Email Deliverability in 2026: From Rules to Enforcement

Inbox providers stopped warning senders in 2025. They started rejecting them.

If your bounce rate spiked this year, or your campaigns suddenly stopped performing, the rules changed under you — and most deliverability guides are still catching up. By the end of this post you'll know exactly what Gmail and Microsoft changed, what the regulatory fines signal about where enforcement is heading, and what your list hygiene has to do with all of it.

The part most guides skip: a dirty list is no longer just a performance liability. Under 2026 enforcement, it's a compliance one.

What actually changed in 2025–2026 (the short version)

The headline is simple. Gmail moved from spam-foldering non-compliant mail to rejecting it at the SMTP level — a 550 error code, not a soft bounce. Microsoft followed on May 5, 2025 with the same enforcement posture. Yahoo and Apple tightened complaint-rate handling. And regulators in Australia and the UK started issuing fines large enough to appear in earnings calls.

The January 2026 outages — Yahoo on the 21st, Microsoft on the 22nd — added noise on top of the enforcement story. Senders mid-campaign saw bounce spikes that had nothing to do with their authentication setup. That's worth separating from the structural changes, because confusing an infrastructure outage with a compliance failure leads to the wrong fix.

Here's the number that matters most: 70.9% of domains still have no effective DMARC policy. The gap between what inbox providers now require and what senders have actually deployed is the single largest deliverability risk in 2026 — bigger than any individual error code.

The Gmail enforcement shift: from warning to rejection

Before mid-2024, Gmail's bulk sender requirements existed on paper. Non-compliant mail landed in spam but still delivered. Senders who ignored the February 2024 announcement deadline discovered, gradually, that "delivering to spam" was the optimistic outcome.

Post-enforcement, the sequence is binary. Missing SPF, DKIM, or DMARC alignment — or crossing a complaint rate of 0.10% — triggers a 550 rejection at the SMTP handshake. The message never enters Gmail's queue. It doesn't bounce softly. It doesn't land in spam. It gets refused at the door, and your sending infrastructure logs a hard bounce.

Google Postmaster Tools v2 now surfaces complaint rate as the primary dashboard metric. Senders who ignored it before 2024 are the ones seeing hard bounces today. The math is unforgiving: on a 50,000-send campaign, 50 spam complaints puts you at exactly 0.10% — the threshold at which Gmail begins enforcement review. One disengaged segment, one purchased list, one re-engagement campaign sent to addresses that have been cold for 18 months, and you're there.

One-click unsubscribe — specifically RFC 8058's List-Unsubscribe-Post header — is enforced for bulk senders. This is not a suggestion and it's not a spam filter signal. A missing header is a rejection trigger. The Lululemon fine in Australia (more on that below) shows that regulators are reaching the same conclusion through a different mechanism.

The practical implication is the one most guides bury: a dirty list that previously cost you open rate now costs you deliverability outright. Every invalid address, every spamtrap, every address that hasn't engaged in two years is a potential complaint waiting to happen. Before 2024, that complaint landed you in the spam folder. In 2026, it lands you in the rejection log.

Run a check your SPF record and a check your DMARC record before you touch anything else. Authentication failures are the fastest path to a 550 rejection, and both checks take under 60 seconds.

Microsoft's parallel enforcement and the 550 5.7.515 code

Microsoft's May 5, 2025 enforcement announcement didn't get the same industry attention as Gmail's, but the rejection behavior is identical in effect. The specific code to know is 550 5.7.515: the sending domain failed the required authentication level for Hotmail, Outlook.com, or Microsoft 365 delivery.

Al Iverson at Spam Resource documented four distinct Microsoft DKIM rejection patterns in May 2026. The most common is a 5322.From domain mismatch — where the DKIM signature is valid but the signing domain doesn't align with the visible From address. This is an alignment problem, not a key problem. Fixing the key doesn't fix it. You need to ensure the d= value in your DKIM signature matches the domain in your From header.

Hotmail, Outlook.com, and Microsoft 365 collectively cover a significant share of B2B inboxes. Fixing Gmail authentication while leaving Microsoft misconfigured is a half-measure — you'll see clean Gmail delivery metrics and still be accumulating 550s from a population you can't see in Google Postmaster Tools.

