Cold email deliverability: SPF, DKIM, DMARC and the bulk sender rules

Cold email deliverability is whether your messages reach the inbox rather than the spam folder or a rejection notice. For a founder doing their own outreach, it rests on two things you control: DNS records called SPF, DKIM and DMARC that prove the mail really comes from your domain, and a list clean enough that few messages bounce and few people report you as spam.

Google and Yahoo began enforcing sender requirements in February 2024, and Microsoft added its own for Outlook.com in May 2025. The strictest rules target senders of about 5,000 messages a day, but some apply to everyone, including a founder sending a few dozen to a few hundred emails a day. In short: Gmail and Yahoo set a hard spam rate limit of 0.3%, and a DMARC policy of p=none is the minimum all three accept.

SPF, DKIM and DMARC in plain words

All three are short text records in your domain's DNS, the internet's public address book.

SPF: who may send for your domain

SPF (Sender Policy Framework) lists the servers allowed to send email for your domain, and the receiving server checks each message against it. One trap: RFC 7208, the standard that defines SPF, caps an SPF check at 10 DNS lookups. Past that, the check returns a permanent error and SPF does not pass. Each sending tool you add usually counts toward the limit, and Microsoft's FAQ gives the same warning.

DKIM: a signature on every message

DKIM (DomainKeys Identified Mail) adds a digital signature to each email. The matching public key sits in your DNS, so the receiver can confirm that your domain signed the message and nobody changed it on the way. Google requires a DKIM key of at least 1024 bits for mail to personal Gmail accounts and recommends 2048 bits where possible.

DMARC: the check that ties them together

DMARC (Domain-based Message Authentication, Reporting and Conformance) asks one question: does the domain in the From line, the one your prospect sees, match the domain that passed SPF or DKIM? That match is called alignment. The record also says what to do with mail that fails, and where to send reports.

An illustrative starting record for the placeholder domain example.com:

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

p=none means "monitor, do not block," and rua is the address that receives the reports. Stricter policies (quarantine, reject) mainly stop people from forging your domain. Microsoft advises moving to them gradually, once all your legitimate sending sources are aligned, because a strict policy set up wrong blocks your own mail.

To check your setup, send a test to a personal Gmail address, open it and choose "Show original." Gmail shows whether SPF, DKIM and DMARC passed.

The Gmail, Yahoo and Microsoft sender rules

Providers update these pages, so check each source.

Gmail (since February 2024)

Google's email sender guidelines cover mail to personal Gmail accounts. Its sender FAQ says they do not apply to Google Workspace accounts, which many B2B prospects use. That is no free pass: business inboxes filter spam too.

Among other things, every sender to personal Gmail accounts must:

• set up SPF or DKIM
• have valid forward and reverse DNS records (PTR records) for the sending domain or IP
• use a TLS (encrypted) connection
• format messages according to the internet message standard, RFC 5322
• keep the spam rate reported in Postmaster Tools below 0.3%

Google's sender FAQ defines a bulk sender as one that sends close to 5,000 messages or more to personal Gmail accounts within 24 hours. All mail from the same primary domain counts together, subdomains included, and a sender that meets this once is permanently treated as a bulk sender. Bulk senders must also:

• set up both SPF and DKIM, plus DMARC (a policy of none is enough)
• align the From domain with the SPF or DKIM domain
• support one-click unsubscribe on marketing and subscribed messages

The FAQ also recommends processing unsubscribe requests within 48 hours. Since November 2025, it adds, Gmail has been ramping up enforcement, with temporary and permanent rejections of non-compliant mail.

Yahoo (since February 2024)

Yahoo's sender requirements follow the same pattern. All senders need SPF or DKIM, valid forward and reverse DNS, and a spam rate below 0.3%. Bulk senders need both SPF and DKIM, an aligned From domain, and a DMARC policy of at least p=none, and Yahoo states that DMARC must pass. They must also honor one-click unsubscribes within 2 days. Yahoo gives no volume number for "bulk."

Microsoft Outlook.com (since May 2025)

Microsoft's requirements for high-volume senders cover its consumer addresses (outlook.com, hotmail.com, live.com) and apply to domains sending over 5,000 emails per day. SPF and DKIM must pass, and DMARC must be at least p=none and aligned with SPF or DKIM. An April 29, 2025 update to the announcement says that from May 5, 2025, messages failing these checks are rejected with the error "550 5.7.515" instead of going to Junk. Microsoft publishes no spam complaint threshold.

