The 2025 Crackdown and What It Means for 2026
In October 2025, Google and Microsoft simultaneously rolled out significant changes to their bulk sender requirements. What had been best-practice recommendations became hard requirements — with automatic filtering or outright rejection for senders who didn't comply.
If you're still running campaigns the way you were two years ago, your inbox placement has almost certainly degraded, even if your bounce rate looks fine.
Here's a complete rundown of what changed and what you need to do about it.
Authentication Is Now Mandatory, Not Optional
SPF (Sender Policy Framework)
SPF has always been important. Now, bulk senders (more than 5,000 messages/day to Gmail) who fail SPF authentication are automatically routed to spam.
If you haven't already, publish an SPF record in your DNS that authorizes every IP and service you send from. A permissive record is better than no record — but a precise record is better still.
DKIM (DomainKeys Identified Mail)
DKIM adds a cryptographic signature to every outgoing message that recipients can verify. Without it, inbox providers have no way to confirm your message wasn't tampered with in transit.
Use 2048-bit keys and rotate them every 12 months minimum. 1024-bit keys are now considered weak and may trigger filtering.
DMARC (Domain-based Message Authentication, Reporting & Conformance)
DMARC ties SPF and DKIM together and tells inbox providers what to do when both fail: nothing (p=none), quarantine (p=quarantine), or reject (p=reject).
As of 2025, Gmail requires a DMARC policy for all bulk senders. Start with p=none to collect reports without impacting delivery, then graduate to p=quarantine and eventually p=reject as your authentication is confirmed solid.
BIMI (Brand Indicators for Message Identification)
BIMI is newer and not a hard requirement, but it's increasingly a deliverability signal. It allows verified brands to display their logo in the inbox, improving recognition and trust. Implementing BIMI requires a valid DMARC policy at enforcement level (p=quarantine or p=reject) and a Verified Mark Certificate (VMC).
List Quality as a Ranking Signal
Inbox providers have become much more sophisticated about using engagement signals to route mail. This means your list quality directly affects inbox placement for every message you send — not just the ones going to bad addresses.
Key engagement signals that help you:
- Opens (though Apple MPP has muddied this water)
- Clicks — the strongest positive signal
- Replies — treated as very strong positive engagement
- Not marked as spam — absence of negative signal
- Moved from spam to inbox — strong positive signal
Key signals that hurt you:
- Spam reports — even a 0.1% complaint rate starts to damage reputation
- Deletes without opening — signals low relevance
- Ignored for 6+ months — stale contacts drag down overall engagement metrics
The practical implication: scrub your list aggressively. Contacts who haven't opened or clicked in 12 months should be suppressed or sent a re-engagement campaign with an easy unsubscribe path. If they don't re-engage, let them go.
Infrastructure Requirements for High-Volume Sending
Dedicated IPs and Warming
Shared IP pools mean your reputation is partially determined by the behavior of other senders. For any organization sending more than 50,000 messages per day, a dedicated IP with a proper warmup plan is worth the investment.
Warming a new IP:
- Day 1–7: 500 messages/day to your most engaged contacts
- Day 8–14: 2,000 messages/day
- Day 15–21: 10,000 messages/day
- Day 22–30: 50,000 messages/day
- After 30 days: scale to target volume
Skip this process and your first large send will be flagged by every major provider.
Subdomain Strategy
Send from a subdomain (mail.yourdomain.com, campaigns.yourdomain.com) rather than your root domain. If your sending reputation takes a hit, it doesn't contaminate the root domain used by your website and transactional emails.
Feedback Loop (FBL) Registration
Major ISPs allow you to register for Feedback Loops — notifications when a recipient marks your message as spam. Register at every provider that offers FBL (Comcast, Microsoft, Yahoo/AOL). Process these reports and suppress complainants immediately.
Content Signals That Modern Filters Catch
Content filtering has become much smarter. Modern spam filters aren't looking for specific words — they're evaluating the entire message context.
Things that hurt:
- Heavy image-to-text ratios (lots of images, very little text)
- URL shorteners (especially generic ones like bit.ly)
- Misleading subject lines that don't match body content
- Excessive use of all-caps or exclamation marks in subject lines
- Hidden text or text that matches background color
- Attachments in cold outreach
Things that help:
- Balanced text and image content
- Links to your own domain (not redirects or shorteners)
- Consistent from-name and domain across sends
- Genuine personalization (not just {first_name} merge tags)
- Plain-text alternative versions of HTML emails
The Unsubscribe Experience
One-click unsubscribe is now a Gmail requirement for bulk senders. This means a List-Unsubscribe header with a working POST endpoint — not just a link buried in the footer that takes five clicks and a form fill to complete.
Counterintuitively, making unsubscribes easy improves your deliverability. A contact who can't find the unsubscribe button will mark you as spam instead — which is much more damaging.
Monitoring Your Reputation
You can't improve what you can't see. Set up:
- Google Postmaster Tools — Track domain and IP reputation, spam rate, and authentication compliance for Gmail delivery
- Microsoft SNDS (Smart Network Data Services) — Equivalent monitoring for Outlook/Hotmail
- MXToolbox — Check if your IPs have landed on any blocklists
- Return Path/Validity — Third-party reputation monitoring across ISPs
Check these dashboards weekly if you're a regular sender. A reputation problem caught early can be corrected in days; caught late, it can take months to recover.
A Deliverability Checklist for 2026
Before every bulk campaign:
- SPF, DKIM, and DMARC all passing for sending domain
- List verified within the last 90 days
- Hard bounces from last campaign suppressed
- Contacts inactive for 12+ months excluded or in re-engagement segment
- One-click unsubscribe working and List-Unsubscribe header present
- Subject line matches body content
- No URL shorteners in links
- Preview text set and compelling
- Seed list test sent and reviewed across major clients (Gmail, Outlook, Apple Mail)
Follow this checklist consistently and your campaigns will reach inboxes. Skip it and you're gambling with a channel that took years to build.