The January 22, 2026 Microsoft outage adds a wrinkle. The outage lasted nearly 11 hours. Senders who queued retries without exponential backoff during that window compounded the bounce spike — retry storms on a recovering mail server produce temporary failures that look like authentication rejections in poorly configured logging. If your bounce rate spiked on January 22, check whether the failures were 4xx (temporary, outage-related) or 5xx (permanent, authentication-related) before changing your DNS.

The fix sequence for Microsoft 550 5.7.515 errors: DKIM alignment first, then DMARC policy moved to p=quarantine or higher, then monitor via DMARC Report Analyzer for rejection patterns specific to Microsoft's infrastructure. Microsoft's aggregate DMARC reports use slightly different failure reason taxonomy than Google's — the report analyzer will parse both.

DMARC in 2026: still the biggest gap

70.9% of domains have no effective DMARC policy. "No effective policy" means p=none or no DMARC record at all — both tell inbox providers to do whatever they were going to do anyway. p=none generates reports, which is useful for auditing, but it provides zero enforcement signal.

BIMI adoption is growing, and brand logos in Gmail inboxes are a real conversion lift in A/B tests. But BIMI requires a DMARC policy at p=quarantine or p=reject, plus a Verified Mark Certificate (VMC) for Gmail display. Senders chasing the logo without fixing DMARC first are building on a foundation that doesn't exist yet.

MTA-STS is now treated as a baseline expectation by major providers. It prevents downgrade attacks on SMTP connections — without it, an attacker between your sending server and the recipient's server can strip TLS and read the message in plaintext. Pair MTA-STS with DMARC enforcement; they solve different attack vectors and both are now expected.

DKIM2 is circulating in technical newsletters as the next evolution of email authentication. Most coverage is getting the details wrong. DKIM2 is not enforced anywhere and the RFC has not finalized. If you're seeing it in a deliverability guide telling you to act now, that's noise. Monitor the IETF working group; don't change infrastructure for a spec that isn't done.

The practical DMARC roadmap hasn't changed, because it's correct: start at p=none with rua and ruf reporting addresses set. Read the aggregate reports for 30 days — use the DMARC Report Analyzer to parse the XML without doing it by hand. Move to p=quarantine once you've confirmed your legitimate sending streams are aligned. Move to p=reject once quarantine has been stable for 30 days. That's it. The roadmap that takes six months takes six months because senders discover shadow sending streams they didn't know about at the p=none stage — not because the steps are complicated.

Regulatory enforcement is accelerating alongside inbox provider rules

Australia's ACMA fined Lululemon A$702,900 for 370,000 emails sent without compliant unsubscribe mechanisms. The ruling turned on a classification question: transactional-looking emails that contained promotional content were ruled commercial, not transactional. The unsubscribe requirement applied. Lululemon didn't have it. Fine issued.

That's the precedent that matters for brands straddling transactional and promotional content in the same send. If a receipt email contains a promotional banner, a discount code, or a product recommendation, regulators in Australia — and increasingly in the UK — will classify it as commercial.

ACMA went further in May 2026, fining Latitude Finance A$3.96 million for separate spam breaches. That's the largest fine in the regulator's history, and it signals that the A$702,900 Lululemon fine was not an outlier — it was a floor.

In the UK, the ICO updated guidance on soft opt-in and legitimate interest rules in May 2026. UK senders should audit their legal basis for each list segment before the next campaign — "legitimate interest" as a blanket basis for commercial email is getting narrower.

In the US, a federal judge ruled that Skechers must face a false-urgency email class action. Manufactured scarcity in subject lines — "Only 3 left!" when inventory is fine, "Offer expires tonight!" when it doesn't — is now litigation risk, not just a deliverability risk. The FTC's guidance on deceptive subject lines has existed for years; plaintiffs' attorneys are now using it.

The pattern across all of these: regulators and inbox providers are converging on the same behaviors from different enforcement directions. Missing unsubscribe. Fake urgency. Purchased lists. Sending to people who didn't ask for the mail. Inbox providers reject the mail. Regulators fine the sender. The behaviors in the crosshairs are identical.

List hygiene is now a compliance input, not just a performance metric

This is the argument most deliverability guides don't make explicitly, so let's make it: under 2026 enforcement rules, a dirty list is a compliance liability. Not just a bounce problem. Not just a sender reputation drag. A compliance liability.

