announcement has been published by Google, Yahoo or Microsoft about email sending requirements. So the topic is not a surprise new constraint, but a lasting reality: domains must be authenticated, aligned, monitored and clean.

Status as of 4 May 2026

The sources followed are the official portals:

Over this watch window, there is no major new rule comparable to the previous announcements on DMARC, SPF, DKIM, volume thresholds or reputation.

That does not mean the risk is going down.

It means the existing rules are now fully in place. (Update: in November 2026, Outlook.com started rejecting some email from domains without DMARC, even at low volume.)

DMARC, SPF and DKIM become lasting requirements at the major email providers

For small and mid-sized companies, today’s difficulties come less from reading the rules than from applying them: several sending tools, legacy DNS, marketing providers, web forms, CRMs, old applications and sometimes no continuous monitoring.

What the big players really expect

Google, Yahoo and Microsoft do not have exactly the same public thresholds, but their expectations converge.

A domain that sends at volume must be able to prove several things:

SPF is correctly configured;
DKIM signs outgoing messages;
DMARC is published and receives reports;
the domain in the From aligns with SPF or DKIM;
forward and reverse DNS are consistent;
marketing campaigns offer easy unsubscribe;
lists are maintained;
spam complaints stay low;
errors and bounces are tracked.

The key point: publishing three DNS records is not enough.

Real emails must pass the providers’ checks.

Authentication is no longer optional

SPF, DKIM and DMARC have become the minimum baseline.

SPF states which sources may send for a domain. DKIM signs the message to prove it was not altered. DMARC links these mechanisms to the domain the recipient sees.

DMARC alignment between the visible domain, SPF and DKIM

The most common trap lies in alignment.

A company may think everything is fine because SPF passes or because the marketing tool says “DKIM enabled”. But if the DKIM signature uses the provider’s domain, or if the SPF return path does not match the visible domain, DMARC can fail.

Problem example:

From: newsletter@company.com
DKIM pass: email-platform.com
SPF pass: bounce.email-platform.com
DMARC fail

Healthier example:

From: newsletter@company.com
DKIM pass: company.com
SPF pass: bounce.company.com
DMARC pass

For a small business, this changes the way of working: every tool that sends on behalf of the domain must be audited, not just the main mailbox. Our guide to configuring SPF, DKIM and DMARC without breaking email delivery explains the method.

Reputation thresholds remain decisive

Technical rules are not enough if recipients complain.

Google made the complaint rate particularly visible in deliverability discussions. The operational goal stays simple: keep the spam rate very low and avoid the risk zones that degrade reputation.

Monitoring the spam complaint rate in Gmail deliverability

The causes are often very concrete:

campaigns sent to a list that is too old;
overly frequent sales follow-ups;
poorly controlled address purchase or enrichment;
hard-to-find unsubscribe;
content no longer matching the original promise;
insufficient segmentation;
inactive addresses kept too long.

Deliverability is therefore not only a DNS topic.

It is also about list quality, consent, frequency and relevance.

Microsoft, Google and Yahoo push towards industrialisation

The era of one-off fixes is ending.

Before, many companies fixed deliverability only when an incident became visible: a drop in opens, messages in spam, an SMTP block, sales complaints or lost leads.

Today, that model comes too late.

Monitoring email flows, volumes, bounces, complaints and DNS drift

The expected approach is more industrial:

map email flows;
separate corporate, marketing and transactional uses;
document authorised providers;
enable DKIM wherever possible;
monitor DMARC reports;
track bounces and complaints;
clean lists regularly;
test DNS changes before large sends;
set up alerts in case of drift.

This work may seem heavy, but it avoids a much more costly situation: discovering a block during an important campaign, a critical invoice or a customer follow-up.

What this changes for small businesses

For a small business, the main risk is rarely a total lack of configuration.

The risk comes from grey areas.

A Microsoft 365 domain can be well configured for staff email but misaligned for the CRM. A newsletter can have DKIM, but not with the right domain. A business application can send from an IP without clean reverse DNS. A website form can spoof the internal domain without proper authentication.

Email list quality, inactive contacts, bounces and domain reputation

These small gaps become visible when providers apply checks at scale.

Companies must therefore move from “it goes out” to “it is compliant, measured and sustainable”.

The priority checklist

The right reading of the situation is simple: there is no new regulatory emergency in the latest announcements, but there is an organisational one.

Priorities to handle:

List every tool that sends email with the domain.
Check SPF, DKIM and DMARC on real messages.
Check DMARC alignment of the visible domain.
Enable DMARC reports and use them.
Fix unidentified sources.
Separate marketing and transactional flows if needed.
Track complaints, bounces and SMTP errors.
Clean inactive lists.
Validate unsubscribe on marketing emails.
Set up continuous monitoring.

The goal is not a configuration that is perfect on paper.

The goal is deliverability that withstands the real checks of Google, Yahoo, Microsoft and other providers.

Conclusion

The absence of a major new announcement is important information.

It confirms that the market is no longer in a discovery phase, but in an execution phase.

The rules set by the web’s major players are here to stay: authentication, alignment, reputation, unsubscribe, list quality and continuous monitoring.

For small businesses and companies, the difference will now come from the ability to industrialise deliverability before incidents become visible to customers.

To review your situation, see Dharmail’s email deliverability audit (page in French).

Email deliverability: Google, Yahoo and Microsoft rules are here to stay