What this means at founder volume

A founder sending a few dozen to a few hundred cold emails a day is far below 5,000, but still falls under the rules for all senders, including the spam rate limit. Setting up all three records takes little time, so treat the bulk rules as your baseline. Send cold email from separate domains, never from your main one. See how many mailboxes and sending domains you need.

Spam rate: the one hard limit

The 0.3% figure is the only hard spam limit Google and Yahoo publish. Google also gives a recommended target: keep the rate below 0.1% and avoid ever reaching 0.3%.

Postmaster Tools divides spam reports by the messages delivered to engaged recipients' inboxes, not by everything you send. In plain arithmetic, 0.3% is 3 spam reports per 1,000 messages delivered to the inbox, and 0.1% is 1 per 1,000. A rate computed from your own sending totals will look lower than the one Google sees.

Spam reports come from people. Your best protection is writing only to people who plausibly have the problem you solve, and making it easy to say no with a one-line reply.

Bounce hygiene and list verification

A bounce is a message returned undelivered. A hard bounce means the address does not exist. A soft bounce is temporary, such as a full mailbox.

Google, Yahoo and Microsoft publish no bounce threshold. A common practice among outbound teams is to keep hard bounces under about 2% of sends, and to pause and clean the list above that. Treat it as a convention, not a rule. The providers point the same way: Google advises senders to automatically unsubscribe recipients who have multiple bounced messages, and Microsoft's FAQ suggests removing inactive or invalid addresses monthly or quarterly.

In practice:

• Run every new list through an email verification service before the first send. It estimates whether each address exists without emailing it, and flags risky or unknown ones, such as domains that accept all mail.
• Remove hard bounces at once. Retry soft bounces later and drop the address after several failures.
• Re-verify a list that has sat unused for a few months. People change jobs.

Plain-text first emails, without links or tracking

Most sending tools can add a tracking pixel, a tiny invisible image that reports opens, and tracked links that route clicks through a redirect domain. Both add HTML and an extra domain for the filter to judge, and neither appears in a normal email between two people.

Opens are a weak signal anyway: software can load an image without anyone reading the email.

Many teams send the first email as plain text, with tracking off and no links, apart from a privacy-notice link where EU or UK rules call for one (is B2B cold email legal), and measure replies instead. To share a page, send the link once the person answers. Writing that first email is covered in how to write a short B2B cold email sequence.

Blocklists

A blocklist (often called a blacklist) is a list of IP addresses or domains that receiving servers consult when filtering mail. Spamhaus is a well-known operator of such lists. Google's guidelines note that messages from IP addresses on a blocklist are more likely to be marked as spam.

On Google Workspace or Microsoft 365, the sending IPs belong to the provider, so the part you control is your domain. You can look it up for free on the Spamhaus checker, which also explains removal. If you are listed, fix the cause first, often a poor list or a sudden jump in volume.

Monitoring with Google Postmaster Tools

Google Postmaster Tools is a free dashboard showing how Gmail sees mail from your domain. Once each sending domain is verified, its dashboards include:

• Compliance status: whether you meet each sender requirement
• Spam rate: as defined above
• Domain reputation: rated Bad, Low, Medium or High
• Authentication: the share of your mail that passes SPF, DKIM and DMARC

Google may leave data out on low-volume days to protect user privacy, so a small sender's charts can stay empty. Also, a very low spam rate is not always good news: Google's troubleshooting notes it can mean much of your mail already lands in spam, where fewer people see it.

A simple routine:

• Daily, while you send: hard bounces per campaign in your sending tool
• Weekly: spam rate, domain reputation and compliance in Postmaster Tools
• Weekly: a Spamhaus lookup per sending domain
• Replies: a sudden drop with the same list and copy often points to a placement problem

New mailboxes also need time before carrying real volume: see how long to warm up a new mailbox.

Key takeaways

• SPF lists who may send for you, DKIM signs each message, and DMARC checks that the visible From domain matches. Start DMARC at p=none.
• Gmail and Yahoo set a hard limit of 0.3% spam reports for every sender. Google recommends staying under 0.1%.
• Stricter rules start around 5,000 messages a day at Google and Microsoft. At Google, bulk status is permanent.
• Google, Yahoo and Microsoft publish no bounce threshold. Verify lists, remove hard bounces, and keep them under about 2%, a convention rather than a rule.
• A common practice: send the first email in plain text, without a tracking pixel or marketing links.
• Check bounces daily while you send, and Postmaster Tools and blocklists weekly.