Take the checklist to your team.
A printable pre-send checklist: authentication, domains and warmup, lists, content, monitoring and the law.
- Authentication and warmup steps
- List hygiene and content rules
- Weekly monitoring thresholds
Why campaign emails end up in spam.
Mailbox providers cannot verify you
Without SPF, DKIM and DMARC, a message looks the same as a forgery. Gmail, Yahoo and Microsoft now reject or filter mail that fails these checks.
Recipients do not want the email
People mark mail as spam, or ignore it, when it is irrelevant, unexpected or hard to unsubscribe from. Complaints and low engagement damage your reputation faster than anything else.
Your sending pattern looks wrong
A new domain that sends thousands of emails on day one, a list full of dead addresses, or sudden volume jumps all look like spam, whatever the content says.
Reputation follows your domain and IP
Providers score the domain and the sending address over time. A few bad campaigns can hurt every email you send after, including mail from your own team.
What Gmail, Yahoo and Microsoft expect in 2026.
Google and Yahoo began enforcing sender rules in 2024, and Microsoft followed for Outlook.com, Hotmail and Live addresses in May 2025. The formal rules apply to bulk senders, usually defined as 5,000 or more messages a day to their users. In practice, treat them as the standard for every campaign, because the filters look at the same signals whatever your volume.
| Requirement | What it means |
|---|---|
| SPF and DKIM | Both must pass, and at least one must align with the domain in your From address. |
| DMARC | A published record is required, at least p=none. Moving to quarantine or reject is the better long-term position. |
| One-click unsubscribe | Promotional mail needs a one-click unsubscribe header (RFC 8058) as well as a visible link. Honour requests within two days. |
| Complaint rate | Keep spam complaints below 0.10% in Google Postmaster Tools. At 0.30% you risk blocks and lose access to some mitigation. Microsoft publishes no number, so use the same targets. |
| Valid sending setup | Reverse DNS that matches your sending host, TLS in transit, and correctly formatted messages. |
Enforcement has tightened. Google moved from temporary deferrals to permanent rejections of non-compliant mail in late 2025, and Microsoft rejects it outright. Thresholds and dates are reported slightly differently by different sources, so check the current Google, Yahoo and Microsoft sender documentation before you rely on a specific figure.
Prove that the email is really from you.
SPF lists the servers allowed to send for your domain. DKIM adds a signature to each message that the receiver checks against a public key in your DNS. DMARC tells receivers what to do when SPF or DKIM fails, and sends you reports.
Set up all three for every domain and subdomain you send from, including your email platform and any CRM or sales tool that sends on your behalf. A simple DMARC record to start with looks like this:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
Read the reports for a few weeks, fix any legitimate sender that fails, then tighten the policy to quarantine and later reject. Check the result with a tool such as Google Admin Toolbox, or send a test message to a mailbox and read the authentication results in the message headers.
Protect your main domain and ramp up slowly.
Do not send cold outreach from your main domain. Use separate, closely related domains or subdomains for outbound prospecting, and keep your main domain for customer, transactional and opted-in mail. If a cold campaign damages a sending domain, your regular business email is not affected.
A new domain or mailbox has no reputation. Providers expect it to start small and grow. A typical schedule for a new sending domain, from vendor guidance, looks like this:
| Week | Emails a day, per mailbox | Notes |
|---|---|---|
| 1 | 5 to 10 | Send to engaged contacts and colleagues. Replies help. |
| 2 | 15 to 25 | Keep the same daily pattern. |
| 3 | 30 to 50 | Start real, well-targeted prospects. |
| 4 | 60 to 90 | Watch bounces and complaints daily. |
| 5 | 100 to 140 | Do not add new content and volume together. |
| 6 to 8 | 150 to 200 | Plateau. Add more domains and mailboxes for more volume, not a higher ceiling. |
These figures are a conservative rule of thumb, not a provider limit. Allow six to eight weeks for a brand new domain and at least three weeks to recover a damaged one. Add domains rather than pushing one domain harder.
Send only to addresses that are real and relevant.
- Never buy or scrape a list. Purchased lists contain dead addresses, spam traps and people who never heard of you. One send can undo months of work.
- Verify addresses before the first send. Remove invalid, role-based and risky addresses. Vendors treat a bounce rate near 5% as critical, so aim to stay far below it.
