Cold email deliverability in 2026: Google, Yahoo and Microsoft sender rules

To get cold email delivered in 2026, you need SPF, DKIM and DMARC set up on your sending domain, a spam complaint rate well below 0.1%, a working one-click unsubscribe, and volume that grows slowly. That's what Google, Yahoo and Microsoft now require or recommend, and since February 2024 (Google and Yahoo) and May 2025 (Microsoft) they've enforced it with spam foldering and rejections.

One thing most cold email advice skips: these published rules are written for consumer mailboxes such as @gmail.com, Yahoo, AOL and Outlook.com. Google's FAQ says its guidelines "don't apply to messages sent to Google Workspace accounts", which is where most B2B cold email goes. We couldn't find published thresholds for business mailboxes, so the consumer rules are the best public guide to what mailbox providers expect. Treat them as the minimum.

This guide covers deliverability only. Whether you're allowed to send cold email at all depends on the recipient's country: see how to find clients for your agency for the US, UK, EU, Australian and Canadian rules side by side.

The three providers' rules side by side (checked 28 Oct 2026)

Sources: Google's email sender guidelines and FAQ, Yahoo's sender best practices and FAQ, and Microsoft's Outlook announcement, all checked 28 Oct 2026.

Google: what Gmail requires

From 1 February 2024, every sender to personal Gmail accounts must set up SPF or DKIM, have valid forward and reverse DNS (PTR records), use TLS, format messages to RFC 5322 and keep spam rates "reported in Postmaster Tools below 0.3%". Elsewhere on the same page Google says to keep spam rates "below 0.10% and avoid ever reaching a spam rate of 0.30% or higher".

If you send more than 5,000 messages a day, you also need SPF and DKIM, a DMARC record ("Your DMARC enforcement policy can be set to none"), a From: domain aligned with SPF or DKIM, and one-click unsubscribe on "marketing messages and subscribed messages".

Three details from the FAQ matter for cold email:

• Subdomains don't split the count. "Messages sent from the same primary domain count toward the 5,000 limit." Sending 2,500 from your main domain and 2,500 from a subdomain makes you a bulk sender.
• Bulk status is permanent. "Senders who meet the above criteria at least once are permanently considered bulk senders."
• New domains get less patience. A new domain is one that hasn't sent more than 5,000 a day to personal Gmail since 1 January 2024, and "the enforcement progression for new domains will be on an accelerated timetable".

Google also says that "starting November 2025, Gmail is ramping up its enforcement", with "temporary and permanent rejections" for mail that fails the requirements.

Be honest with yourself about one line in the guidelines: "Don't send messages to people who didn't sign up to get messages from you." Google also says not to buy addresses. Cold email cuts against that advice by definition, which is why the complaint rate is the number that decides whether it works.

Yahoo: what Yahoo and AOL require

Yahoo's requirements apply to "all domains and consumer email brands hosted by Yahoo Mail", including AOL. All senders need SPF or DKIM "at a minimum", a spam rate below 0.3%, valid forward and reverse DNS, and compliance with RFCs 5321 and 5322.

Bulk senders need both SPF and DKIM, a DMARC policy of "at least p=none" that passes, a From: domain aligned with SPF or DKIM, a List-Unsubscribe header supporting one-click unsubscribe, a visible unsubscribe link in the body, and unsubscribes honoured "within 2 days". Yahoo won't say what makes you bulk: "We will not specify a volume threshold." Assume it's you.

Yahoo also recommends not sending bulk or marketing mail from the same IPs you use for user or transactional mail, and enrolling your DKIM domain in its Complaint Feedback Loop so you get a copy of every spam complaint.

Microsoft: Outlook.com, Hotmail and Live

Microsoft's announcement applies to "Outlook.com - our consumer service, which is supporting hotmail.com live.com and outlook.com consumer domain addresses", for "domains sending more than 5,000 emails per day". They need SPF, DKIM and DMARC of "at least p=none" aligned with SPF or DKIM, "preferably both". It also recommends a From: or Reply-To address that "can receive replies", working unsubscribe links, regular list cleaning, and making sure recipients "have consented".

Microsoft's own pages disagree on what happens to mail that fails:

Either way, failing mail doesn't reach the inbox. Plan for rejection. The post also says adding yourself to a recipient's safe senders list won't get you around it.