Gmail's 0.10% complaint rate threshold sounds generous. Do the math. On a 50,000-send campaign, 50 spam complaints triggers enforcement review. Stale addresses — ones that haven't engaged in 12+ months — are significantly more likely to have been recycled into spamtraps. They're also more likely to belong to users who have forgotten they subscribed and will click "report spam" instead of "unsubscribe" when they see your name in their inbox.

Catch-all domains are a specific 2026 problem. Microsoft tightened catch-all handling in its enforcement wave, meaning addresses that previously returned a soft bounce — or no bounce at all, because the catch-all accepted everything — now return hard bounces. Senders who built lists against catch-all domains over the past few years are discovering this the hard way.

What does that mean operationally? The unknown verification result — where neither SMTP probe can confirm whether a mailbox exists — is the signal to drop an address before sending, not after the bounce. An unknown result on a catch-all domain means the domain accepts everything at the MX level but you have no confirmation the specific mailbox exists. Sending to it is a gamble. Under current enforcement, it's a gamble with your sender reputation as the stake.

Verification before every new campaign send is the operational habit that separates senders who stayed compliant through the 2025–2026 enforcement wave from those who didn't. It's not glamorous. It doesn't show up in a case study. But the senders running at 5,000+ sends per day without complaint rate problems all share one thing: they verify before the job queues, every time.

What hasn't changed (and won't)

Sender reputation is still domain + IP + content + engagement. The weighting has shifted toward authentication and complaint rate, but all four inputs still matter. Fixing DMARC while sending irrelevant content to a cold list will improve your authentication score and leave your engagement score in the floor — inbox providers weight both.

Apple Mail Privacy Protection, introduced in 2021, still inflates open rates for Apple Mail users. Open rate has been a broken metric for five years. If your reporting still treats opens as a primary engagement signal, your segmentation is built on a number that Apple is pre-populating for you. Clicks, replies, and moves out of spam are the engagement signals that actually reflect recipient behavior.

Permission is still the foundation. Every regulatory enforcement action in 2025–2026 — the Lululemon fine, the Latitude Finance fine, the Skechers litigation — traces back to a single root cause: sending to people who didn't clearly ask for the mail, or sending content the recipient didn't consent to receive. Technical authentication is necessary but not sufficient. A DMARC-aligned phishing campaign is still a phishing campaign.

Warm-up is still required for new IPs and domains. The timeline for transactional senders is days, not the six-week ramp that marketing guides recommend. Transactional mail — receipts, password resets, account notifications — earns high engagement signals quickly because recipients expect it and open it. Marketing mail earns those signals more slowly. Applying a marketing warm-up schedule to a transactional sending stream is over-cautious and delays deployment unnecessarily.

Your 2026 compliance checklist

Run through these in order. Authentication first, then complaint rate management, then list quality. Each layer depends on the one before it.

1. SPF: one record per domain, under 10 DNS lookups, no conflicting mechanisms. Use the SPF Record Checker to count your lookups — exceeding 10 causes a PermError that fails authentication silently.
2. DKIM: 2048-bit keys, signing domain aligned with the From domain, rotated at least annually. Check the d= value against your From header — misalignment is the most common Microsoft 550 5.7.515 root cause.
3. DMARC: p=quarantine or p=reject, rua and ruf reporting addresses set, aggregate reports reviewed weekly. Use the DMARC Record Checker to confirm your record is parsing correctly.
4. One-click unsubscribe: List-Unsubscribe-Post header on every bulk send, honored within two business days. Missing this header is a Gmail rejection trigger for bulk senders.
5. Complaint rate: below 0.10% in Google Postmaster Tools. Check it before every campaign, not after. On a 50,000-send list, 50 complaints puts you at the threshold.
6. List verification: run a sample through an 11-stage verifier before each send. Drop invalid, spamtrap, and unknown results before the job queues — these three statuses are the primary drivers of complaint rate spikes and hard bounces.
7. BIMI (optional, but growing): a VMC certificate is required for Gmail logo display. Only worthwhile after DMARC is at p=reject and has been stable for at least 30 days.

The 2025–2026 enforcement wave didn't change what good sending looks like — it changed the cost of ignoring it. Authentication failures used to land you in spam. Now they land you in the rejection log. Complaint rate spikes used to hurt open rates. Now they trigger SMTP-level blocks. The fastest way to find out where your list stands is to run a sample through a verifier and read the failure mix before your next send — not after the bounce report comes back.