- Collect permission where you can. For opted-in mail, use a clear sign-up and record where and when each person agreed. Double opt-in gives the cleanest list.
- Segment by role, industry and stage. Relevant mail gets opened and replied to. Mass mail gets reported.
- Retire inactive contacts. Stop mailing people who have not opened or clicked in about six months, or move them to a re-permission email. Inactive addresses drag down your engagement.
- Make leaving easy. A visible unsubscribe link and the one-click header cost you a few contacts and save your reputation.
Write like a person and send like one.
Be recognisable
Use a real name and a consistent From address on a domain you own. Make the subject line match what is inside.
Keep it plain
One clear message, one link, little formatting. Avoid image-only emails, URL shorteners, attachments in cold mail and anything that looks like a mass mailer.
Match the offer to the reader
A guide or a short review for a named role in a named industry performs better than a generic pitch. Relevance is the best spam filter you have.
Keep a steady rhythm
Send at a consistent volume and cadence. Spread large sends over hours or days, and stop a sequence when someone replies or bounces.
Say who you are
Include your company name and a physical address, which US law requires, and a clear reason for writing.
Test before you send
Send to your own seed addresses at Gmail, Outlook and Yahoo, and read the result in the spam folder and the message headers.
Watch the numbers and stop early.
Reputation problems are cheap to fix in week one and expensive in month three, so look at the signals every week.
| Signal | Where to see it | Act when |
|---|---|---|
| Spam complaint rate | Google Postmaster Tools, your email platform, feedback loops | It approaches 0.10%. Pause the campaign and review the list. |
| Hard bounce rate | Your email platform | It rises above your normal level. Stop and verify the list. |
| Domain and IP reputation | Google Postmaster Tools, Microsoft SNDS | Reputation drops from high to medium or low. |
| Inbox placement | Seed-address tests | Mail moves to spam at any one provider. |
| Blocklists | Public blocklist lookup tools | Your domain or IP is listed. |
| Replies and opt-outs | Your inbox and email platform | Opt-outs climb, or replies turn negative. |
Judge campaigns by replies, sales-accepted leads and the lead-to-SAL ratio, not by opens. Open rates are distorted by privacy features such as Apple Mail Privacy Protection.
Cold email and opted-in email follow different rules.
| Cold B2B outreach | Opted-in newsletters and nurture | |
|---|---|---|
| Basis for sending | US: no prior consent needed, but all CAN-SPAM rules apply. EU and UK: usually legitimate interest, with a documented assessment. Canada: express or implied consent. | Consent recorded at sign-up. Keep the date, source and wording. |
| Every message | Accurate From and subject line, your identity, a valid physical address, and a working opt-out. | The same, plus content that matches what people signed up for. |
| Opt-outs | Honour them promptly. CAN-SPAM allows 10 business days, and providers expect two days. | Process them within two days and suppress the address permanently. |
| Penalties | CAN-SPAM fines run to tens of thousands of dollars per email. GDPR fines reach 4% of global turnover. CASL fines reach CAD 10 million per violation. | Same laws apply. |
India's Digital Personal Data Protection Act also covers how you collect and use personal data, so check it if you email contacts in India. This guide is general information, not legal advice. Take advice for the countries you target.
Already in spam? A 30-day recovery plan.
Stop and diagnose
Pause campaigns. Check SPF, DKIM and DMARC, blocklists, Postmaster Tools and your bounce and complaint rates. Find which list or campaign caused it.
Clean and rebuild
Cut the list to engaged and verified contacts. Remove everyone who bounced or complained. Restart at a fraction of your old volume, to your most engaged people first.
Grow carefully
Increase volume a little at a time while complaints stay low. If a domain stays damaged, retire it and warm a new one. Do not use your main domain as the fix.
Before every campaign.
- SPF, DKIM and DMARC pass on every domain you send from.
- Cold outreach is not on your main domain.
- The list is verified, and nobody inactive is on it.
- Unsubscribe works, visible link and one-click header.
- Volume is ramped, not jumped.
- Postmaster Tools and bounce reports are checked weekly.
- Complaints are under 0.10%. If not, pause.
Take the checklist to your team.
A printable pre-send checklist: authentication, domains and warmup, lists, content, monitoring and the law.
- Authentication and warmup steps
- List hygiene and content rules
- Weekly monitoring thresholds