Set up SPF, DKIM and DMARC

You do this once per sending domain, at your DNS host. Google's own setup pages are a clear walkthrough even if you use another provider.

1. SPF. Publish an SPF TXT record listing every service that sends as your domain. Google's SPF page gives v=spf1 include:_spf.google.com ~all for Google Workspace, with an extra include: for each other sender, and says "each domain must have its own SPF record". Microsoft warns that more than 10 DNS lookups can make SPF fail, so don't stack includes for tools you no longer use.
2. DKIM. Turn on signing in your email provider and publish the public key it gives you. Google's DKIM page recommends a 2048-bit key where your DNS host supports it.
3. DMARC. Google's DMARC page says to "allow 48 hours after setting up SPF and/or DKIM before setting up DMARC". Start with v=DMARC1; p=none; rua=mailto: plus an address you read, so you get reports. Microsoft advises moving "gradually (none → quarantine → reject)" once your legitimate senders pass.
4. One-click unsubscribe. Your sending tool must add both List-Unsubscribe and List-Unsubscribe-Post: List-Unsubscribe=One-Click headers, as described in RFC 8058. Google says mailto and plain URL links "don't meet our one-click unsubscribe requirement".

A separate sending domain and warm-up

A separate domain is our suggestion, not a provider rule. Sending cold outreach from a second domain you own (for example getyourbrand.com alongside yourbrand.com) keeps complaints from that outreach away from the domain that sends your invoices, password resets and replies to customers. The closest provider support is Yahoo's advice to separate email types "by IP or DKIM domain" and Google's advice that "messages of the same category should have the same From: email address". A subdomain also separates reputation to a degree, but remember Google counts it towards the same 5,000 limit. Whatever you use, authenticate it fully and make sure replies reach a real inbox.

Warm-up: Google's words, then our numbers. Google says to "start with a low sending volume to engaged users, and slowly increase the volume over time", to "send email at a consistent rate" and that "immediately doubling previously sent volumes suddenly could result in rate limiting or reputation drops". No provider gives numbers. Our suggestion for one new mailbox: a few personal emails a day to people you know will reply for the first couple of weeks, then add no more than about 20% a week, and stop increasing the moment bounces or complaints rise.

Monitor the numbers that matter

• Google Postmaster Tools for your spam rate, authentication and domain reputation. Google says it "doesn't track open rates" and that low open rates "aren't necessarily an accurate indicator" of deliverability problems.
• Yahoo's Complaint Feedback Loop for copies of spam complaints against your DKIM domain.
• DMARC reports (the rua address) to see who's sending as your domain.
• Bounces. If messages start bouncing or being deferred, Google says to reduce volume until errors fall, then increase slowly again.

Common mistakes

• Assuming you're under the limits so nothing applies. Google's all-sender rules start at message one, and Yahoo won't tell you where bulk begins.
• Splitting volume across subdomains to stay under 5,000. Google counts them together.
• Using a fake "Re:" subject. Google says not to start subjects with Re: or Fwd: unless the message really is a reply or forward.
• Judging success by open rates. Watch complaints, replies and bounces instead.
• Buying a list. Google and Yahoo both say not to, and it's the fastest way to a high spam rate.
• Leaving DMARC at none forever once you know your legitimate senders pass.

Checklist

1. Pick your sending domain (separate from your main one, if you follow our suggestion) and set up a real inbox for replies.
2. Publish an SPF record that lists every service sending as that domain.
3. Turn on DKIM with a 2048-bit key if your DNS host supports it.
4. Wait 48 hours, then publish DMARC at p=none with a reporting address.
5. Make sure your sending tool adds RFC 8058 one-click unsubscribe headers and a visible opt-out link, and removes people within 48 hours.
6. Register the domain in Google Postmaster Tools and Yahoo's Complaint Feedback Loop.
7. Check the law in each recipient's country before you send.
8. Start low, grow slowly, and keep the spam rate well under 0.1%.
9. Move DMARC towards quarantine, then reject, once reports show only your own senders.
10. Recheck the three providers' pages every quarter.

Where to go next

Read how to find clients for your agency for whether cold email is legal in the US, UK, EU, Australia and Canada, and getting your first customers without ads for channels that don't depend on cold email at all. If you'd like to swap notes on outbound with other founders, you can join Remote Builders: it's free, and you're in straight away.