Between February 2024 and mid-2026, the three inbox providers that matter for B2B outbound — Google, Yahoo, and Microsoft — moved email authentication from "recommended" to "mandatory." Non-compliant mail is no longer sent to the junk folder; it is rejected at the server with a 5.7.x error, meaning it never reaches a recipient at all. This is the environment every cold-outreach program now operates in, and it is why Growth Orbit treats deliverability as an operating discipline — verified lists, warmed inboxes, monitored reputation, aligned authentication, disciplined volume — rather than a one-time DNS setup. One number anchors everything below: a Gmail user-reported spam rate above 0.3% is a reputation incident, and Google recommends staying below 0.1%.
What changed in email deliverability between 2024 and 2026?
Three enforcement waves, each harder than the last. Google and Yahoo's sender requirements took force in February 2024; Google escalated to permanent rejections of non-compliant bulk mail in November 2025. Microsoft aligned Outlook.com, Hotmail, and Live on May 5, 2025 — with only 33 days between announcement and enforcement — and now rejects non-compliant bulk mail at the SMTP layer with a 550 5.7.515 response.
The practical shift is the failure mode. A misconfigured DNS record, an unaligned From: header, or a missing unsubscribe header no longer lands you in spam — it bounces the message. The failure is invisible: you look like you sent, the recipient never sees anything, and there is nothing in the sent folder to investigate.
What do Google, Yahoo, and Microsoft now require from senders?
Google's Email Sender Guidelines split senders into two tiers, and Yahoo and Microsoft enforce materially the same bar. Every sender must have SPF or DKIM authentication, valid forward and reverse DNS (PTR) on the sending IP, TLS in transit, and RFC 5322–compliant formatting. Cross 5,000 messages per day to personal Gmail accounts and you are permanently classed as a bulk sender — the classification does not reset if volume drops — and the stricter bar applies:
- Both SPF and DKIM, not just one
- A published DMARC record (minimum
p=none) with alignment between theFrom:domain and either SPF or DKIM - One-click unsubscribe (RFC 8058 headers), honored within two days
- A Postmaster-reported spam rate below 0.3% — with 0.1% as the working target
What numbers decide whether you reach the inbox?
Even a perfectly authenticated domain lands in spam if the reputation numbers drift. Three metrics govern whether the inbox trusts you, and every one has a published threshold:
Postmaster data lags 24–48 hours, so by the time a spike shows in the dashboard, the bad campaign is already two days old. That is why Growth Orbit watches these metrics at the campaign level, not the monthly average — a single bad list of 5,000 addresses can trip a lasting reputation drop. Recovery from a 0.3% breach typically takes 2–4 weeks of demonstrably good behavior: send only to engaged recipients, cut Gmail volume by roughly half, and ramp back in 20% daily increments once the rate holds under 0.1% for three consecutive days.
“Google is the most demanding email provider in this regard. If they can glean the information, they’ll use it.”
Laura Atkins, co-founder, Word to the Wise — via Stripo
Atkins's point — made about the signals mailbox providers weigh — is the right mental model: reputation is continuously computed from everything your domain does, and Gmail uses every signal it can see.
Why should cold email never come from your main company domain?
Because your primary domain carries customer, partner, and transactional mail, and one bad cold campaign puts all of that reputation at risk. Growth Orbit runs cold outbound exclusively from secondary domains (think try-brand.com, get-brand.com) — a reputation firewall between prospecting mail and the mail your business cannot afford to lose. Secondary domains are bought as .coms from top-tier registrars, forwarded to the primary domain so replies and manual visits land in the right place, and run at one to two mailboxes per domain so a single contaminated mailbox can never drag down a shared identity. A domain that degrades gets warmed down and retired; the corporate brand is never touched.
How many inboxes does it take to send 1,000 cold emails a day?
Twenty. Even a fully warmed mailbox should not exceed roughly 50 cold sends per day — the way to scale is more mailboxes, never more volume per mailbox:
At 5,000+ sends per day into Gmail you are a bulk sender by definition, and the full DMARC and one-click-unsubscribe bar above is mandatory. Send patterns matter as much as volume: 60–120 seconds between sends, randomized, distributed over an 8–10 hour window; a 3–4 touch cadence spaced 3–4 days apart; stop on any reply, unsubscribe, or bounce; plain-text-first formatting from a real reply-to address on a custom tracking domain.
How long does it take to warm up a new sending domain?
Three weeks — and warming for three weeks rather than two has been documented to lift open rates by roughly 30%. A brand-new domain has zero reputation, and sending 100 cold emails from it on day one is a guaranteed, often permanent, trip to spam. The schedule Growth Orbit runs: days 1–7, warmup traffic only, ramping from 5 to 25 messages a day against seeded inboxes; days 8–14, ramp to 40–50 a day and begin 10–15 hand-picked cold sends; days 15–21, reach cruising speed at 30–50 cold sends per mailbox per day. Warmup then stays on permanently at a background 5–10 a day — continuous domain warming is what maintains the reputation you spent three weeks building. Once a domain is burned, recovery is slower than starting over.
Which DNS records are mandatory for cold outreach in 2026?
Four records are the entry ticket; anything missing or misaligned means rejection before a human ever sees the message:
- SPF — declares which servers may send for the domain. Keep the authorized-sender list lean: your sequencer, your inbox provider, your transactional ESP.
- DKIM — cryptographic proof the message wasn't altered in transit. Use 2048-bit keys and rotate them periodically.
- DMARC — ties SPF/DKIM to the visible
From:domain and tells receivers what to do with failures. Start atp=nonefor monitoring, then move top=quarantineandp=rejectas reports come clean — RFC 9989 guidance (2025) advises at least a month at each stage. Do not jump straight top=reject; you will block your own legitimate mail. But do not linger either — Microsoft actively down-weights domains that sit atp=none. - PTR (reverse DNS) — the sending IP must resolve back to a hostname. A missing PTR is an automatic rejection at Microsoft and Yahoo.
Where do outbound programs actually get burned?
Rarely by one dramatic failure. Four predictable choices account for most of the deliverability incidents Growth Orbit is called in to fix: cold from the corporate domain (transactional reputation exposed to prospecting risk); enriched contacts loaded without send-time verification — data from any provider decays between pull and send, roughly 30% a year for contact data, which is why every address gets verified at ~98% confidence before it enters a sequence, however fresh the source claims to be (see data decay); DNS and DMARC misalignment on domains re-entering production; and scaling volume before the reputation math supports it — the most expensive mistake in outbound, because the 0.3% line takes weeks to un-cross and the bulk-sender classification never resets.
What does a compliant outbound program look like?
Authenticated on all four records with alignment. Secondary domains only, warmed three weeks, capped at 30–50 sends per mailbox per day. Every list verified to hold bounces under 2%. Google Postmaster Tools and Microsoft SNDS monitored per domain — weekly at minimum, daily during active campaigns — with seed-list placement tests holding 90%+ primary inbox. One-click unsubscribe honored within 48 hours, not spam-adjacent behavior of any kind.
Deliverability is not a settings page; it is a continuous operating discipline, and every campaign either invests in domain reputation or spends it. This playbook is one module of how Growth Orbit runs pipeline as a service — the sending layer of a governed system that starts with knowing exactly who should be receiving your mail in the first place. If you want to know what your outbound is actually aimed at, that is a coverage-gap analysis: read-only, two weeks to first finding.